Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/06/2023, 08:04
Behavioral task
behavioral1
Sample
2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
-
Size
877KB
-
MD5
9d8e89b9385730b406a3a1aca542568d
-
SHA1
e681e7b38ddfcfecc5574b893b30ba5744c04bb9
-
SHA256
2bbff41fc9130ce1d19babdbe120a44a4d3c40d08b6ffd0edc65a3a71da41ebf
-
SHA512
4a947d095d2c463292e9e8f67497e3d73fb63721a3e1aef83f93f617381b7b4dc951e9dc27b0a46e5b724446dd8d18ab0e69cb92849e644154ce4ee4c2bbd790
-
SSDEEP
12288:VNsvP/BulDVh+OqcAJCDSnuvVjt7wce7KpTOpdBdNd9Rkv9i2cNJoWg+h6/j/dxX:haNu/iJNolNQ+00
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\How to Recovery.bat
33j4JbAEzZwWGgA2MxBARD7zprJuNDP2hP
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 9 IoCs
resource yara_rule behavioral1/files/0x000a00000001230b-56.dat family_chaos behavioral1/files/0x000a00000001230b-58.dat family_chaos behavioral1/files/0x000a00000001230b-62.dat family_chaos behavioral1/memory/360-65-0x0000000000210000-0x00000000002E8000-memory.dmp family_chaos behavioral1/files/0x0009000000012313-67.dat family_chaos behavioral1/files/0x0009000000012313-70.dat family_chaos behavioral1/files/0x0009000000012313-69.dat family_chaos behavioral1/memory/268-71-0x0000000001380000-0x0000000001458000-memory.dmp family_chaos behavioral1/memory/360-90-0x000000001B010000-0x000000001B090000-memory.dmp family_chaos -
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000100000001031f-64.dat family_neshta behavioral1/files/0x000900000001231c-72.dat family_neshta behavioral1/files/0x000900000001231c-73.dat family_neshta behavioral1/files/0x000100000001031f-83.dat family_neshta behavioral1/files/0x000100000001031d-82.dat family_neshta behavioral1/files/0x000200000001047d-81.dat family_neshta behavioral1/files/0x0002000000010480-80.dat family_neshta behavioral1/files/0x000100000000f7df-86.dat family_neshta behavioral1/files/0x000100000000f782-89.dat family_neshta behavioral1/files/0x000100000000f7e4-87.dat family_neshta behavioral1/files/0x000100000000f7f2-97.dat family_neshta behavioral1/files/0x0001000000010b9c-105.dat family_neshta behavioral1/files/0x00010000000114cd-104.dat family_neshta behavioral1/files/0x000100000000f87e-103.dat family_neshta behavioral1/files/0x000100000000f83a-102.dat family_neshta behavioral1/files/0x000100000000f839-101.dat family_neshta behavioral1/files/0x000100000000f70f-100.dat family_neshta behavioral1/files/0x000100000000f7d6-91.dat family_neshta behavioral1/files/0x0001000000010376-108.dat family_neshta behavioral1/files/0x0001000000010376-109.dat family_neshta behavioral1/files/0x0001000000011805-114.dat family_neshta behavioral1/files/0x0001000000010f37-115.dat family_neshta behavioral1/files/0x0001000000010c1a-113.dat family_neshta behavioral1/files/0x000100000001187f-117.dat family_neshta behavioral1/files/0x00010000000118ec-119.dat family_neshta behavioral1/files/0x00010000000118ec-121.dat family_neshta behavioral1/files/0x00010000000118f3-122.dat family_neshta behavioral1/files/0x0001000000010901-127.dat family_neshta behavioral1/files/0x0001000000010901-128.dat family_neshta behavioral1/files/0x0003000000012152-131.dat family_neshta behavioral1/files/0x0003000000012192-140.dat family_neshta behavioral1/files/0x0003000000012150-137.dat family_neshta behavioral1/files/0x000300000001218f-142.dat family_neshta behavioral1/files/0x000300000001218f-143.dat family_neshta behavioral1/files/0x00010000000106a4-145.dat family_neshta behavioral1/files/0x000200000001092c-149.dat family_neshta behavioral1/files/0x0002000000011818-151.dat family_neshta behavioral1/files/0x0001000000011601-161.dat