Analysis
-
max time kernel
44s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30/06/2022, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
5713de.msi
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
5713de.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
5713de.msi
-
Size
1.0MB
-
MD5
b8520a4e0945ba689030685895d6bed8
-
SHA1
ea8b828430149f67f45f9a71ee486bc674e21da7
-
SHA256
34839e85cb8ae781654f2f9f0529114dbf21399e02bea3c9de94f6c247807e7e
-
SHA512
f35feec25d6aa629b050c0ec3f8ac2d94887cc05eba11e7bb816aec1c60a6a5ad0f3703bd4e28a8753717b14225ea46364a518d76531e3534d6a4c4fbca2b966
Malware Config
Signatures
-
Matanbuchus
A loader sold as MaaS first seen in February 2021.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 2 1464 msiexec.exe 4 1464 msiexec.exe 6 1464 msiexec.exe 8 1464 msiexec.exe 10 1720 msiexec.exe -
Loads dropped DLL 1 IoCs
pid Process 1660 regsvr32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\6c626c.msi msiexec.exe File created C:\Windows\Installer\6c626d.ipi msiexec.exe File opened for modification C:\Windows\Installer\6c626d.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\6c626c.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI671B.tmp msiexec.exe File created C:\Windows\Installer\6c626f.msi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1720 msiexec.exe 1720 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1464 msiexec.exe Token: SeIncreaseQuotaPrivilege 1464 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeSecurityPrivilege 1720 msiexec.exe Token: SeCreateTokenPrivilege 1464 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1464 msiexec.exe Token: SeLockMemoryPrivilege 1464 msiexec.exe Token: SeIncreaseQuotaPrivilege 1464 msiexec.exe Token: SeMachineAccountPrivilege 1464 msiexec.exe Token: SeTcbPrivilege 1464 msiexec.exe Token: SeSecurityPrivilege 1464 msiexec.exe Token: SeTakeOwnershipPrivilege 1464 msiexec.exe Token: SeLoadDriverPrivilege 1464 msiexec.exe Token: SeSystemProfilePrivilege 1464 msiexec.exe Token: SeSystemtimePrivilege 1464 msiexec.exe Token: SeProfSingleProcessPrivilege 1464 msiexec.exe Token: SeIncBasePriorityPrivilege 1464 msiexec.exe Token: SeCreatePagefilePrivilege 1464 msiexec.exe Token: SeCreatePermanentPrivilege 1464 msiexec.exe Token: SeBackupPrivilege 1464 msiexec.exe Token: SeRestorePrivilege 1464 msiexec.exe Token: SeShutdownPrivilege 1464 msiexec.exe Token: SeDebugPrivilege 1464 msiexec.exe Token: SeAuditPrivilege 1464 msiexec.exe Token: SeSystemEnvironmentPrivilege 1464 msiexec.exe Token: SeChangeNotifyPrivilege 1464 msiexec.exe Token: SeRemoteShutdownPrivilege 1464 msiexec.exe Token: SeUndockPrivilege 1464 msiexec.exe Token: SeSyncAgentPrivilege 1464 msiexec.exe Token: SeEnableDelegationPrivilege 1464 msiexec.exe Token: SeManageVolumePrivilege 1464 msiexec.exe Token: SeImpersonatePrivilege 1464 msiexec.exe Token: SeCreateGlobalPrivilege 1464 msiexec.exe Token: SeBackupPrivilege 1368 vssvc.exe Token: SeRestorePrivilege 1368 vssvc.exe Token: SeAuditPrivilege 1368 vssvc.exe Token: SeBackupPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1936 DrvInst.exe Token: SeLoadDriverPrivilege 1936 DrvInst.exe Token: SeLoadDriverPrivilege 1936 DrvInst.exe Token: SeLoadDriverPrivilege 1936 DrvInst.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe Token: SeTakeOwnershipPrivilege 1720 msiexec.exe Token: SeRestorePrivilege 1720 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1464 msiexec.exe 1464 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32 PID 1720 wrote to memory of 1660 1720 msiexec.exe 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5713de.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1464
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\windows\SysWoW64\regsvr32.exec:\windows\SysWoW64\regsvr32.exe -e -n -i:"TrustedPublisher" "C:\Users\Admin\AppData\Local\VisualStudioIDE\locale.nls" Office2⤵
- Loads dropped DLL
