Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
26-03-2022 23:16
Static task
static1
Behavioral task
behavioral1
Sample
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
Resource
win10v2004-20220310-en
General
-
Target
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe
-
Size
440KB
-
MD5
a3b4d25af01edf5fe34fd6e13a1381e6
-
SHA1
3a60499205fa92a581d3b6cb232fc8ed8d750088
-
SHA256
8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
-
SHA512
d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1284 nslookup.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation nslookup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook nslookup.exe Key opened \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 api.ipify.org 44 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1572 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2348 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1284 nslookup.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 2960 powershell.exe 2960 powershell.exe 1284 nslookup.exe 1284 nslookup.exe 1284 nslookup.exe 1284 nslookup.exe 1284 nslookup.exe 1284 nslookup.exe 2572 powershell.exe 2572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 1284 nslookup.exe Token: SeDebugPrivilege 2572 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 nslookup.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3948 wrote to memory of 2960 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 91 PID 3948 wrote to memory of 2960 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 91 PID 3948 wrote to memory of 2960 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 91 PID 3948 wrote to memory of 4380 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 93 PID 3948 wrote to memory of 4380 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 93 PID 3948 wrote to memory of 4380 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 93 PID 3948 wrote to memory of 4060 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 95 PID 3948 wrote to memory of 4060 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 95 PID 3948 wrote to memory of 4060 3948 8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe 95 PID 4380 wrote to memory of 1572 4380 cmd.exe 97 PID 4380 wrote to memory of 1572 4380 cmd.exe 97 PID 4380 wrote to memory of 1572 4380 cmd.exe 97 PID 4060 wrote to memory of 2348 4060 cmd.exe 98 PID 4060 wrote to memory of 2348 4060 cmd.exe 98 PID 4060 wrote to memory of 2348 4060 cmd.exe 98 PID 4060 wrote to memory of 1284 4060 cmd.exe 99 PID 4060 wrote to memory of 1284 4060 cmd.exe 99 PID 4060 wrote to memory of 1284 4060 cmd.exe 99 PID 1284 wrote to memory of 2572 1284 nslookup.exe 102 PID 1284 wrote to memory of 2572 1284 nslookup.exe 102 PID 1284 wrote to memory of 2572 1284 nslookup.exe 102 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe"C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn nslookup.exe /tr '"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"'3⤵
- Creates scheduled task(s)
PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8C6E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2348
-
-
C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1284 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\zygolen\nslookup.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5b597c90d8967bc27104d9fc54c32a6d4
SHA1d6d0182c3367bf7b87941f05baff2d27532ec1be
SHA256c57652ded43ff393f9d0b51c1709b30c4c8ebedf6040942f3b2510dc3dd15b46
SHA5128e7211b0dd60683c11491c3ef23ade022aa2900e7ffec304e4d183bbc0668121f7440d36af113cc8074d504698d1269f0c46a555ac460d72bda1ff01997bbb72
-
Filesize
160B
MD5f0a2091e01c4caab167d64d2c14a3c2d
SHA183536fd7b95ee98438506cfde8c006514c814ae1
SHA2560157ebb01fc0604d0e798097286f2b6bfac6bcbaf93d71a117c7431c9ac7c23b
SHA5123e65d18ba27477230b2cd3c6eb077b186add49d6c35c8cb11007ae89a5e400958c3e0e91096f9ca9b7158377403ebe78639fb174824342b8e78d08515b94eab8
-
Filesize
440KB
MD5a3b4d25af01edf5fe34fd6e13a1381e6
SHA13a60499205fa92a581d3b6cb232fc8ed8d750088
SHA2568b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
SHA512d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0
-
Filesize
440KB
MD5a3b4d25af01edf5fe34fd6e13a1381e6
SHA13a60499205fa92a581d3b6cb232fc8ed8d750088
SHA2568b88a1b3eeaae266280873836b1a2059a90233e4bc315634ea09a70697af7d6f
SHA512d9269e5c8bbf672ef32e8f74d61bdd3abaa991a74fb092ca5dc7f9a25b8bb7cd0dc09b59b823336edcc9b18d226b9b8e518ac2ca710e2c9bd8ce5452b9ccc5b0