family_neshta behavioral1/files/0x0001000000011601-163.dat family_neshta behavioral1/files/0x000100000001160f-164.dat family_neshta behavioral1/files/0x0001000000011855-166.dat family_neshta behavioral1/files/0x0001000000010f39-171.dat family_neshta behavioral1/files/0x000100000001187b-167.dat family_neshta behavioral1/files/0x0001000000010f4b-176.dat family_neshta behavioral1/files/0x000100000001187e-175.dat family_neshta behavioral1/files/0x0001000000010f39-174.dat family_neshta behavioral1/files/0x0001000000010f54-179.dat family_neshta behavioral1/files/0x0001000000010f9c-182.dat family_neshta behavioral1/files/0x0001000000011086-188.dat family_neshta behavioral1/files/0x000100000001127b-195.dat family_neshta behavioral1/files/0x0001000000011b63-199.dat family_neshta behavioral1/files/0x0001000000011b63-201.dat family_neshta behavioral1/files/0x000100000001128f-202.dat family_neshta behavioral1/files/0x00030000000120c9-207.dat family_neshta behavioral1/files/0x00030000000120c5-206.dat family_neshta behavioral1/files/0x00030000000120c5-204.dat family_neshta behavioral1/files/0x0003000000005ae6-210.dat family_neshta behavioral1/files/0x000300000000e714-211.dat family_neshta behavioral1/memory/1096-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1096-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-219-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1096-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CompressCheckpoint.tif.uz1j svchost.exe File created C:\Users\Admin\Pictures\RegisterSend.png.qi0h svchost.exe File created C:\Users\Admin\Pictures\RequestRead.raw.xnj2 svchost.exe File opened for modification C:\Users\Admin\Pictures\RequestRead.raw.xnj2 svchost.exe File created C:\Users\Admin\Pictures\RestoreRequest.png.lodk svchost.exe File created C:\Users\Admin\Pictures\CompressCheckpoint.tif.uz1j svchost.exe File created C:\Users\Admin\Pictures\JoinSet.png.ty4o svchost.exe File opened for modification C:\Users\Admin\Pictures\JoinSet.png.ty4o svchost.exe File opened for modification C:\Users\Admin\Pictures\RegisterSend.png.qi0h svchost.exe File opened for modification C:\Users\Admin\Pictures\RestoreRequest.png.lodk svchost.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\How to Recovery.bat svchost.exe -
Executes dropped EXE 5 IoCs
pid Process 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 268 svchost.exe 1644 svchost.com 1324 svchost.com 572 svchost.com -
Loads dropped DLL 13 IoCs
pid Process 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1644 svchost.com 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 1644 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3BHGYNU\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3FFX6WH\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M3HSS2N\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KDJSR44L\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F9XZZTVM\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FPRRZWTM\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTIFN44A\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2STIOPZK\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t3qenmsjc.jpg" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE svchost.com File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe svchost.com File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE svchost.com File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe svchost.com File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe svchost.com File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE svchost.com File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe svchost.com File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE svchost.com File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE svchost.com File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE svchost.com File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE svchost.com File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE svchost.com File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE svchost.com File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE svchost.com -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1716 vssadmin.exe -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 268 svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 268 svchost.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe Token: SeDebugPrivilege 268 svchost.exe Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe Token: SeIncreaseQuotaPrivilege 456 WMIC.exe Token: SeSecurityPrivilege 456 WMIC.exe Token: SeTakeOwnershipPrivilege 456 WMIC.exe Token: SeLoadDriverPrivilege 456 WMIC.exe Token: SeSystemProfilePrivilege 456 WMIC.exe Token: SeSystemtimePrivilege 456 WMIC.exe Token: SeProfSingleProcessPrivilege 456 WMIC.exe Token: SeIncBasePriorityPrivilege 456 WMIC.exe Token: SeCreatePagefilePrivilege 456 WMIC.exe Token: SeBackupPrivilege 456 WMIC.exe Token: SeRestorePrivilege 456 WMIC.exe Token: SeShutdownPrivilege 456 WMIC.exe Token: SeDebugPrivilege 456 WMIC.exe Token: SeSystemEnvironmentPrivilege 456 WMIC.exe Token: SeRemoteShutdownPrivilege 456 WMIC.exe Token: SeUndockPrivilege 456 WMIC.exe Token: SeManageVolumePrivilege 456 WMIC.exe Token: 33 456 WMIC.exe Token: 34 456 WMIC.exe Token: 35 456 WMIC.exe Token: SeIncreaseQuotaPrivilege 456 WMIC.exe Token: SeSecurityPrivilege 456 WMIC.exe Token: SeTakeOwnershipPrivilege 456 WMIC.exe Token: SeLoadDriverPrivilege 456 WMIC.exe Token: SeSystemProfilePrivilege 456 WMIC.exe Token: SeSystemtimePrivilege 456 WMIC.exe Token: SeProfSingleProcessPrivilege 456 WMIC.exe Token: SeIncBasePriorityPrivilege 456 WMIC.exe Token: SeCreatePagefilePrivilege 456 WMIC.exe Token: SeBackupPrivilege 456 WMIC.exe Token: SeRestorePrivilege 456 WMIC.exe Token: SeShutdownPrivilege 456 WMIC.exe Token: SeDebugPrivilege 456 WMIC.exe Token: SeSystemEnvironmentPrivilege 456 WMIC.exe Token: SeRemoteShutdownPrivilege 456 WMIC.exe Token: SeUndockPrivilege 456 WMIC.exe Token: SeManageVolumePrivilege 456 WMIC.exe Token: 33 456 WMIC.exe Token: 34 456 WMIC.exe Token: 35 456 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1096 wrote to memory of 360 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 28 PID 1096 wrote to memory of 360 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 28 PID 1096 wrote to memory of 360 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 28 PID 1096 wrote to memory of 360 1096 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 28 PID 360 wrote to memory of 268 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 29 PID 360 wrote to memory of 268 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 29 PID 360 wrote to memory of 268 360 2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe 29 PID 268 wrote to memory of 1644 268 svchost.exe 30 PID 268 wrote to memory of 1644 268 svchost.exe 30 PID 268 wrote to memory of 1644 268 svchost.exe 30 PID 268 wrote to memory of 1644 268 svchost.exe 30 PID 1644 wrote to memory of 1460 1644 svchost.com 31 PID 1644 wrote to memory of 1460 1644 svchost.com 31 PID 1644 wrote to memory of 1460 1644 svchost.com 31 PID 1644 wrote to memory of 1460 