Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 04:31
Behavioral task
behavioral1
Sample
618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe
Resource
win7-20220812-en
General
-
Target
618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe
-
Size
280KB
-
MD5
1243b2ad0c307d811c19c2c46d28d636
-
SHA1
02e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
-
SHA256
618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
-
SHA512
4068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
SSDEEP
6144:m3LZpsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPd2:SbeAtpVxagMU/plruchDofAPM
Malware Config
Extracted
cybergate
v1.02.0
GRATIS
bowo.no-ip.biz:82
3P06T6K7C531W1
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Executes dropped EXE 2 IoCs
pid Process 1172 server.exe 1600 server.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R43G15V0-115N-27KE-E6WN-45MNOM1U8Y8P} 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R43G15V0-115N-27KE-E6WN-45MNOM1U8Y8P}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R43G15V0-115N-27KE-E6WN-45MNOM1U8Y8P} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R43G15V0-115N-27KE-E6WN-45MNOM1U8Y8P}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
resource yara_rule behavioral1/memory/1584-56-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral1/memory/1584-65-0x0000000024070000-0x00000000240CF000-memory.dmp upx behavioral1/memory/1868-70-0x0000000024070000-0x00000000240CF000-memory.dmp upx behavioral1/memory/1868-73-0x0000000024070000-0x00000000240CF000-memory.dmp upx behavioral1/memory/1584-75-0x00000000240D0000-0x000000002412F000-memory.dmp upx behavioral1/memory/1584-81-0x0000000024130000-0x000000002418F000-memory.dmp upx behavioral1/memory/1796-86-0x0000000024130000-0x000000002418F000-memory.dmp upx behavioral1/memory/1796-87-0x0000000024130000-0x000000002418F000-memory.dmp upx behavioral1/memory/1796-98-0x0000000024130000-0x000000002418F000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 1796 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 1796 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe File opened for modification C:\Windows\SysWOW64\install\ 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1796 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1796 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe Token: SeDebugPrivilege 1796 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10 PID 1584 wrote to memory of 1412 1584 618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe"C:\Users\Admin\AppData\Local\Temp\618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
PID:1868
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe"C:\Users\Admin\AppData\Local\Temp\618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608.exe"3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Executes dropped EXE
PID:1600
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"3⤵
- Executes dropped EXE
PID:1172
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD52c453c2ba94c98a57a37459b5ff4b1c4
SHA17d5e694328ba2439baf77c94e10b606e17d77710
SHA2564ecba45a39e0edfcd0e352207b7ee78ba346a1ca94f8ea4a2bafd5edb038e926
SHA512ebd4753f2a19ab3f602e2633f7b8e71a2f3f974145c3f2c92f7162332c9dc4e1318a98759bcfa9d82ab43aa942f059f580a81a1e3a32fb43225b20e270f493e0
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae
-
Filesize
280KB
MD51243b2ad0c307d811c19c2c46d28d636
SHA102e9dbf9a1c75fe7a61a95d0c68a4034f5cca727
SHA256618519d9d7863551fb1a33f5397ae510f19cdbae6fbdfd25757f037445b4f608
SHA5124068de9bc94c9c30f59d8bbbd34f54af80af9595b45477e353287fa5193a6345d993d6e1b11cfc09ba9bca345448845ff43671092b5f6926a8270568c7f507ae