Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
cs+changer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cs+changer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
loader-o.pyc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
loader-o.pyc
Resource
win10v2004-20240709-en
General
-
Target
cs+changer.exe
-
Size
57.2MB
-
MD5
4f89f4e58160db47d19260b5f9de9bca
-
SHA1
9599c5e021195c4b9355f2bf6e59a6067379cfc1
-
SHA256
50259bd5d39e1d33d5ca3250ba67333c57c11c08959d237404166b4356572aa6
-
SHA512
d5682ae141f3e241967859bd3dbf99eda859bf3d89032457141b1372dc4d540c244a48aab8ba64aa2d3be64691a5c6f8fcaab75086d7ec3307bc0170300a364b
-
SSDEEP
1572864:qxB7vFQqMrlpA+Ql4VdIvIe6MqQZ19Wb84xhvsZ:qxBJyklAIvNF/9e8ehM
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
pid Process 3320 powershell.exe 1916 powershell.exe 1856 powershell.exe 2668 powershell.exe -
Loads dropped DLL 57 IoCs
pid Process 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x00070000000238ce-1672.dat upx behavioral2/memory/4824-1676-0x00007FF9DA3E0000-0x00007FF9DAAA4000-memory.dmp upx behavioral2/files/0x00070000000234c1-1678.dat upx behavioral2/files/0x0007000000023507-1684.dat upx behavioral2/memory/4824-1685-0x00007FF9DCB60000-0x00007FF9DCB85000-memory.dmp upx behavioral2/memory/4824-1686-0x00007FF9EF120000-0x00007FF9EF12F000-memory.dmp upx behavioral2/files/0x00070000000234c4-1690.dat upx behavioral2/files/0x00070000000234bf-1688.dat upx behavioral2/files/0x00070000000234cf-1718.dat upx behavioral2/files/0x00070000000234cd-1716.dat upx behavioral2/files/0x00070000000234cc-1715.dat upx behavioral2/files/0x00070000000234cb-1714.dat upx behavioral2/files/0x00070000000234ca-1713.dat upx behavioral2/files/0x00070000000234c9-1712.dat upx behavioral2/files/0x00070000000234c8-1711.dat upx behavioral2/files/0x00070000000234c7-1710.dat upx behavioral2/files/0x00070000000234c6-1709.dat upx behavioral2/files/0x00070000000234c5-1708.dat upx behavioral2/files/0x00070000000234c3-1707.dat upx behavioral2/files/0x00070000000234c2-1706.dat upx behavioral2/files/0x00070000000234c0-1705.dat upx behavioral2/files/0x00070000000234be-1704.dat upx behavioral2/files/0x0007000000023ca9-1703.dat upx behavioral2/files/0x0007000000023c9c-1701.dat upx behavioral2/files/0x0007000000023c36-1700.dat upx behavioral2/files/0x00070000000238d3-1699.dat upx behavioral2/files/0x00070000000238d2-1698.dat upx behavioral2/files/0x00070000000238d1-1697.dat upx behavioral2/files/0x00070000000238cc-1696.dat upx behavioral2/files/0x0007000000023508-1694.dat upx behavioral2/files/0x0007000000023506-1693.dat upx behavioral2/memory/4824-1692-0x00007FF9DA0B0000-0x00007FF9DA0DD000-memory.dmp upx behavioral2/memory/4824-1691-0x00007FF9DC350000-0x00007FF9DC36A000-memory.dmp upx behavioral2/memory/4824-1723-0x00007FF9DA350000-0x00007FF9DA386000-memory.dmp upx behavioral2/memory/4824-1722-0x00007FF9EA9E0000-0x00007FF9EA9EF000-memory.dmp upx behavioral2/memory/4824-1725-0x00007FF9DC370000-0x00007FF9DC389000-memory.dmp upx behavioral2/memory/4824-1727-0x00007FF9E9E70000-0x00007FF9E9E7D000-memory.dmp