1644 svchost.com 31 PID 1460 wrote to memory of 1716 1460 cmd.exe 33 PID 1460 wrote to memory of 1716 1460 cmd.exe 33 PID 1460 wrote to memory of 1716 1460 cmd.exe 33 PID 1460 wrote to memory of 1716 1460 cmd.exe 33 PID 1460 wrote to memory of 456 1460 cmd.exe 35 PID 1460 wrote to memory of 456 1460 cmd.exe 35 PID 1460 wrote to memory of 456 1460 cmd.exe 35 PID 1460 wrote to memory of 456 1460 cmd.exe 35 PID 268 wrote to memory of 1324 268 svchost.exe 37 PID 268 wrote to memory of 1324 268 svchost.exe 37 PID 268 wrote to memory of 1324 268 svchost.exe 37 PID 268 wrote to memory of 1324 268 svchost.exe 37 PID 1324 wrote to memory of 1756 1324 svchost.com 38 PID 1324 wrote to memory of 1756 1324 svchost.com 38 PID 1324 wrote to memory of 1756 1324 svchost.com 38 PID 1324 wrote to memory of 1756 1324 svchost.com 38 PID 268 wrote to memory of 572 268 svchost.exe 40 PID 268 wrote to memory of 572 268 svchost.exe 40 PID 268 wrote to memory of 572 268 svchost.exe 40 PID 268 wrote to memory of 572 268 svchost.exe 40 PID 572 wrote to memory of 1172 572 svchost.com 41 PID 572 wrote to memory of 1172 572 svchost.com 41 PID 572 wrote to memory of 1172 572 svchost.com 41 PID 572 wrote to memory of 1172 572 svchost.com 41 PID 268 wrote to memory of 2564 268 svchost.exe 44 PID 268 wrote to memory of 2564 268 svchost.exe 44 PID 268 wrote to memory of 2564 268 svchost.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Modifies extensions of user files
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete5⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
PID:1716
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no5⤵PID:1756
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C wbadmin delete catalog -quiet5⤵PID:1172
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\How to Recovery.bat" "4⤵PID:2564
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
859KB
MD502ee6a3424782531461fb2f10713d3c1
SHA1b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA5126c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
186KB
MD558b58875a50a0d8b5e7be7d6ac685164
SHA11e0b89c1b2585c76e758e9141b846ed4477b0662
SHA2562a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b
-
Filesize
1.1MB
MD5566ed4f62fdc96f175afedd811fa0370
SHA1d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7
-
Filesize
285KB
MD5831270ac3db358cdbef5535b0b3a44e6
SHA1c0423685c09bbe465f6bb7f8672c936e768f05a3
SHA256a8f78ac26c738b13564252f1048ca784bf152ef048b829d3d22650b7f62078f0
SHA512f64a00977d4b6f8c43f53cee7bb450f3c8cbef08525975055fde5d8c515db32d2bfad92e99313b3a10a72a50dd09b4ffe28e9af4c148c6480622ba486776e450
-
Filesize
313KB
MD58c4f4eb73490ca2445d8577cf4bb3c81
SHA10f7d1914b7aeabdb1f1e4caedd344878f48be075
SHA25685f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
SHA51265453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769
-
Filesize
569KB
MD5eef2f834c8d65585af63916d23b07c36
SHA18cb85449d2cdb21bd6def735e1833c8408b8a9c6
SHA2563cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd
SHA5122ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7
-
Filesize
381KB
MD53ec4922dbca2d07815cf28144193ded9
SHA175cda36469743fbc292da2684e76a26473f04a6d
SHA2560587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801
SHA512956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7
-
Filesize
137KB
MD5e1833678885f02b5e3cf1b3953456557
SHA1c197e763500002bc76a8d503933f1f6082a8507a
SHA256bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14
SHA512fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe
-
Filesize
373KB
MD52f6f7891de512f6269c8e8276aa3ea3e
