Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe
Resource
win10v2004-20221111-en
General
-
Target
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe
-
Size
446KB
-
MD5
d141690e4b38011b41fdc209ae7c2efd
-
SHA1
61841c062d376c6466fdbcc984cae7ab29be0a06
-
SHA256
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56
-
SHA512
5c0d6742c2af4b8f1a635044306d18e117e42b9843d64972a91f6cf8467b49614bd6fdc868bfbd61b9bcbcad9010daff0d017cdb141728d350517892357f5b69
-
SSDEEP
12288:RXgt0rfmU628WdQTxVAdJJyzNbcY7cxXYF+jp:RXgtMuzWClVOJYpL7cxIct
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1736 installd.exe 856 nethtsrv.exe 316 netupdsrv.exe 1244 nethtsrv.exe 1720 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exeinstalld.exenethtsrv.exenethtsrv.exepid process 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1736 installd.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 856 nethtsrv.exe 856 nethtsrv.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe 1244 nethtsrv.exe 1244 nethtsrv.exe 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Windows\SysWOW64\hfpapi.dll 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Windows\SysWOW64\installd.exe 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Windows\SysWOW64\nethtsrv.exe 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Windows\SysWOW64\netupdsrv.exe 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe -
Drops file in Program Files directory 3 IoCs
Processes:
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 472 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1244 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1288 wrote to memory of 1148 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 1148 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 1148 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 1148 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1148 wrote to memory of 1332 1148 net.exe net1.exe PID 1148 wrote to memory of 1332 1148 net.exe net1.exe PID 1148 wrote to memory of 1332 1148 net.exe net1.exe PID 1148 wrote to memory of 1332 1148 net.exe net1.exe PID 1288 wrote to memory of 764 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 764 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 764 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 764 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 764 wrote to memory of 1344 764 net.exe net1.exe PID 764 wrote to memory of 1344 764 net.exe net1.exe PID 764 wrote to memory of 1344 764 net.exe net1.exe PID 764 wrote to memory of 1344 764 net.exe net1.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 1736 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe installd.exe PID 1288 wrote to memory of 856 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe nethtsrv.exe PID 1288 wrote to memory of 856 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe nethtsrv.exe PID 1288 wrote to memory of 856 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe nethtsrv.exe PID 1288 wrote to memory of 856 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe nethtsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 316 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe netupdsrv.exe PID 1288 wrote to memory of 2036 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 2036 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 2036 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 2036 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 2036 wrote to memory of 1192 2036 net.exe net1.exe PID 2036 wrote to memory of 1192 2036 net.exe net1.exe PID 2036 wrote to memory of 1192 2036 net.exe net1.exe PID 2036 wrote to memory of 1192 2036 net.exe net1.exe PID 1288 wrote to memory of 340 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 340 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 340 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 1288 wrote to memory of 340 1288 54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe net.exe PID 340 wrote to memory of 1364 340 net.exe net1.exe PID 340 wrote to memory of 1364 340 net.exe net1.exe PID 340 wrote to memory of 1364 340 net.exe net1.exe PID 340 wrote to memory of 1364 340 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe"C:\Users\Admin\AppData\Local\Temp\54c06c40ca493723f8a7adfa8f81d6efff9dea0123c080c20c2b08443bfefb56.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1332
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1344
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:316 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1192
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1364