upx behavioral2/memory/4824-1729-0x00007FF9E79A0000-0x00007FF9E79AD000-memory.dmp upx behavioral2/memory/4824-1731-0x00007FF9DA330000-0x00007FF9DA344000-memory.dmp upx behavioral2/memory/4824-1733-0x00007FF9D9B80000-0x00007FF9DA0A9000-memory.dmp upx behavioral2/memory/4824-1738-0x00007FF9DA220000-0x00007FF9DA2ED000-memory.dmp upx behavioral2/memory/4824-1737-0x00007FF9DA2F0000-0x00007FF9DA323000-memory.dmp upx behavioral2/memory/4824-1746-0x00007FF9DA180000-0x00007FF9DA192000-memory.dmp upx behavioral2/memory/4824-1745-0x00007FF9DA0F0000-0x00007FF9DA177000-memory.dmp upx behavioral2/memory/4824-1744-0x00007FF9DA1A0000-0x00007FF9DA1B6000-memory.dmp upx behavioral2/files/0x0007000000023cac-1743.dat upx behavioral2/memory/4824-1742-0x00007FF9DA3E0000-0x00007FF9DAAA4000-memory.dmp upx behavioral2/files/0x00070000000234d6-1750.dat upx behavioral2/files/0x00070000000234d5-1748.dat upx behavioral2/memory/4824-1754-0x00007FF9D9830000-0x00007FF9D994B000-memory.dmp upx behavioral2/memory/4824-1753-0x00007FF9D9950000-0x00007FF9D9977000-memory.dmp upx behavioral2/memory/4824-1752-0x00007FF9E1D90000-0x00007FF9E1D9B000-memory.dmp upx behavioral2/memory/4824-1758-0x00007FF9DA350000-0x00007FF9DA386000-memory.dmp upx behavioral2/memory/4824-1757-0x00007FF9EA9E0000-0x00007FF9EA9EF000-memory.dmp upx behavioral2/memory/4824-1759-0x00007FF9D9490000-0x00007FF9D94A8000-memory.dmp upx behavioral2/memory/4824-1760-0x00007FF9D9460000-0x00007FF9D9484000-memory.dmp upx behavioral2/memory/4824-1761-0x00007FF9D92E0000-0x00007FF9D945F000-memory.dmp upx behavioral2/memory/4824-1775-0x00007FF9D9160000-0x00007FF9D916B000-memory.dmp upx behavioral2/memory/4824-1774-0x00007FF9DA330000-0x00007FF9DA344000-memory.dmp upx behavioral2/memory/4824-1783-0x00007FF9D9130000-0x00007FF9D913D000-memory.dmp upx behavioral2/memory/4824-1782-0x00007FF9DA220000-0x00007FF9DA2ED000-memory.dmp upx behavioral2/memory/4824-1786-0x00007FF9D9070000-0x00007FF9D908C000-memory.dmp upx behavioral2/memory/4824-1785-0x00007FF9D9090000-0x00007FF9D909B000-memory.dmp upx behavioral2/memory/4824-1784-0x00007FF9DA0F0000-0x00007FF9DA177000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 48 discord.com 49 discord.com 28 discord.com 29 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 46 ip-api.com -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2208 netsh.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3880 WMIC.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1705699165-553239100-4129523827-1000\{6DCAC086-4785-4FD8-890F-816E907C1599} cs+changer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 4824 cs+changer.exe 3320 powershell.exe 3320 powershell.exe 3320 powershell.exe 1856 powershell.exe 1856 powershell.exe 1856 powershell.exe 2668 powershell.exe 2668 powershell.exe 1916 powershell.exe 1916 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4824 cs+changer.exe Token: SeDebugPrivilege 3320 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: 36 3012 WMIC.exe Token: SeIncreaseQuotaPrivilege 3012 WMIC.exe Token: SeSecurityPrivilege 3012 WMIC.exe Token: SeTakeOwnershipPrivilege 3012 WMIC.exe Token: SeLoadDriverPrivilege 3012 WMIC.exe Token: SeSystemProfilePrivilege 3012 WMIC.exe Token: SeSystemtimePrivilege 3012 WMIC.exe Token: SeProfSingleProcessPrivilege 3012 WMIC.exe Token: SeIncBasePriorityPrivilege 3012 WMIC.exe Token: SeCreatePagefilePrivilege 3012 WMIC.exe Token: SeBackupPrivilege 3012 WMIC.exe Token: SeRestorePrivilege 3012 WMIC.exe Token: SeShutdownPrivilege 3012 WMIC.exe Token: SeDebugPrivilege 3012 WMIC.exe Token: SeSystemEnvironmentPrivilege 3012 WMIC.exe Token: SeRemoteShutdownPrivilege 3012 WMIC.exe Token: SeUndockPrivilege 3012 WMIC.exe Token: SeManageVolumePrivilege 3012 WMIC.exe Token: 33 3012 WMIC.exe Token: 34 3012 WMIC.exe Token: 35 3012 WMIC.exe Token: 36 3012 WMIC.exe Token: SeIncreaseQuotaPrivilege 2976 wmic.exe Token: SeSecurityPrivilege 2976 wmic.exe Token: SeTakeOwnershipPrivilege 2976 wmic.exe Token: SeLoadDriverPrivilege 2976 wmic.exe Token: SeSystemProfilePrivilege 2976 wmic.exe Token: SeSystemtimePrivilege 2976 wmic.exe Token: SeProfSingleProcessPrivilege 2976 wmic.exe Token: SeIncBasePriorityPrivilege 2976 wmic.exe Token: SeCreatePagefilePrivilege 2976 wmic.exe Token: SeBackupPrivilege 2976 wmic.exe Token: SeRestorePrivilege 2976 wmic.exe Token: SeShutdownPrivilege 2976 wmic.exe Token: SeDebugPrivilege 2976 wmic.exe Token: SeSystemEnvironmentPrivilege 2976 wmic.exe Token: SeRemoteShutdownPrivilege 2976 wmic.exe Token: SeUndockPrivilege 2976 wmic.exe Token: SeManageVolumePrivilege 2976 wmic.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2664 wrote to memory of 4824 2664 cs+changer.exe 88 PID 2664 wrote to memory of 4824 2664 cs+changer.exe 88 PID 4824 wrote to memory of 4452 4824 cs+changer.exe 94 PID 4824 wrote to memory of 4452 4824 cs+changer.exe 94 PID 4452 wrote to memory of 3320 4452 cmd.exe 96 PID 4452 wrote to memory of 3320 4452 cmd.exe 96 PID 4824 wrote to memory of 2112 4824 cs+changer.exe 97 PID 4824 wrote to memory of 2112 4824 cs+changer.exe 97 PID 2112 wrote to memory of 1856 2112 cmd.exe 99 PID 2112 wrote to memory of 1856 2112 cmd.exe 99 PID 2112 wrote to memory of 2668 2112 cmd.exe 100 PID 2112 wrote to memory of 2668 2112 cmd.exe 100 PID 2112 wrote to memory of 1916 2112 cmd.exe 101 PID 2112 wrote to memory of 1916 2112 cmd.exe 101 PID 4824 wrote to memory of 2208 4824 cs+changer.exe 102 PID 4824 wrote to memory of 2208 4824 cs+changer.exe 102 PID 4824 wrote to memory of 4900 4824 cs+changer.exe 109 PID 4824 wrote to memory of 4900 4824 cs+changer.exe 109 PID 4900 wrote to memory of 3012 4900 cmd.exe 111 PID 4900 wrote to memory of 3012 4900 cmd.exe 111 PID 4824 wrote to memory of 2976 4824 cs+changer.exe 112 PID 4824 wrote to memory of 2976 4824 cs+changer.exe 112 PID 4824 wrote to memory of 3544 4824 cs+changer.exe 114 PID 4824 wrote to memory of 3544 4824 cs+changer.exe 114 PID 3544 wrote to memory of 3880 3544 cmd.exe 116 PID 3544 wrote to memory of 3880 3544 cmd.exe 116 PID 4824 wrote to memory