SHA153f648c482e2341b4718a60f9277198711605c80
SHA256d1ee54eb64f31247f182fd62037e64cdb3876e1100bc24883192bf46bab42c86
SHA512c677f4f7bfb2e02cd0babed896be00567aad08304cbff3a85fcc9816b10247fedd026fee769c9bd45277a4f2814eabe6534f0b04ea804d0095a47a1477188dd6
-
Filesize
100KB
MD56a091285d13370abb4536604b5f2a043
SHA18bb4aad8cadbd3894c889de85e7d186369cf6ff1
SHA256909205de592f50532f01b4ac7b573b891f7e6e596b44ff94187b1ba4bcc296bb
SHA5129696e4f60a5b1166535ca8ca3fb495d718086463d1a12fa1facc08219ad5b918208ddd2a102f7955e29153b081e05985c4ae6e4302ab36d548bb62991a47db18
-
Filesize
130KB
MD57ce8bcabb035b3de517229dbe7c5e67d
SHA18e43cd79a7539d240e7645f64fd7f6e9e0f90ab9
SHA25681a3a1dc3104973a100bf8d114b6be35da03767a0cbbaf925f970ffcbe5f217c
SHA512be7fcd50b4f71b458ca001b7c019bf1169ec089d7a1ce05355134b11cbe75a5a29811f9efec803877aeb1a1d576ea2628926e0131361db23214275af6e89e80c
-
Filesize
2.4MB
MD5a741183f8c4d83467c51abab1ff68d7b
SHA1ddb4a6f3782c0f03f282c2bed765d7b065aadcc6
SHA25678be3aeb507db7e4ee7468c6b9384ee0459deebd503e06bd4988c52247ecea24
SHA512c15dbecc0754a662892ecaff4b9b6c1bad46f710d8e1b973f86eaee467444f8e5764b31ace8f5a9a5e936947cc4dcb97cb1b14a6930c1025f38a3544393b6b18
-
Filesize
859KB
MD502ee6a3424782531461fb2f10713d3c1
SHA1b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA5126c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
571KB
MD5d4fdbb8de6a219f981ffda11aa2b2cc4
SHA1cca2cffd4cf39277cc56ebd050f313de15aabbf6
SHA256ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b
SHA5127167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf
-
Filesize
157KB
MD5a24fbb149eddf7a0fe981bd06a4c5051
SHA1fce5bb381a0c449efad3d01bbd02c78743c45093
SHA2565d13230eae7cd9b4869145c3280f7208788a8e68c9930a5c9aa3e822684a963d
SHA5121c73b762c340a8d7ea580985ba034a404c859d814690390a6e0b6786575c219db9ca20880ea20313bb244560e36cf24e4dda90229b3084d770495f4ceedfd5de
-
Filesize
229KB
MD528f7305b74e1d71409fec722d940d17a
SHA14c64e1ceb723f90da09e1a11e677d01fc8118677
SHA256706db4d832abdf4907a1386b917e553315660a59bfb4c180e38215b4a606d896
SHA512117de88d0bc437023ca2f1f54b1f2cf03b00c8cb52e4b728cabcb3140659c67cdb6d2c203d3ca13767312831c6308622dfa65d6c5361ec28aaf4ec0870f9ba6e
-
Filesize
503KB
MD53f67da7e800cd5b4af2283a9d74d2808
SHA1f9288d052b20a9f4527e5a0f87f4249f5e4440f7
SHA25631c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711
SHA5126a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3
-
Filesize
153KB
MD512a5d7cade13ae01baddf73609f8fbe9
SHA134e425f4a21db8d7902a78107d29aec1bde41e06
SHA25694e8ea2ed536484492d746f6f5808192cb81ae3c35f55d60826a2db64a254dd5
SHA512a240f5c59226749792cfb9fbd76b086d2544a493b834a72c0bfd8b076ed753ec8876ff056fc35f63f5497183d985f8f8c5c7b6abbcad70981f1ec83af1b3bd76
-
Filesize
539KB
MD560f6a975a53a542fd1f6e617f3906d86
SHA12be1ae6fffb3045fd67ed028fe6b22e235a3d089
SHA256be23688697af7b859d62519807414565308e79a6ecac221350cd502d6bf54733
SHA512360872d256ef91ea3debfb9b3efa22ee80859af9df29e0687c8e1b3c386d88ff1dc5635b86e714fbf1a7d4d6bc3d791efa31a9d9d13e0f79547b631bddb5108d
-
Filesize
205KB
MD5da31170e6de3cf8bd6cf7346d9ef5235
SHA1e2c9602f5c7778f9614672884638efd5dd2aee92
SHA2567737ab500cbbd5d507881d481eef9bd91cf6650bf8d2b41b47b1a8c5f2789858
SHA5122759d938d6ad963e0bf63481a700f7c503d06011a60bcfc1071b511e38afa87d903deb36f9cbfa0b3fd08f1ecb88d2c0bddf0d3b5f2dea2a0cca1a80471669f3
-
Filesize
125KB
MD546e43f94482a27df61e1df44d764826b
SHA18b4eab017e85f8103c60932c5efe8dff12dc5429
SHA256dc6658dec5bf89f65f2d4b9bdb27634bac0bf5354c792bc8970a2b39f535facd
SHA512ce5bdd3f9a2394ffda83c93fc5604d972f90bd72e6aded357bdf27a2b21a0469f6ac71ce40d9fb4ed8c845468c4171a3c5b4501edbae79447c4f4e08342d4560
-
Filesize
155KB
MD5f7c714dbf8e08ca2ed1a2bfb8ca97668
SHA1cc78bf232157f98b68b8d81327f9f826dabb18ab
SHA256fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
SHA51228bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c
-
Filesize
305KB
MD520d724819f31bd89107b7b930ea01f7c
SHA1ec65940fe3e30d3309e232267c000cefc047e42e
SHA25641d6a7e9725262e1c055b5979b4e9ab4b5585e5f3760c3edd5f175552713b365
SHA51216dc256250c81df50a5e270c5a9c24dbfd9a04c258218e0cb96179011b4724426917b16c7fa0f87941f4ab7e4150c6a7bbab4dd11fac1c8ddde2602d2d259fec
-
Filesize
439KB
MD5400836f307cf7dbfb469cefd3b0391e7
SHA17af3cbb12d3b2d8b5d9553c687c6129d1dd90a10
SHA256cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a
SHA512aa53cb304478585d6f83b19a6de4a7938ba2570d380a565a56ff5365aed073d5f56b95ad3228eb7d1e7e6110c6172a58b97bd6a5e57e4a8d39e762ed31dc17c8
-
Filesize
207KB
MD53b0e91f9bb6c1f38f7b058c91300e582
SHA16e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA25657c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f
-
Filesize
85KB
MD5685db5d235444f435b5b47a5551e0204
SHA199689188f71829cc9c4542761a62ee4946c031ff
SHA256fde30bfdd34c7187d02eabe49f2386b4661321534b50032a838b179a21737411
SHA512a06d711574fbe32f07d20e1d82b7664addd664bf4a7ee07a8f98889172afe3653f324b5915968950b18e76bbfc5217a29704057fd0676611629aa9eb888af54a
-
Filesize
1.5MB
MD592724a039ff89fb4dbf81af8de334fef
SHA1076c6a350376748aa51d27ca82ee2b9b530d08f9
SHA256e76511f06efd7f21aebafbbe8bd7deb024b76f10714e06f95b45992df8a847f5
SHA512c8d8ada1492c2881896662bd1e387c3b6408034f49e078f58d1d5a7476af01433c9e35cf123a91b785d5f0284803631c153e9d26895bb61a1ccd19be267b2631
-
Filesize
129KB
MD5b1e0da67a985533914394e6b8ac58205
SHA15a65e6076f592f9ea03af582d19d2407351ba6b6
SHA25667629b025fed676bd607094fa7f21550e18c861495ba664ee0d2b215a4717d7f
SHA512188ebb9a58565ca7ed81a46967a66d583f7dea43a2fc1fe8076a79ef4a83119ccaa22f948a944abae8f64b3a4b219f5184260eff7201eb660c321f6c0d1eba22
-
Filesize
605KB
MD58acc19705a625e2d4fa8b65214d7070a
SHA1ad16e49369c76c6826a18d136bf9618e8e99ec12
SHA2563fb179a3ae88a3d14db48de29d4b9d43243b80b2118b578b8117ad776ce47f12
SHA51292e22275194b5a73d825e1e7ad5a5cb5649d3679f545f88328aa72e39c161c4d797b7b3462e590edf546ddbd53c1508a49056f50fa63b113134e1bdc7d977dec
-
Filesize
1.7MB
MD533cb3cf0d9917a68f54802460cbbc452
SHA14f2e4447fabee92be16806f33983bb71e921792b
SHA2561230b2032d2d35a55cd86d1215eb38fa18bcf590c3c19b9ac4dda5350c24e10a
SHA512851f0a098020cb1da3f5f48febce3b9eaef3b885df9134b3fb6b364f3a7572a8c516456710a15f66f0a44eff59cfa50f2dc8bb5d274e5c093294b2ea96fd49cb
-
Filesize
109KB
MD544623cc33b1bd689381de8fe6bcd90d1
SHA1187d4f8795c6f87dd402802723e4611bf1d8089e
SHA256380154eab37e79ed26a7142b773b8a8df6627c64c99a434d5a849b18d34805ba
SHA51219002885176caceb235da69ee5af07a92b18dac0fb8bb177f2c1e7413f6606b1666e0ea20f5b95b4fa3d82a3793b1dbe4a430f6f84a991686b024c4e11606082
-
Filesize
741KB
MD55d2fd8de43da81187b030d6357ab75ce
SHA1327122ef6afaffc61a86193fbe3d1cbabb75407e
SHA2564d117648525a468532da011f0fc051e49bf472bbcb3e9c4696955bd398b9205f
SHA5129f7470978346746b4e3366f9a6b277aa747cc45f13d36886fc16303221565d23348195b72ac25f7b1711789cd7cb925d7ceea91e384ef4f904a4e49b4e06d9b2
-
Filesize
392KB
MD525b9301a6557a958b0a64752342be27d
SHA10887e1a9389a711ef8b82da8e53d9a03901edebc
SHA2565d916f7c7f6cb6cfd7545a57cb9c9d9c6df16af3517298c346901081a9135303
SHA512985f6b2fcac2f0425a1a339a55616012879a393caa747412d04c1ee4de3b12aff2cc051860066d84ecbeae335eaa5116ccb8a02090a2674eded367378c56b1ab
-
Filesize
694KB
MD57a4edc8fb7114d0ea3fdce1ea05b0d81
SHA102ecc30dbfab67b623530ec04220f87b312b9f6b
SHA256ff16fdc703e55ddfe5ee867f343f3b20b496e7199c6c4b646335a01026f74550