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5754ca10c3ab6a3b18071879dfadb4301
SHA1fa837390bef2515efc68337668abc57106e925f7
SHA25695febd952e15ed2a1b9cd80555b9829bb4cc6a74795a60708648634867f51701
SHA5124e9c784f1542ff48a952c1f08c09d3bae84e6b20cee8457edf360185fde6165bfcb7eecf3c39e87c0921c4d22b6595b11ae64990020cafb569d274deb0332328
-
Filesize
241KB
MD59b212dd52d866c850d3f0e977b6a0010
SHA14bf4f130edc99d8ce743b05741b81164510933fa
SHA2562ed26e0c1d37e4a14c4ead74ff1c6178092cdf90d1c381aacde4866c4d13aa32
SHA5128b5fbb86c895b739e770b831759d19778993502223503a77c4e8118c98f8ead29ca7f08eba9d1ee1015f581ec31722f0c9edf127b98def8490ab4ab6a9b00142
-
Filesize
108KB
MD57791b1dbd524dfe8d5e2113317f5e03d
SHA140637bc964f4075189dd02ac154ff9298a72cd27
SHA25683e7432d8a83e9f1f51261a6c6c74f74fbe69c7a3c2fe39714b796b4fcbdeec1
SHA5120782ff9c188e9a6af4db32fd417fe36c608aee12c2a05709aadd244e7f95130304dbbd070849624aa4074ec39b45f483bf6cd4f2b01a39e61a9d7770b0f5fd83
-
Filesize
176KB
MD52958acdb662ea114a1ed8cd790a42770
SHA12ac2159d2d90f707c1543be1c1993b755aad6422
SHA25601f197684ccea565623e9e4b65f2e5a50c305d3460be75a3beb36a5fccbd9111
SHA512486fb67afdd76b0fce92cdbed6fe286d77c8c4fbdb901765e9e856aa239a094606655a15f4ba4b90add1633c9947343846db0552f998713a1ab3c4a8edb8673e
-
Filesize
176KB
MD52958acdb662ea114a1ed8cd790a42770
SHA12ac2159d2d90f707c1543be1c1993b755aad6422
SHA25601f197684ccea565623e9e4b65f2e5a50c305d3460be75a3beb36a5fccbd9111
SHA512486fb67afdd76b0fce92cdbed6fe286d77c8c4fbdb901765e9e856aa239a094606655a15f4ba4b90add1633c9947343846db0552f998713a1ab3c4a8edb8673e
-
Filesize
158KB
MD504a7956877ee51a75e452af31d8c0834
SHA1b8dd2c613710e79474358d5eff524485d4eb2c67
SHA2561e752f2283d4faab7a2d1ec7d7a20c26bf1c46cf14247a7e214a0c4bd85ba298
SHA51270c06647d0bddca35dc9ca7a5215de602eb58411575d137fc303dc6919541c89b360ab10b92fe127748b80c7f134a3e3c232d4373e96e57be6ae9d7a56e7b909
-
Filesize
158KB
MD504a7956877ee51a75e452af31d8c0834
SHA1b8dd2c613710e79474358d5eff524485d4eb2c67
SHA2561e752f2283d4faab7a2d1ec7d7a20c26bf1c46cf14247a7e214a0c4bd85ba298
SHA51270c06647d0bddca35dc9ca7a5215de602eb58411575d137fc303dc6919541c89b360ab10b92fe127748b80c7f134a3e3c232d4373e96e57be6ae9d7a56e7b909
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5754ca10c3ab6a3b18071879dfadb4301
SHA1fa837390bef2515efc68337668abc57106e925f7
SHA25695febd952e15ed2a1b9cd80555b9829bb4cc6a74795a60708648634867f51701
SHA5124e9c784f1542ff48a952c1f08c09d3bae84e6b20cee8457edf360185fde6165bfcb7eecf3c39e87c0921c4d22b6595b11ae64990020cafb569d274deb0332328
-
Filesize
106KB
MD5754ca10c3ab6a3b18071879dfadb4301
SHA1fa837390bef2515efc68337668abc57106e925f7
SHA25695febd952e15ed2a1b9cd80555b9829bb4cc6a74795a60708648634867f51701
SHA5124e9c784f1542ff48a952c1f08c09d3bae84e6b20cee8457edf360185fde6165bfcb7eecf3c39e87c0921c4d22b6595b11ae64990020cafb569d274deb0332328
-
Filesize
106KB
MD5754ca10c3ab6a3b18071879dfadb4301
SHA1fa837390bef2515efc68337668abc57106e925f7
SHA25695febd952e15ed2a1b9cd80555b9829bb4cc6a74795a60708648634867f51701
SHA5124e9c784f1542ff48a952c1f08c09d3bae84e6b20cee8457edf360185fde6165bfcb7eecf3c39e87c0921c4d22b6595b11ae64990020cafb569d274deb0332328
-
Filesize
241KB
MD59b212dd52d866c850d3f0e977b6a0010
SHA14bf4f130edc99d8ce743b05741b81164510933fa
SHA2562ed26e0c1d37e4a14c4ead74ff1c6178092cdf90d1c381aacde4866c4d13aa32
SHA5128b5fbb86c895b739e770b831759d19778993502223503a77c4e8118c98f8ead29ca7f08eba9d1ee1015f581ec31722f0c9edf127b98def8490ab4ab6a9b00142
-
Filesize
241KB
MD59b212dd52d866c850d3f0e977b6a0010
SHA14bf4f130edc99d8ce743b05741b81164510933fa
SHA2562ed26e0c1d37e4a14c4ead74ff1c6178092cdf90d1c381aacde4866c4d13aa32
SHA5128b5fbb86c895b739e770b831759d19778993502223503a77c4e8118c98f8ead29ca7f08eba9d1ee1015f581ec31722f0c9edf127b98def8490ab4ab6a9b00142
-
Filesize
108KB
MD57791b1dbd524dfe8d5e2113317f5e03d
SHA140637bc964f4075189dd02ac154ff9298a72cd27
SHA25683e7432d8a83e9f1f51261a6c6c74f74fbe69c7a3c2fe39714b796b4fcbdeec1
SHA5120782ff9c188e9a6af4db32fd417fe36c608aee12c2a05709aadd244e7f95130304dbbd070849624aa4074ec39b45f483bf6cd4f2b01a39e61a9d7770b0f5fd83
-
Filesize
176KB
MD52958acdb662ea114a1ed8cd790a42770
SHA12ac2159d2d90f707c1543be1c1993b755aad6422
SHA25601f197684ccea565623e9e4b65f2e5a50c305d3460be75a3beb36a5fccbd9111
SHA512486fb67afdd76b0fce92cdbed6fe286d77c8c4fbdb901765e9e856aa239a094606655a15f4ba4b90add1633c9947343846db0552f998713a1ab3c4a8edb8673e
-
Filesize
158KB
MD504a7956877ee51a75e452af31d8c0834
SHA1b8dd2c613710e79474358d5eff524485d4eb2c67
SHA2561e752f2283d4faab7a2d1ec7d7a20c26bf1c46cf14247a7e214a0c4bd85ba298
SHA51270c06647d0bddca35dc9ca7a5215de602eb58411575d137fc303dc6919541c89b360ab10b92fe127748b80c7f134a3e3c232d4373e96e57be6ae9d7a56e7b909