of 3892 4824 cs+changer.exe 117 PID 4824 wrote to memory of 3892 4824 cs+changer.exe 117 PID 3892 wrote to memory of 4416 3892 cmd.exe 119 PID 3892 wrote to memory of 4416 3892 cmd.exe 119 PID 4824 wrote to memory of 2128 4824 cs+changer.exe 120 PID 4824 wrote to memory of 2128 4824 cs+changer.exe 120 PID 2128 wrote to memory of 2172 2128 cmd.exe 122 PID 2128 wrote to memory of 2172 2128 cmd.exe 122 PID 4824 wrote to memory of 4992 4824 cs+changer.exe 123 PID 4824 wrote to memory of 4992 4824 cs+changer.exe 123 PID 4992 wrote to memory of 3088 4992 cmd.exe 125 PID 4992 wrote to memory of 3088 4992 cmd.exe 125 PID 4824 wrote to memory of 1172 4824 cs+changer.exe 126 PID 4824 wrote to memory of 1172 4824 cs+changer.exe 126 PID 1172 wrote to memory of 564 1172 cmd.exe 128 PID 1172 wrote to memory of 564 1172 cmd.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"3⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""3⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2208
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:3880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\System32\wbem\WMIC.exeC:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid4⤵PID:2172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"3⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\System32\Wbem\WMIC.exewmic path softwarelicensingservice get OA3xOriginalProductKey4⤵PID:3088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵PID:564
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91B
MD55aa796b6950a92a226cc5c98ed1c47e8
SHA16706a4082fc2c141272122f1ca424a446506c44d
SHA256c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
-
Filesize
23B
MD55638715e9aaa8d3f45999ec395e18e77
SHA14e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA2564db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA51278c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
-
Filesize
783KB
MD560c44c7e44e22439d3389a7f422a0aba
SHA16b71cfec0ac96fc1613e733bf95b86ce82fcb56b
SHA256fef1136eb9990d6090c0028cae91af7532f5b0d1a7c1511819f02ca8518d1cc4
SHA5126a182bdffb294a37184a8cc5a208990b76165de8f7f0f86c32f79626ed530c075fd379a3f386009984819b7afd01f485375fc4850fdd23571cc57f82b67990bf
-
Filesize
575KB
MD5e1d7ad52d932c84e00b02f6fdc3ff49d
SHA1d74432cbd12f38b85e34d8e9644dca9db8044445
SHA256360b3da8380d8d70da965f6ce1c079df5ea46b149a5f94fe4e888315ef6f5d1c
SHA5121867a63db63f0924583d890302d12c88736c7a6b9895cd72b48661fb27d95274488ec3f68e5c4e1a24bec5bfe7d43606c6f8b9b994087ea6f7a098c981fc3cd9
-
Filesize
539KB
MD5314b6c9fc5cb8cd4baa9278d76231280
SHA1bae8997059acc5a10657277be21d55aa37543da4
SHA256569b13eb8c64c5a964ff26bfe2cb81c34783b2ca740deb125dca306839c46442
SHA512d1b59aaa139f19fe3c57e6664f9c67cc7fc4d860dad51cbc21b5740e6475172b146c3ae3bc85adf6717aad6d0dbbf371619b3003184c4f404178e504c3ded86f
-
Filesize
1.1MB
MD5e7298c2e3024a4060071c2a6071ffc64
SHA1954e77ebfe2b7abbaf7a970637527d60f3571c3d
SHA256369fed89360904de5c8457be6eab5ffb93cbc8aac46e49cc1b3d1d5031d5af1b