SHA51239519685b1dd872008abfa967f79fd3b7a5e6f6ee1b9c3de891aae64490b2d0feb56bcd3f5dab4527d2c6d07646db5966028df153f38a1c09ee88a1ba9a1ef44
-
Filesize
184KB
MD567a6e518de5b8401669ccf03059f1bac
SHA198ccf378e8c7e3ada48c4f6ca52b9293e141ce84
SHA256c554dfea900392e9eb4a0ab658f76a5a1de1e41bdce80382b5943dd78fc9516f
SHA5124e7b1922328d1e05e7faf456f61375df081faacca415c5242e12f081dee4d7f03835a9776295c77e7788984188f27ff358d72bc9100dbb250975aaaf2e95777c
-
Filesize
127KB
MD5154b891ad580307b09612e413a0e65ac
SHA1fc900c7853261253b6e9f86335ea8d8ad10c1c60
SHA2568a3598c889dbcb1dca548a6193517ed7becb74c780003203697a2db22222a483
SHA51239bf032033b445fc5f450abec298ea3f71cadecfeafc624f2eb1f9a1d343a272181a874b46b58bb18168f2f14d498c3b917c3392d4c724fe4e5ae749113c2ad6
-
Filesize
2.1MB
MD5d104dece8d9423bae1900ebb13e6a75e
SHA1c658e5b125d5706d6c405a6074938d495e3d7933
SHA2561863dea7a57dea8e738beb9a106c59fb5a0efae0d098bbc2bc15235e863648a0
SHA512d4e3815225b622e1a804b327706b1654ff855dee091086e16facfd6f0aacd7cdf3cbe073f08bb731bae10db754713d56dd82160a8d308d0820ffb65799087c38
-
Filesize
1.4MB
MD5328a15382885fe27a2fbe65a6b6c8b82
SHA1032fde6f0898393387ac4142b7f540de0d586555
SHA2564f78a7e0d8ab78d7e76a00d81f4af2d634e7b48c1c82cb44539a0178f50add86
SHA5128466fb50a185bda1fdc35126748a81a54d9a804f7023531dd205a18e157931fcbfcf33e006ad1e7cab5288624b8816f54758fb74cc5190f263d208e32a694216
-
Filesize
1.8MB
MD5fc87e701e7aab07cd97897512ab33660
SHA165dcd8e5715f2e4973fb6b271ffcb4af9cefae53
SHA256bb1814297615d6b22fa20ee4f8613c8bc9fa67d93cb7fe032f46f377569e2f46
SHA512b03e3b3f7b0f11b85757d8bf5678542f4281407e95cf8e074da4ddc421c217fcfaf23cc927ccd0bbca2891a424b2d3565072aba6406dc46c2fa1fdba7a249eec
-
Filesize
1.5MB
MD593766da984541820057ae0ab3d578928
SHA1ea19a657c6b1b5eb5accc09c45dcf04f063151c3
SHA256ad3a9f7beaaea0bc49a7ccba83198cfb2882d462441203684076695b0ef6c514
SHA512e14c86e13ab79fa9b9eb1a05d69764d522c4acfab7742c200080b215bb3bc31ec7f3dd2abf44cbc996d2e58a0ca1990b18ab055b232b243fe61b5fb018a9b719
-
Filesize
598KB
MD502e02577a83a1856dc838f9e2f24e8d2
SHA12ab44e2072a3598fc7092b2ccb9aff3a2c5d4ced
SHA2563b6ca9d9fcbb0c1677fe4caeef03e4db326f70166f030b5f9fa9f2856031d4fc
SHA512a95d454a4f9e5271bc52e6c245c7840a92b8331b84260b2556432ac66dd07bec1b2c3dcf41282d6d8ae581a152f3147e75dc673ce0c7ecbb653dcc61bc1d1bd8
-
Filesize
267KB
MD515163eb05b0a8f65a5ca3c74a658077d
SHA18b116062a5754fa2d73fc4df9f635283ae1ccd02
SHA2568751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf
SHA512a8299e9a522aa58429847920b999598551c1863f63ba473178f61cde43fb91cab6ef62c9e1a51268e54338e012ccfe6428a7c37bc89007d1604fafa2560258c9
-
Filesize
141KB
MD57e3b8ddfa6bd68ca8f557254c3188aea
SHA1bafaaaa987c86048b0cf0153e1147e1bbad39b0c
SHA2568270ecef6079a21f5ae22f1a473e5eb8abac51628367f4acf6466529ba11d7e2
SHA512675ca07cdb787b3f624eae9707daf519214f8dc4670c524cef5110c9dba197e833cedb051919c757c58a3687e63cf175d1397d8ce69c5995f4eab3b85f6dafbb
-
Filesize
674KB
MD597510a7d9bf0811a6ea89fad85a9f3f3
SHA12ac0c49b66a92789be65580a38ae9798237711db
SHA256c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea
SHA5122a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb
-
Filesize
715KB
MD5f34835c1f458f93cd9041bfa7d01ee7d
SHA1283ac4059492a22e10f7fcef219e52e0400a8926
SHA256afc5cc567db1a3318c89dd0efad2ca60a353290bc25d98bbbba8e6f1492e23b1
SHA512d5cc2244f1b6492dd9e66c6e917c2dfaa11376d4a8d1dea2c241cd35ce947ad919e47d1a78dea0c1f6cd6fa1e74426f806ddcf9ed3e8f25a9ae7c370b09e6857
-
Filesize
1KB
MD5b8586407e4dfadd8049ea11aa768d3ce
SHA1aa41a8ad9fb4c89cf36d99a15757d6f87c799f83
SHA2569e7344df5c62c3bbeb866d3e758816c04d4e7aeb3c455e1aa2328a832dc2dd8d
