Analysis
-
max time kernel
126s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
Resource
win10v2004-20220414-en
General
-
Target
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe
-
Size
392KB
-
MD5
5fea51478a01f10a78d428751e973aba
-
SHA1
cb7f1e3acc3636a6f890edb8c44d0abe2674ec1c
-
SHA256
0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b
-
SHA512
47ea5c07b4d9d2bd5f9045906da94961f9d7d64e55c992435bdae2d21334daed98f096892da46f2bd18637f48ecac6bc80d6531c5a1cacceb7f3a46182e103c6
Malware Config
Extracted
redline
04062022
62.204.41.166:27688
-
auth_value
48182fe753fa2aff7472da064aa2a5d9
Extracted
arkei
Default
http://62.204.41.69/p8jG9WvgbE.php
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/2020-68-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2020-69-0x0000000000400000-0x0000000000424000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 1352 Fvdfggf.exe 912 azne.exe 1204 pm.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\International\Geo\Nation azne.exe -
Deletes itself 1 IoCs
pid Process 1596 cmd.exe -
Loads dropped DLL 12 IoCs
pid Process 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qreqp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yrretwohx\\Qreqp.exe\"" pm.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1580 set thread context of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1352 set thread context of 2020 1352 Fvdfggf.exe 30 PID 912 set thread context of 1936 912 azne.exe 39 PID 1204 set thread context of 1552 1204 pm.exe 42 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1304 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2020 regasm.exe 912 azne.exe 912 azne.exe 1944 powershell.exe 1204 pm.exe 1204 pm.exe 1552 aspnet_compiler.exe 1552 aspnet_compiler.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 1352 Fvdfggf.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2020 regasm.exe Token: SeDebugPrivilege 912 azne.exe Token: SeDebugPrivilege 1204 pm.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 1552 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 1352 Fvdfggf.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1580 wrote to memory of 1352 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 28 PID 1580 wrote to memory of 1352 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 28 PID 1580 wrote to memory of 1352 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 28 PID 1580 wrote to memory of 1352 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 28 PID 1580 wrote to memory of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1580 wrote to memory of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1580 wrote to memory of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1580 wrote to memory of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1580 wrote to memory of 2016 1580 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 29 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 1352 wrote to memory of 2020 1352 Fvdfggf.exe 30 PID 2016 wrote to memory of 912 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 34 PID 2016 wrote to memory of 912 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 34 PID 2016 wrote to memory of 912 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 34 PID 2016 wrote to memory of 912 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 34 PID 2016 wrote to memory of 1204 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 35 PID 2016 wrote to memory of 1204 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 35 PID 2016 wrote to memory of 1204 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 35 PID 2016 wrote to memory of 1204 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 35 PID 2016 wrote to memory of 1596 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 36 PID 2016 wrote to memory of 1596 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 36 PID 2016 wrote to memory of 1596 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 36 PID 2016 wrote to memory of 1596 2016 0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe 36 PID 1596 wrote to memory of 1304 1596 cmd.exe 38 PID 1596 wrote to memory of 1304 1596 cmd.exe 38 PID 1596 wrote to memory of 1304 1596 cmd.exe 38 PID 1596 wrote to memory of 1304 1596 cmd.exe 38 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 912 wrote to memory of 1936 912 azne.exe 39 PID 1204 wrote to memory of 1944 1204 pm.exe 40 PID 1204 wrote to memory of 1944 1204 pm.exe 40 PID 1204 wrote to memory of 1944 1204 pm.exe 40 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42 PID 1204 wrote to memory of 1552 1204 pm.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"C:\Users\Admin\AppData\Local\Temp\Fvdfggf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
-
C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Roaming\azne.exe"C:\Users\Admin\AppData\Roaming\azne.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵PID:1936
-
-
-
C:\Users\Admin\AppData\Roaming\pm.exe"C:\Users\Admin\AppData\Roaming\pm.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAJwAsACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAHIAcgBlAHQAdwBvAGgAeABcAFEAcgBlAHEAcAAuAGUAeABlACcA4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\0f63b4b4659449eee766610af817b786e9cd7622743851cf7b71430613d7521b.exe" & exit3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:1304
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5e124d6fab64aa638922bc7861998fa8c
SHA13420d895a8ef834eaf85c800fb83b1eca0a7816e
SHA256de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3
SHA512b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
Filesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
Filesize
172KB
MD5e124d6fab64aa638922bc7861998fa8c
SHA13420d895a8ef834eaf85c800fb83b1eca0a7816e
SHA256de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3
SHA512b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7
-
Filesize
172KB
MD5e124d6fab64aa638922bc7861998fa8c
SHA13420d895a8ef834eaf85c800fb83b1eca0a7816e
SHA256de8f8f5217cc3fca88d5261c8ad2c3115750ccf4f7bf3e7904760af2014959e3
SHA512b456215751eeda2f5b633cd52b5b5d820d1dc96d9ec4f4f35fa4fa1c5859dd925c949f0f6270af80a12ede9f9ac45f4a979aea7f8d4da459ed05cd1b7bdd5ed7
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD5263950977bac605cb152d88be7b3115f
SHA1c690bae8657278742c2ddf1144b1ecbbaaab7916
SHA256479a6f9b920dc41930fbfb0dbe7bc6fb34724da607bbbe8775b7be7e3897c688
SHA512aea4d8df7678330cbd033c5e302cd02c44699cad1e11bc12d01f47bcfc52bb49876dba7a5247dc36713f5bfd9fbe9e1548417a54391b6013e261e8e997e8a464
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37
-
Filesize
295KB
MD551a6e667c3c59d0e4a2fb644a284ead4
SHA1f2f6646aa2a70ae1520728c376d6048e5a8bf7ef
SHA25640e3f0d6fc66f3881a716191aa965e1b4bceceb357d98f63254e4cb6db00c7c5
SHA51236d2c78ba57322d26a22059daa92f5255ffcb9fd3695a1300898f3fd42ff4ed2cdd51f014410de372e5dbad86f2227f6002084282f93b6b1248e3da420c76b37