SHA5129f8c83f555ffb3a76f76c79532f00f8a450a2d05f1a85ba6587611d4a18f3b3035b05bf91e078ec816caaf73338cc83196f7257051ad8ae4025ee25990ba3caa
-
Filesize
851KB
MD56296cd8ca4500c79cf70bb0cb8721178
SHA1499b3ff882745fd6192c214078722a420a0c4404
SHA25626670b7a562d04d1449265b92f47e3a7d2a47fc9240555ba05f011312ff463a2
SHA51240a12e7c1aab4072ca5648a68a6f9c8e75fa1740b3d50eee2c60af43b3db834ef274175f5bb39a52388deed3ad19663c9744c5cc32563e24d893b53e1091f5ab
-
Filesize
525KB
MD59a2c99518e0a9a2f3d6e07474f537a85
SHA1097e726273baf0f24d8c4a1c7e7d3917352d2588
SHA256732912b75c38033943a326a806ba9b5fa3f2048a93b89af12f98f40846c80508
SHA512b342958a137e5052a9430d02a464f54c9e89a019a671bdb383b83ddd09bc57d7203cd8a6d2213565a6220f32f733b903aba1c9267f4ea7ca4c19e1d940f1ee40
-
Filesize
16KB
MD59419bda470d6e2eaebc827a81b42a24b
SHA18fbf5729548f44f1757c0a918cf7cd940b225ae6
SHA2568f0a36973666eee763c05d0d13de350eaef03cbad8169b1adf82a63e3e99ba68
SHA5124719299d3ac2ccc6014cd7b46360699eef0807a3a45b13342e2ab8068775247b0f3cfd994954b27096a3f09f6aa2f2e9dae19e9331db4d84dbedb1363799ce7f
-
Filesize
18KB
MD5906a99bcf81250f36a195b8b85a76979
SHA1b76cf3774bbeee8d523823957488f393c213cb5d
SHA2564719a1366ce2501ceb483a5713fa89f14b72a18b78fcbb10fe1b127f7d4efcda
SHA512484456629dd01191184fce00efeda25fb2e91c84d52252a12893992b446dcdf0d48b23bea70ea2441c5845e3c2e69400e2b97cb7d896fb6a16024efe4351a387
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
37KB
MD56880e3d5872fefa9810753e181cf3033
SHA1e875467792bbe3c4117040f6cf935a7a60a21d55
SHA256c7000207e8c406f3a18b006649248906963834ff901c7b8b9f627d534e31575b
SHA512f501bfe8300b20a621d587d9a86e1228ab90da5f4cab8ed47a2822617ca5eeaf66691756228745ff24084ba481f6b3eedcddfc4a4869cd56334e8ca53a92148d
-
Filesize
48KB
MD5ab542da47a7745a2f588ca78d41734e0
SHA1d8f1601548510333e35199e3b6bb4eaf994ca9ae
SHA2564aba601dd528a85dad5975daf6aa394002c8a38582e4abb05a89684f52130084
SHA512d80228ae846c562e08b08b92796e871e546760cd8ed92cbbe526675947ea2a5524ff4a93210e820c9f646912db24ff112ed2a354fc018a53a5161934c7fbd0f0
-
Filesize
71KB
MD55225e3fc11136d4ad314367fa911a8b1
SHA1c2cfb71d867e59f29d394131e0e6c8a2e71dee32
SHA25608005b24e71411fc4acdb312a4558339595b1d12c6917f8d50c6166a9f122abe
SHA51287bdeacaca87dc465de92fe8dda425560c5e6e149883113f4541f2d5ecc59f57523cde41ad48fa0081f820678182648afbf73839c249fe3f7d493dcf94e76248
-
Filesize
59KB
MD5fc609234e81821c069d54a7c8d4a7e05
SHA19aef96aa0276feb2df28ce0abf4ec1f2f766d011
SHA256506cdca8f4cc4754a78edac3be230a5ec7ca4a0d61ef08fe0accab4080b2c69e
SHA512bea687c1a9ed32db6c99be1c8689ac9e498f0ffce74c0c66c6c7653d58b6ee90e50df66c8a48b49854d47142fa9a930047f4828651193f7a500ae7fbc1882d2e
-
Filesize
107KB
MD5e3245ba10c125de02593c0a67669ab17
SHA16b846b98ee8f663aa39d3c6c960df8bc84d82193
SHA256306cc1df8631d632e9831d6a710c8776784c4655b107424290338c385e743026
SHA51226c4d7280a93dc004b0a92689c43b9bcb6c0afa282d24581051fd18d0037499c2c77431636ca20a9225af002f254526cf66ff466b3b7fad0d73b8096ce1594fc
-
Filesize
35KB
MD5fa6ae459e8a2c3071bd373da5a4cfe18
SHA1dbf6462e952efe70f4ad72c0c8688456833462d5
SHA25620af24170652420bc06adbb2fc159ae9e61e71f2cad5370b423c9ce4c57ad5e1