SHA5120ae6821b814d4865bcb4bffaaf20baafcc95e4ac2bce16269ea015426830c48c865f407174574f61bfe13a29f19ea7f346a13d1463a3188bb43057d93bb2ee7f
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
Filesize837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
Filesize837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605
-
Filesize
837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605
-
Filesize
837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605
-
Filesize
837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
29B
MD58e966011732995cd7680a1caa974fd57
SHA12b22d69074bfa790179858cc700a7cbfd01ca557
SHA25697d597793ec8307b71f3cfb8a6754be45bf4c548914367f4dc9af315c3a93d9b
SHA512892da55e0f4b3ff983019c11d58809fdcb8695d79c617ddc6251791308ee013bf097d1b4a7541140f7a01c56038a804974a4f154cc1b26e80e5cf5c07adf227c
-
Filesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
Filesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
571KB
MD5d4fdbb8de6a219f981ffda11aa2b2cc4
SHA1cca2cffd4cf39277cc56ebd050f313de15aabbf6
SHA256ba3dc87fca4641e5f5486c4d50c09d087e65264e6c5c885fa6866f6ccb23167b
SHA5127167e13dbcc8c96114fef5fc7ae19afa31173617db153dd283aa6d8256f6b8c09c8f906f5d418efe9f7f242cdfaef24b93c11c451701c4d56eb48d18de4e88bf
-
Filesize
205KB
MD5da31170e6de3cf8bd6cf7346d9ef5235
SHA1e2c9602f5c7778f9614672884638efd5dd2aee92
SHA2567737ab500cbbd5d507881d481eef9bd91cf6650bf8d2b41b47b1a8c5f2789858
SHA5122759d938d6ad963e0bf63481a700f7c503d06011a60bcfc1071b511e38afa87d903deb36f9cbfa0b3fd08f1ecb88d2c0bddf0d3b5f2dea2a0cca1a80471669f3
-
Filesize
125KB
MD546e43f94482a27df61e1df44d764826b
SHA18b4eab017e85f8103c60932c5efe8dff12dc5429
SHA256dc6658dec5bf89f65f2d4b9bdb27634bac0bf5354c792bc8970a2b39f535facd
SHA512ce5bdd3f9a2394ffda83c93fc5604d972f90bd72e6aded357bdf27a2b21a0469f6ac71ce40d9fb4ed8c845468c4171a3c5b4501edbae79447c4f4e08342d4560
-
Filesize
207KB
MD53b0e91f9bb6c1f38f7b058c91300e582
SHA16e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA25657c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f
-
Filesize
605KB
MD58acc19705a625e2d4fa8b65214d7070a
SHA1ad16e49369c76c6826a18d136bf9618e8e99ec12
SHA2563fb179a3ae88a3d14db48de29d4b9d43243b80b2118b578b8117ad776ce47f12
SHA51292e22275194b5a73d825e1e7ad5a5cb5649d3679f545f88328aa72e39c161c4d797b7b3462e590edf546ddbd53c1508a49056f50fa63b113134e1bdc7d977dec
-
Filesize
741KB
MD55d2fd8de43da81187b030d6357ab75ce
SHA1327122ef6afaffc61a86193fbe3d1cbabb75407e
SHA2564d117648525a468532da011f0fc051e49bf472bbcb3e9c4696955bd398b9205f
SHA5129f7470978346746b4e3366f9a6b277aa747cc45f13d36886fc16303221565d23348195b72ac25f7b1711789cd7cb925d7ceea91e384ef4f904a4e49b4e06d9b2
-
Filesize
1.8MB
MD5fc87e701e7aab07cd97897512ab33660
SHA165dcd8e5715f2e4973fb6b271ffcb4af9cefae53
SHA256bb1814297615d6b22fa20ee4f8613c8bc9fa67d93cb7fe032f46f377569e2f46
SHA512b03e3b3f7b0f11b85757d8bf5678542f4281407e95cf8e074da4ddc421c217fcfaf23cc927ccd0bbca2891a424b2d3565072aba6406dc46c2fa1fdba7a249eec
-
Filesize
267KB
MD515163eb05b0a8f65a5ca3c74a658077d
SHA18b116062a5754fa2d73fc4df9f635283ae1ccd02
SHA2568751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf
SHA512a8299e9a522aa58429847920b999598551c1863f63ba473178f61cde43fb91cab6ef62c9e1a51268e54338e012ccfe6428a7c37bc89007d1604fafa2560258c9
-
\Users\Admin\AppData\Local\Temp\3582-490\2023-06-05_9d8e89b9385730b406a3a1aca542568d_neshta_wannacry.exe
Filesize837KB
MD58c872241e0c3645f8357416c66628b2c
SHA145f352f3c82801c35b680e3b926e777cab1d4feb
SHA25658cc793739af806c85fe01aadcf731e874ff3e88da121dbeeb43b9aa37837fea
SHA5121ef1ed544a1275194db8b8ce36e658bcf4720c677d8c4e6c5aacc9ca0549ce7fdc66db52b066424df2f5abca28c681a9fedd511895d8cc7091e0eb4b15f8c605