Analysis
-
max time kernel
244s -
max time network
264s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
Resource
win10v2004-en-20220113
General
-
Target
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
-
Size
192KB
-
MD5
9c2f2398a853063303817e181b7cd140
-
SHA1
f0c032844d33537e7f270374f1f1c28ef7670683
-
SHA256
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
-
SHA512
4ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
SwSTcwJ.exepid process 2260 SwSTcwJ.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exeSwSTcwJ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation SwSTcwJ.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SwSTcwJ.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exeSwSTcwJ.exepid process 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 2260 SwSTcwJ.exe 2260 SwSTcwJ.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exeSwSTcwJ.exedescription pid process Token: SeDebugPrivilege 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe Token: SeBackupPrivilege 2260 SwSTcwJ.exe Token: SeBackupPrivilege 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exenet.exenet.exenet.exeSwSTcwJ.exenet.exenet.exenet.execmd.execmd.exedescription pid process target process PID 1712 wrote to memory of 2260 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe SwSTcwJ.exe PID 1712 wrote to memory of 2260 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe SwSTcwJ.exe PID 1712 wrote to memory of 2260 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe SwSTcwJ.exe PID 1712 wrote to memory of 2304 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe sihost.exe PID 1712 wrote to memory of 600 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 600 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 600 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 2340 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe svchost.exe PID 1712 wrote to memory of 2420 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe taskhostw.exe PID 1712 wrote to memory of 1304 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe svchost.exe PID 1712 wrote to memory of 3252 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe DllHost.exe PID 1712 wrote to memory of 3344 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe StartMenuExperienceHost.exe PID 1712 wrote to memory of 3424 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe RuntimeBroker.exe PID 1712 wrote to memory of 3504 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe SearchApp.exe PID 1712 wrote to memory of 3760 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe RuntimeBroker.exe PID 1712 wrote to memory of 4848 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 4848 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 4848 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 3180 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe RuntimeBroker.exe PID 1712 wrote to memory of 2752 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe backgroundTaskHost.exe PID 1712 wrote to memory of 4180 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe RuntimeBroker.exe PID 1712 wrote to memory of 3584 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe BackgroundTransferHost.exe PID 4848 wrote to memory of 3108 4848 net.exe net1.exe PID 4848 wrote to memory of 3108 4848 net.exe net1.exe PID 4848 wrote to memory of 3108 4848 net.exe net1.exe PID 600 wrote to memory of 2868 600 net.exe net1.exe PID 600 wrote to memory of 2868 600 net.exe net1.exe PID 600 wrote to memory of 2868 600 net.exe net1.exe PID 1712 wrote to memory of 1448 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 1448 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 1448 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1448 wrote to memory of 2448 1448 net.exe net1.exe PID 1448 wrote to memory of 2448 1448 net.exe net1.exe PID 1448 wrote to memory of 2448 1448 net.exe net1.exe PID 2260 wrote to memory of 3528 2260 SwSTcwJ.exe net.exe PID 2260 wrote to memory of 3528 2260 SwSTcwJ.exe net.exe PID 2260 wrote to memory of 3528 2260 SwSTcwJ.exe net.exe PID 1712 wrote to memory of 4164 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 4164 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1712 wrote to memory of 4164 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 3528 wrote to memory of 2824 3528 net.exe net1.exe PID 3528 wrote to memory of 2824 3528 net.exe net1.exe PID 3528 wrote to memory of 2824 3528 net.exe net1.exe PID 4164 wrote to memory of 908 4164 net.exe net1.exe PID 4164 wrote to memory of 908 4164 net.exe net1.exe PID 4164 wrote to memory of 908 4164 net.exe net1.exe PID 2260 wrote to memory of 392 2260 SwSTcwJ.exe net.exe PID 2260 wrote to memory of 392 2260 SwSTcwJ.exe net.exe PID 2260 wrote to memory of 392 2260 SwSTcwJ.exe net.exe PID 392 wrote to memory of 4656 392 net.exe net1.exe PID 392 wrote to memory of 4656 392 net.exe net1.exe PID 392 wrote to memory of 4656 392 net.exe net1.exe PID 1712 wrote to memory of 3368 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 1712 wrote to memory of 3368 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 1712 wrote to memory of 3368 1712 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 3368 wrote to memory of 4328 3368 cmd.exe reg.exe PID 3368 wrote to memory of 4328 3368 cmd.exe reg.exe PID 3368 wrote to memory of 4328 3368 cmd.exe reg.exe PID 2260 wrote to memory of 5072 2260 SwSTcwJ.exe cmd.exe PID 2260 wrote to memory of 5072 2260 SwSTcwJ.exe cmd.exe PID 2260 wrote to memory of 5072 2260 SwSTcwJ.exe cmd.exe PID 5072 wrote to memory of 1300 5072 cmd.exe reg.exe PID 5072 wrote to memory of 1300 5072 cmd.exe reg.exe PID 5072 wrote to memory of 1300 5072 cmd.exe reg.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2340
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3252
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3344
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:1304
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3760
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3504
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4180
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2752
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe"C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exe"C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵PID:2824
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:4656
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exe" /f /reg:643⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exe" /f /reg:644⤵
- Adds Run key to start application
PID:1300 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2868
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3108
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2448
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:908
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" /f /reg:642⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" /f /reg:643⤵
- Adds Run key to start application
PID:4328 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:2824
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:5268
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:5292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:5776
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:12192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:11616
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_e269d2c1-0edf-4391-ac7b-818b8e88b04fMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
5cedf73dbf75099b8abcefc3f07e9975
SHA12ecabc828715573e9d7aefaf82bfb0e7379e92cc
SHA256beb3695bb9be64d641570104a56889b776cdbebd9c132045c52b9543d1f82b63
SHA512dfe8485e7138ee9d0a03b9f3000bc8513856f82b51d2ef9f7c6be66b28ea0df86521c2b3b3c575f11061b3820758f280a99fbf77e482fa34c3a53c40c3928c56
-
C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exeMD5
9c2f2398a853063303817e181b7cd140
SHA1f0c032844d33537e7f270374f1f1c28ef7670683
SHA256d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
SHA5124ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
-
C:\Users\Admin\AppData\Local\Temp\SwSTcwJ.exeMD5
9c2f2398a853063303817e181b7cd140
SHA1f0c032844d33537e7f270374f1f1c28ef7670683
SHA256d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
SHA5124ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319