SHA5129846f7fcf86fd67b03080a6ec270e4c6ecb0fee7bd0019fddd976c26e062c5d41f35691384a2307ca80289010f73cecf7326d7f446971639698b2948c4f67c08
-
Filesize
86KB
MD5ed15089e3c0c1b2ab5b73354abf0087b
SHA1f51ade203d249e27ebf9ae2159220fabdb8726c0
SHA25602fe60ad99452d53294514e8c6b8d95d79cc013742e3a4cd74b36601fc3fb09b
SHA512a9f869b2988057c37d14ee56495ecbf2ec688517203a7e2d1bc1488f4d37c6e3d3fb6fb439442c86679a9cebbbd5b2e7b11d42f64bdbce7212b6411cd27073ac
-
Filesize
27KB
MD5a2de86f88aad5c050f86d258b1f05617
SHA111824bbb09e5ee9865cadcbbfda1e0664c6d98ff
SHA256f10fc80b19740eceb7fdce89c30d6670c9af7ed600fa7f881d27b8b5a054495f
SHA5123662a8e6afa6b385a3e2682a49b0ae57f0f2aefc029eaaf841a228ec76c0f79c4e963b6f22eb345f4cad72b35bd72576a79a282d9816cf9b37b762773c10a80b
-
Filesize
33KB
MD5d2b3134bae2e401e1753aac8b9ca577e
SHA13b4c4fe61c724a6bc4ee423ee7a1efb007a1f515
SHA2562386cf6ceaef4c6aa13974f913d6b3e6cde3b48e2fbb73f5c63ae6fe4384836f
SHA512215609827121d9da6fa0bc884bd388391c46a799c22d54762775d591d9ae5e6bbce70011bc5f5237b6e526b79416c00f5daa8fc6baf70450ce37ced17fafa1f6
-
Filesize
26KB
MD56cff25f6eb2872a07d52591cffe97ed7
SHA11e51fc338bcf4e868a827c8dd2d3573a60ec9a73
SHA256b58694a5585645827ce1f0aa285e176e9328584917a36434132fd71c3f017d8d
SHA512e847437f88dfd473272ed89f06fc9939c2e58e71f309275afa89599b4d79365459f763815660499be69b93b2440f3ed0dec88192d7d5b2be6ac2b79009a6442a
-
Filesize
44KB
MD5552d390e9c359bf460b87cfb9a24a48b
SHA1d4920c3355b18087e9a392bea152cef90cc04a60
SHA256f11b57f08a31e172cabae66830f9ef936e322a4df03ba5230d1621db4e7a24b6
SHA512cfc59e43ab855f1c571db92c0df1258e88bc6db9d8569c2a5242b90d22f327503f4b4402f79f816f53f12a43f3d1ca84066231f0a3e719758340813f79528d8e
-
Filesize
57KB
MD5435b49a7f84e7fbe0c6681932de37179
SHA1a8a285579de10dacbfd053735c6f0ab930fe0fe2
SHA2565321e5c26a9bcaebb58f11241121bd0d1e45f98dcfbb4d8457eae42f17b8328a
SHA51213d7d7120a7a150d789b92964acbe6d2ea7ebb130d6cb1833456ea1cdd6654cdd1d8841165296b3f077935dbaec4a37ca7e45c395c0b72d9b6dc970dbb76136a
-
Filesize
66KB
MD5318cfedf19856dbbc627e79ed9fd2b9c
SHA1fb9b5565a033a8c6a4aee3f0a27de047714442d1
SHA256efa7fef1f1456e19c44a787b62d047f5d73c6abb6a6d4201d125dc3d101fff09
SHA512d5d616400fa33751bec6ce8786d4c29e6307f2042db0602907354734ff72387570201420290f5e99c375059ef7217159e254c44291b36f7f296574f506211e10
-
Filesize
86KB
MD5056fe629b0d09c81b2508fe020f573fb
SHA157650f99cf4989059a905e91a5b652691a16364c
SHA256abfc2dff9dc4d881750e18406d7b72579c3198d19fba6a8b17e5b731dc3ebbf7
SHA512a9ae6aa908a30b920b5ddd4187cdd016703cf44b0ed1b74cbe05cea32b4d8d74aa0489b1e30203f897c77a151189d28dbe751f6abc06211e1f7eb50ee946788f
-
Filesize
31KB
MD58d093aa8b56a712c85c111c3e8499c03
SHA1961e3703f3ce97228b89f3119e03fb604b9adb50
SHA2569df34b9f9e658dfc882d1c69bed57ca47660eb4f09066ba83ec92f3c1fee2ddd
SHA512d01512df46861d6ae1b8af3a1fe1c20cf2323aaeb22d9f79510db85dcace0487241df2e92e1b75c69c8459cebbc62d13a0306982298333138f4ae618598e499b
-
Filesize
38KB
MD566fa43762fbf1a3051a4517eae9966fc
SHA1836473cd01e92cb9085c373a0efe148267488f3c
SHA2562263317a838f36d4eac8c580abcb65232902940f31e86257453f3a720722e2e9
SHA512955495faa4366104a63d72be201a0f0d8c0ea2e0d192a1cde2f2cf158f1652db3f089f8bae62a594dd794bda4ce6a3f61bdaf3c2f124c4439276e688b7217c89
-
Filesize
25KB
MD550521b577719195d7618a23b3103d8aa
SHA17020d2e107000eaf0eddde74bc3809df2c638e22
SHA256acbf831004fb8b8d5340fe5debd9814c49bd282dd765c78faeb6bb5116288c78
SHA5124ee950da8bbbd36932b488ec62fa046ac8fc35783a146edadbe063b8419a63d4dfb5bbd8c45e9e008fe708e6fc4a1fee1202fce92ffc95320547ba714fed95e1
-
Filesize
28KB
MD554ba74f0c557b0c0463c08b5d2439379
SHA18aa3f3f50501962f4a64ead15b24b6a77b06c5c5
SHA25653d4c23bc2ba89ee5050bae9b498eebbcde5a1906e51389742780f0c976b861f
SHA512fa4b6ca32a635f3a17d1e50b2b0a0c9e184cc104c2632b1d57c2a14db30272e6985a5665c567f49a5d4a6f36bfe80db9b5c591856d1667c024631a7050efb5fe
-
Filesize
1.3MB
MD555df3c98d18ec80bc37a6682ba0abcbb
SHA1e3bf60cfecfee2473d4e0b07057af3c27afa6567
SHA256d8de678c0ac0cecb7be261bda75511c47e6a565f0c6260eacf240c7c5039753b
SHA51226368c9187155ee83c450bfc792938a2908c473ba60330ce95bcc3f780390043879bbff3949bd4a25b38343eac3c5c9ba709267959109c9c99a229809c97f3bd
-
Filesize
284KB
MD5181ac9a809b1a8f1bc39c1c5c777cf2a
SHA19341e715cea2e6207329e7034365749fca1f37dc
SHA256488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee
SHA512e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85
-
Filesize
9KB
MD5e4fad9ff1b85862a6afaca2495d9f019
SHA10e47d7c5d4de3a1d7e3bb31bd47ea22cc4ddeac4
SHA256e5d362766e9806e7e64709de7e0cff40e03123d821c3f30cac5bac1360e08c18
SHA512706fb033fc2079b0aabe969bc51ccb6ffaaf1863daf0e4a83d6f13adc0fedab61cee2b63efb40f033aea22bf96886834d36f50af36e6e25b455e941c1676a30a
-
Filesize
39KB
MD55c643741418d74c743ca128ff3f50646
SHA10b499a3228865a985d86c1199d14614096efd8a0
SHA2562d86563fdfdc39894a53a293810744915192f3b3f40a47526551e66cdb9cb35c
SHA51245d02b854557d8f9c25ca8136fa6d3daed24275cc77b1c98038752daed4318bd081c889ff1f4fa8a28e734c9167f477350a8fa863f61729c30c76e7a91d61a97
-
Filesize
1KB
MD54ce7501f6608f6ce4011d627979e1ae4
SHA178363672264d9cd3f72d5c1d3665e1657b1a5071
SHA25637fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
-
Filesize
1.6MB
MD563eb76eccfe70cff3a3935c0f7e8ba0f
SHA1a8dd05dce28b79047e18633aee5f7e68b2f89a36
SHA256785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e
SHA5128da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322
-
Filesize
29KB
MD5be8ceb4f7cb0782322f0eb52bc217797
SHA1280a7cc8d297697f7f818e4274a7edd3b53f1e4d
SHA2567d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
SHA51207318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571
-
Filesize
222KB
MD57e87c34b39f3a8c332df6e15fd83160b
SHA1db712b55f23d8e946c2d91cbbeb7c9a78a92b484
SHA25641448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601
SHA512eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559
-
Filesize
72KB
MD5ae1775318dbafe2773b8a7461f762bfc
SHA1b724f8bc9c46c9b402996eefea5e92bf1199c8c0
SHA2566f8c04396646162159ecbf4014e4b9bb757816755497f08132ae37052205a4c7
SHA512fb995eea66b8319d6686add73ba9e06c980293b364b60b2148565f78755c26e80e93a893f06d51eeb4885b657cff0471be702615d5ce89c0a283322137cc221b
-
Filesize
88KB
MD57291100352b163626455abf2252f2a96
SHA13c4d13bbf5fb69fe6f2af70f675ed2e437cea893
SHA25601974148486d569e9f1ad62d36d4d54b5396b07c853bd50f358d5580fde331f4
SHA512fc384703828bb7a38b51dcf1a131b49283808b5658395e1d1c5ee9a204f895da0c29b12a7b1fc9aa468babc5d6f03be638fecf519e41911bf015a481f95458bc
-
Filesize
66KB
MD5a07661c5fad97379cf6d00332999d22c
SHA1dca65816a049b3cce5c4354c3819fef54c6299b0
SHA2565146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
SHA5126ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d
-
Filesize
1.7MB
MD58f165bfadf970edafd59067ad45a3952
SHA116c1876f2233087156b49db35d4d935c6e17be6a
SHA25622470af77229d53d9141823c12780db63c43703dd525940bc479730d2e43513d
SHA512b3af95dc9a68e21e8eca98e451b935f72663c2552ebf26de299716f17193f238d55c292df953d641defcbcec3ea18eb37cd4b839800804efa8f40658427263ae
-
Filesize
25KB
MD53b214dfb6ec4ca67be55b3aa52922827
SHA1f665ffeab25d2bab506b873be944280586eb50f6
SHA2567507a92c4787e9e7936a0b4a8eeb0a3f24e5ee12ae58cd7988543581d99817ac
SHA512de4e9b9d79b01d21aca74179c6a3e8fc6fe041f71cdd78910fd893cda90c2cfe7e54ade91064333f37ffc880d446879a64dd8bb790677039df56df1f80ec6b45
-
Filesize
644KB
MD5b26fa7619d82c7272b7279eb7aae801c
SHA1fa6a3240a531615a0853306f3b3d66aed98a04d8
SHA25674dc76a2a2d06d61f9f06bd3b0972bfb30ab57b0e5cb8c3011e79ce4a52924f0
SHA51220b0d6cf3e07ca0d565f140c9f9c1e218406ed9bdaaf75433858acb250bfb71bb134a6479fdcf6d4d0e0252707b1fb14f9c9d3e4d6a40824c3fdc7a43dfad0ee
-
Filesize
652KB
MD5f31b4bd4866929ef7bc212782583aef5
SHA1d5060178cdc4c8aa6dd85ab26448ba8bf76f7079
SHA256299f1ef2362fde11b413a35d99a4a7bc046923e5dd601f5ae514d57dfd73d954
SHA512716c6d913cc8a3b3965cba2b70237a99073cbb372767e05c32af5dbf6dfc6379267815954e20d15ccbec79ffeb68c1f66f703196195bc1456374703626aa7ac0
-
Filesize
626KB
MD51e04190c21fbc017f6a76974b55821db
SHA1f1db74c8e92fda7c9ec1db88f20c23a86b737617
SHA256eb02c02d7ede94b11480557f41d85d48e6a8fe409bd9aac477d7597b4ee2eddc
SHA51263c34dd51b73ae6d8a349adc32709e1de704aa64c4e16f06be68d4ad829a62b13269739f0e5d0f797e88fb9daddeaa62efc1e5ce33e6ed4e473593ab4824efc2
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
295KB
MD597f08bbcf9903c768668b1cd1e30aada
SHA184e2dc5c3662bd39ac09b5f682a59104ffec16d2
SHA256c5c2997c3b16eb8b89fe230582a579a753efc8317ffd95d9795ec2762aa54ed9
SHA512076ca0017ae252d62d4a3bd7a42af95800e39a164bda990a0ca651aa2f0df2736c0dfdc086d8328a1834ae89f17716c5f76e798460a90263d1d8b6f2c233c686
-
Filesize
77KB
MD57250d6ff20cc06b115e965662a18e94f
SHA1adc6902b75492a06ad4b1b24627f4dfe2ee3b9b2
SHA25691daca770fc15bca5a9e4c8fc04c2a81953f9fc35c741fe68ef27817e2be9579
SHA512cf87c842e876da92deace197f94bc93292862650dff7e4ae6fb6411e39f9aa938b8ba9a4a7ad7f5f5094dae1c395cfd4f132bdf8481117eef09b8f83cc3f33a9
-
Filesize
167KB
MD52f12da584a362bad45c6b9b3ddd2445c
SHA186adc05435a9a7dc0b0c676456b15f64d7df6f44
SHA256da95d86762fb4ea6a479990e1b91591ccad7d0f88072a7805052cd71168db115
SHA5126113292936ea39c45764c240e04a92479403ef6c64aa959922e94f990f8d405299793acbdeb8a4c924d81857e12b3d83e7c8c93c261e8101f4eee44ab77dc92e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82