PID:1660
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000334" "000000000000055C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize727B
MD59c82c2178d20b3f7a9d6b4f84679f2df
SHA10990191b7c08c9f02fbfc06165baabfb5b52569b
SHA2567c634c3784a1a66abc59cac26dd0fe8c36632bbf5d75fbad6be7743c1d110a54
SHA5121b54d95212ad87ed847b8754c082ffc510046d30e72040794aeecad44ecda879a97aa8fd4fe182dfc0cfefb5e4173277d3d6ce46d7f4e761c6d66bd930555da9
-
Filesize
60KB
MD5589c442fc7a0c70dca927115a700d41e
SHA166a07dace3afbfd1aa07a47e6875beab62c4bb31
SHA2562e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a
SHA5121b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_AA53F781F7F4C895625B394C44214055
Filesize655B
MD54366536c40e2de1150e6f9d9ff0b76a2
SHA198e41e895fe41e903740977e4da3dcc6924ce755
SHA256960d7b140f8ac1ad74632ff67bb0a3fd486035121a1aa2d30fe87f06ab6d7a2b
SHA512e97b2cf5a9e9e4fc1d2cf58503dddea5fd4a641af8358b437e418dfc00d608f92e4bf0115b3c4a73cdbf6370041ddcead4cfdefe26f14213b348ede6d9bdb4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize471B
MD55a6a354c3cf43bd3f88091127b2cab6d
SHA10e8896597db07f9848926a2a1feef0b805e76c59
SHA2565ea41876cfd6228b2d5aaad60ae1059359eb15412d1bae897cfb4e55d9993909
SHA512a9023e6e6f0ca6e6bdaac334d33333223b5a8f963b62d2c4c3ae6bbe40e2f34855e9a6e7ef18d38485c89e4cc976eca94f712439599d3650b1f60f3e729d7957
-
Filesize
1KB
MD578f2fcaa601f2fb4ebc937ba532e7549
SHA1ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA256552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
SHA512bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
Filesize398B
MD54e94a76639cf9b65936acb5abba1a78f
SHA1cfe68b56604055eda8e947c872e84df301c615fa
SHA256797542476bef6499f819a41204c500f419de53410fac9c555cf8cf7579fbf985
SHA512157aeb5f722aeeecae93858f58260ee8bbaff57db9ca5e75bc94957e99f08c6c7e832a350f34252e419c6d960bbfc6a95e8ffe73f325dbdaa99bd37c80f51b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD5c62a205b0342802523c74518b87ae420
SHA1092d2ed16dc1a502cf1274a25b69655ee50d5987
SHA25629583630b2905794ac0ed455953f4745774a8e273c0b77e6e9d72f79102eaec8
SHA5125be21c0d0170b8ca146525f255c629049387c601acc14c0711534dbc7052f9365bf722a4a7eb16d7ea38cf1a5ebfc4aec14c0ab35c306d30fbf9608639da189e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_AA53F781F7F4C895625B394C44214055
Filesize398B
MD5224777cea82356b981c80d019733ba00
SHA1ce583f6c4f23b7bed97198ec26458af14015da50
SHA256dfe0ae7f44a660c056a5e770c74f686096062cfa18ede58483f7c766d29cb742
SHA51232c40c9f0fbb9cd35059cd90e019566de2f842c9e00456fa46768b148468e7b33c123ad0328b6eb04c4910aeabc021e4bff5db44a10e854004ae12f50fab6956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Filesize396B
MD5bbeaf82d415be27d9d4b2095278e6c93
SHA1a0574373dce5f10f07639fe3f85eba7f2667dc26
SHA256c97b8d4d92c57b1534d2255bd4cce4896943ab0e2701ac476ab2ad353b66a21c
SHA5120823eafd799d4abe14bf3480e9cf8b43c818d06e57ffcfc2c3f3842022879974299a75dc37b3b1a148a24a41cefa6492081783b0f5cca3f647f12dfa1b6c2a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Filesize254B
MD5e7f7f925a1cca5256a39fe50f9945432
SHA1594d73623f0c88938da9209eddc223772688430b
SHA2560e01b20c41ea9188f6951877f862ee951aafe61954704b66405b715c27d0d5e2
SHA5128d9bd29bff165c99219d053645619f5eccac497001bfc4edff1ceb06e0df3a613b42e6b8ad87f47608bbbf97d74010961060a74883f17a01e5361ca4cbcb0426
-
Filesize
1.5MB
MD5d902d9b6580de0f0264e23b4000b5070
SHA19ca85ea9142c2135fc912bbbcb6d1db85c40f3a4
SHA25667a9e8599ab71865a97e75dae9be438c24d015a93e6a12fb5b450ec558528290
SHA512c971dacbfd9b9bb9e6a6f6d666576c2ff5f8854941b5b9c5057d907032cdba902fab7723bcb2b81108b2657edc964ef90d78f2a43252714350129e72b3c4416b
-
Filesize
1.5MB
MD5d902d9b6580de0f0264e23b4000b5070
SHA19ca85ea9142c2135fc912bbbcb6d1db85c40f3a4
SHA25667a9e8599ab71865a97e75dae9be438c24d015a93e6a12fb5b450ec558528290
SHA512c971dacbfd9b9bb9e6a6f6d666576c2ff5f8854941b5b9c5057d907032cdba902fab7723bcb2b81108b2657edc964ef90d78f2a43252714350129e72b3c4416b