Malware Analysis Report

2024-09-23 03:56

Sample ID 240530-wm2e7agh32
Target 418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd
SHA256 418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd
Tags
metasploit backdoor bootkit persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd

Threat Level: Known bad

The file 418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor bootkit persistence trojan

MetaSploit

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: AddClipboardFormatListener

NTFS ADS

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-30 18:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 18:03

Reported

2024-05-30 18:05

Platform

win10v2004-20240508-en

Max time kernel

109s

Max time network

94s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd.dll

Signatures

MetaSploit

trojan backdoor metasploit

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\MEMZ.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\MEMZ.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\Desktop\MEMZ.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\MEMZ.exe:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A
N/A N/A C:\Users\Admin\Desktop\MEMZ.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4464 wrote to memory of 4524 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4464 wrote to memory of 4524 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4464 wrote to memory of 4524 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4524 wrote to memory of 4004 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 4004 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 4524 wrote to memory of 4004 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\cmd.exe
PID 4004 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4004 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4004 wrote to memory of 2956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 424 wrote to memory of 2024 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 3252 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 2024 wrote to memory of 4028 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\418541857fdbac27dcafb5f1be266ae9a5c35c3f69ea64e8af14e996c12a53cd.dll

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c set XlOLqhCejHbSNW=8300 & reg add HKCU\SOFTWARE\WaMgGneKhtgTTy /v LbmWADsevLywrkP /t REG_DWORD /d 3809 & exit

C:\Windows\SysWOW64\reg.exe

reg add HKCU\SOFTWARE\WaMgGneKhtgTTy /v LbmWADsevLywrkP /t REG_DWORD /d 3809

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveConfirm.mpg"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.0.743241403\1718702044" -parentBuildID 20230214051806 -prefsHandle 1776 -prefMapHandle 1700 -prefsLen 22244 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c174fa09-e146-4658-9c16-90f1131ad5c6} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 1868 2389610f058 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.1.1402425665\1583181859" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22280 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2077713-eb06-4c41-b1cc-4231446e08cb} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 2436 23889489358 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.2.282339546\912494797" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 22318 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a77741a-5f37-497a-83ce-3b73f85ca39a} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 2848 23899007258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.3.1644522546\1174217165" -childID 2 -isForBrowser -prefsHandle 3956 -prefMapHandle 2764 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bd00b21-bc47-4b4e-8790-ebc89af8257f} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 3968 2389b147858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.4.331715533\1316597189" -childID 3 -isForBrowser -prefsHandle 4976 -prefMapHandle 4992 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13962d8b-2bdc-4196-9352-6749145fc0bf} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 4944 2389d42bc58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.5.1441083636\1924761248" -childID 4 -isForBrowser -prefsHandle 5116 -prefMapHandle 5124 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {365a8dcd-ca81-4335-a29d-ad4796d69410} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 5000 2389d42a758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.6.305856695\2091249111" -childID 5 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad42a3ad-fb4c-4bb1-b725-9a0e541cfb2b} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 5304 2389d42a158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.7.1143093796\1033075901" -childID 6 -isForBrowser -prefsHandle 4328 -prefMapHandle 4332 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cfa4102-1c0f-46a2-b5c5-25da4294342b} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 5896 2389c403b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.8.1684040177\891826739" -parentBuildID 20230214051806 -prefsHandle 4476 -prefMapHandle 4484 -prefsLen 27697 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fec82fd-4baa-44ca-b4de-49a4219e4abf} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 6080 2389d262258 rdd

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.9.601133440\1848481147" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 1232 -prefMapHandle 3560 -prefsLen 27697 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74e01cde-d303-472e-9a06-0a4668d290b6} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 4348 2389d261658 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.10.1402066720\663031653" -childID 7 -isForBrowser -prefsHandle 6176 -prefMapHandle 6140 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2007528-cd39-48f4-a8df-80109548e323} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 6280 2389d260a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2024.11.1352062605\930922974" -childID 8 -isForBrowser -prefsHandle 5200 -prefMapHandle 4996 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1272 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {225c5008-204a-469d-9670-7b7585242e89} 2024 "\\.\pipe\gecko-crash-server-pipe.2024" 5284 23896678658 tab

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe"

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /watchdog

C:\Users\Admin\Desktop\MEMZ.exe

"C:\Users\Admin\Desktop\MEMZ.exe" /main

C:\Windows\SysWOW64\notepad.exe

"C:\Windows\System32\notepad.exe" \note.txt

Network

Country Destination Domain Proto
CA 5.149.253.238:443 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 214.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
N/A 127.0.0.1:57771 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 34.117.188.166:443 spocs.getpocket.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.188.166:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 44.237.65.238:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
N/A 127.0.0.1:57778 tcp
US 8.8.8.8:53 238.65.237.44.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.212.214:443 i.ytimg.com tcp
GB 216.58.212.214:443 i.ytimg.com tcp
GB 216.58.212.214:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.212.214:443 i.ytimg.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.178.14:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.14:443 youtube-ui.l.google.com udp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 214.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.200.34:443 googleads.g.doubleclick.net tcp
GB 216.58.213.6:443 static.doubleclick.net tcp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.200.34:443 googleads.g.doubleclick.net udp
GB 172.217.169.10:443 jnn-pa.googleapis.com tcp
GB 172.217.169.10:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 216.58.213.6:443 static.doubleclick.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 172.217.169.10:443 jnn-pa.googleapis.com udp
GB 172.217.169.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com udp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
GB 142.250.180.14:443 encrypted-vtbn0.gstatic.com tcp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
US 8.8.8.8:53 encrypted-vtbn0.gstatic.com udp
GB 142.250.180.14:443 encrypted-vtbn0.gstatic.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 api.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 21.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 209.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp

Files

memory/4524-0-0x00000000011A0000-0x00000000011A1000-memory.dmp

memory/4524-1-0x000000006BAC0000-0x000000006BADF000-memory.dmp

memory/4604-10-0x00007FFA07BF0000-0x00007FFA07C24000-memory.dmp

memory/4604-9-0x00007FF7ED8B0000-0x00007FF7ED9A8000-memory.dmp

memory/4604-11-0x00007FF9F7B50000-0x00007FF9F7E06000-memory.dmp

memory/4604-12-0x00007FF9F6050000-0x00007FF9F7100000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\activity-stream.discovery_stream.json.tmp

MD5 311328795d32b1f63e8347495bfa5856
SHA1 3218202e6fbec6ceb89002802faee11fc23d129e
SHA256 503df43050680455b84528dc4d79c541a9fafa58c6f2d1af8a07c3e1f862ffa2
SHA512 00fbfcc12b44f258ee34b461b4de8a4e4f812db96ed5617625373afc3c96ccfea46fbfdfffcf9a0ef732457a12c3743f814b1b0f33151b936dd59053ea60f155

memory/4524-49-0x000000006BAC0000-0x000000006BADF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

MD5 23a1a83b51b91ecd440322e093c25e35
SHA1 6a4d63b834df0e05eb454d951ec677d1579907a9
SHA256 76122442b4c064bf3b99e7b49ae25489b4a40222804fb143cec26f17882d956c
SHA512 59a30e235988456c4b46491c00cda8961841524c48cc96070d638679f4da9416ecfae2ec7ebeb7661d8611b5fa887e63557bfd98eb96f779479f4b5b8f6da354

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

MD5 59cd9a3dad32de59ee4e1fb673c8c145
SHA1 93b1f343a0dbe2896bbb42cba85889feb6379020
SHA256 6c7cfb06ac6e42fb5577632abac8cbf9e8ba8cf0ce59ed6f3c6fc909c11ce100
SHA512 bc2d99fb287e028997a7f745de4a05a9a09dd66fdcd65dad9df2203972b6c7cc5ff466bf37ec26e5d36dd2949f263bcf48be3dde52efe1fb8b6f7af665e875ba

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

MD5 bd41ea68c74a623e46a0a067c0ce322d
SHA1 71042b36123f95a1e71002a889bea53caeb2a7c1
SHA256 6802b9bfb6bcfcea11a60b685be52e8ffada89bf446276217e087c2e78c32e48
SHA512 e0c321df13edb985c09b433bbd9a08ea64d946695e4b97b199b4e778819233d015ba6b50de0acd366c8f8a037a7ef5c7bde9204f06789e876e63959b7efd2ac0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

MD5 190e45a089d9d08b704ec889a9274167
SHA1 2d62896a3f058994f50d26846ca1c7247daa1ee4
SHA256 cb569de61557e75e3f84eac53c51110311e6d44c908b63922190559762f30cbc
SHA512 0d5c84ccf2304fc7da7450fd3c814e5e99dbbb6a01909266bad6aea8aa1a4f9f1ff236efb3bdef98b8f51351288851f5034b7f2ec94c1ba1a4a0d1e166fc2c49

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e6zhegwu.default-release\cache2\entries\041C4F545D1E509BC208BBABAE51AC5A16C7DC00

MD5 26d95282a699cbb4f611374057e52c77
SHA1 50f3814d58d93709c76eb5a8314eb94d48896a6c
SHA256 8d3f0416c357f2dce3f30b281d9f7aa7cd13127b26436fcf97500432bb554fb1
SHA512 d330bda0fd2c156e88ce7c0284d5ea761603ba5569abb8cca319bffece7463acde26a0ac2fbf50abdff1b860f523cd31faf8c8e054f6ca7aaf1e92171953803a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e29f59c30d67deb71d4d720aedc392ac
SHA1 43d7a29d2b48130f5a9c7fed2740ab8dd9cd217f
SHA256 69ef7b4602fece5d1ef5dab247bc33df6f0635d49feda30adff41bee12f0867a
SHA512 aef87c12a1185e49f9da35c262321da196849f241341386ae2f0a3813507546b023e2552cc93f01b6a5bf7af49c4d57538e6e0d4b16d33957956ac8f571b6a0c

C:\Users\Admin\Downloads\MEMZ.exe

MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\sessionstore.jsonlz4

MD5 3a086a1577498a6779d75954abcb1cb2
SHA1 53d4a8fb4a435059c63da56bb4af6401c8db8cf1
SHA256 5896ee2eee49c8072aa705250a9c926d5c4062394dfd8b99a32b8121364e6615
SHA512 72d6ef44a91877be895ca8166bbb4d8bb4d01f87b4843080954661e040aa78d4c5cedebe21a3c547d6beeb78c83e0bd923a2a09f53e12651d52bb4d251018ab4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e6zhegwu.default-release\prefs-1.js

MD5 43fb3f83a82a8aec8b6c268f5075353f
SHA1 1dac210c0d5c9daac4c595d732e80fceb2a8b708
SHA256 5e7b44cb436f98c4d0d4a1ac3da839934031ffa825a87ccd3740e569d7d9cadc
SHA512 24d36b0dacee028061e70b06b202d3002802a89f7fbdec9b2ab0e6fb64bf0b1e17a18bd9dd05af781ff370128791aea62eafb4e82b7438b879c2111440e4914d

C:\note.txt

MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf