Analysis
-
max time kernel
201s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe
Resource
win10v2004-20221111-en
General
-
Target
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe
-
Size
446KB
-
MD5
08d1101774d5c33748639d68ced23e36
-
SHA1
e3d112b4e70ee3da615e9fafbe7aaa1202f1f186
-
SHA256
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16
-
SHA512
53b1556f2f790eef64479a3c410f9a86bbf81146868e16477c1a1f170ede0168c5b8fc9b789c89c6111c03790d4d8d6a6ba848a23d2ed5a2ad376897f8ba08c5
-
SSDEEP
6144:XzfSZ8vRxCRxYRAMRX0KHXdFP5WgUykA2GPJRC295vdZ6Wrc5C0cpefagQ0:2SY/uNFPN72GhRb1ZJgQ0
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 3644 installd.exe 4084 nethtsrv.exe 2624 netupdsrv.exe 4692 nethtsrv.exe 1760 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exeinstalld.exenethtsrv.exenethtsrv.exepid process 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 3644 installd.exe 4084 nethtsrv.exe 4084 nethtsrv.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4692 nethtsrv.exe 4692 nethtsrv.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Windows\SysWOW64\hfpapi.dll 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Windows\SysWOW64\installd.exe 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Windows\SysWOW64\nethtsrv.exe 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Windows\SysWOW64\netupdsrv.exe 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe -
Drops file in Program Files directory 3 IoCs
Processes:
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 4692 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4000 wrote to memory of 3824 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 3824 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 3824 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 3824 wrote to memory of 3468 3824 net.exe net1.exe PID 3824 wrote to memory of 3468 3824 net.exe net1.exe PID 3824 wrote to memory of 3468 3824 net.exe net1.exe PID 4000 wrote to memory of 4544 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 4544 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 4544 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4544 wrote to memory of 8 4544 net.exe net1.exe PID 4544 wrote to memory of 8 4544 net.exe net1.exe PID 4544 wrote to memory of 8 4544 net.exe net1.exe PID 4000 wrote to memory of 3644 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe installd.exe PID 4000 wrote to memory of 3644 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe installd.exe PID 4000 wrote to memory of 3644 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe installd.exe PID 4000 wrote to memory of 4084 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe nethtsrv.exe PID 4000 wrote to memory of 4084 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe nethtsrv.exe PID 4000 wrote to memory of 4084 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe nethtsrv.exe PID 4000 wrote to memory of 2624 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe netupdsrv.exe PID 4000 wrote to memory of 2624 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe netupdsrv.exe PID 4000 wrote to memory of 2624 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe netupdsrv.exe PID 4000 wrote to memory of 4560 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 4560 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 4560 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4560 wrote to memory of 3308 4560 net.exe net1.exe PID 4560 wrote to memory of 3308 4560 net.exe net1.exe PID 4560 wrote to memory of 3308 4560 net.exe net1.exe PID 4000 wrote to memory of 3412 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 3412 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 4000 wrote to memory of 3412 4000 43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe net.exe PID 3412 wrote to memory of 2876 3412 net.exe net1.exe PID 3412 wrote to memory of 2876 3412 net.exe net1.exe PID 3412 wrote to memory of 2876 3412 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe"C:\Users\Admin\AppData\Local\Temp\43a21be7a521f039542105801ba98ff46a0159ea4f4f27a72d6cd39afd029f16.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:3468
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:8
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3644 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4084 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3308
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:2876
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5b06c4d1c506858c92f96e39b67f3f142
SHA191b09b1412247016c0cedbbdfedd670b9ce1fcbc
SHA2563c6a2bcb70888ce14b525fd51e8b0fd6457590f115a4eca6268e880a3823b9ea
SHA51258a47934216cee80497dae9639eac85251e26931b6ebc2bfc0012b52cf7334bc97004fead7c19d776d3bc83eb6ca5ad036dc40c34ea45160180f366b27844ea6
-
Filesize
106KB
MD5b06c4d1c506858c92f96e39b67f3f142
SHA191b09b1412247016c0cedbbdfedd670b9ce1fcbc
SHA2563c6a2bcb70888ce14b525fd51e8b0fd6457590f115a4eca6268e880a3823b9ea
SHA51258a47934216cee80497dae9639eac85251e26931b6ebc2bfc0012b52cf7334bc97004fead7c19d776d3bc83eb6ca5ad036dc40c34ea45160180f366b27844ea6
-
Filesize
106KB
MD5b06c4d1c506858c92f96e39b67f3f142
SHA191b09b1412247016c0cedbbdfedd670b9ce1fcbc
SHA2563c6a2bcb70888ce14b525fd51e8b0fd6457590f115a4eca6268e880a3823b9ea
SHA51258a47934216cee80497dae9639eac85251e26931b6ebc2bfc0012b52cf7334bc97004fead7c19d776d3bc83eb6ca5ad036dc40c34ea45160180f366b27844ea6
-
Filesize
106KB
MD5b06c4d1c506858c92f96e39b67f3f142
SHA191b09b1412247016c0cedbbdfedd670b9ce1fcbc
SHA2563c6a2bcb70888ce14b525fd51e8b0fd6457590f115a4eca6268e880a3823b9ea
SHA51258a47934216cee80497dae9639eac85251e26931b6ebc2bfc0012b52cf7334bc97004fead7c19d776d3bc83eb6ca5ad036dc40c34ea45160180f366b27844ea6
-
Filesize
241KB
MD5424366167c789bbb926bd043c0f9eab5
SHA102467e17d41e8f02253fb87458c6efaba9111b94
SHA2568170b81b28a23f09753c18513a937681f78a416ad3e5e1ed1d01b8bf1d502aa7
SHA5129474c983cb0c9a492156a466ad027440706bd3bd246f8fb21069b6b5f8357f0cd1682ec8165511e33c5556b73875ffbf4a3fa439956be7856081a414368c1b5d
-
Filesize
241KB
MD5424366167c789bbb926bd043c0f9eab5
SHA102467e17d41e8f02253fb87458c6efaba9111b94
SHA2568170b81b28a23f09753c18513a937681f78a416ad3e5e1ed1d01b8bf1d502aa7
SHA5129474c983cb0c9a492156a466ad027440706bd3bd246f8fb21069b6b5f8357f0cd1682ec8165511e33c5556b73875ffbf4a3fa439956be7856081a414368c1b5d
-
Filesize
241KB
MD5424366167c789bbb926bd043c0f9eab5
SHA102467e17d41e8f02253fb87458c6efaba9111b94
SHA2568170b81b28a23f09753c18513a937681f78a416ad3e5e1ed1d01b8bf1d502aa7
SHA5129474c983cb0c9a492156a466ad027440706bd3bd246f8fb21069b6b5f8357f0cd1682ec8165511e33c5556b73875ffbf4a3fa439956be7856081a414368c1b5d
-
Filesize
108KB
MD521a947a3f67085d29b8e1004f483d618
SHA1644e5f070e985e24fe17443a0155b8a2ce036733
SHA2561096b3357002dd1f45e2bb284c05b09ecffe4cd01b5e7eeec5ad639613d5a791
SHA512b19542cf20f858257df8aafb5c536fae87aaed839ba2bab19dab608a61e6240909a1e019718b9b1ae19ae8874e98ad5b3dc54446812a0ebe11aaaffe68804ca1
-
Filesize
108KB
MD521a947a3f67085d29b8e1004f483d618
SHA1644e5f070e985e24fe17443a0155b8a2ce036733
SHA2561096b3357002dd1f45e2bb284c05b09ecffe4cd01b5e7eeec5ad639613d5a791
SHA512b19542cf20f858257df8aafb5c536fae87aaed839ba2bab19dab608a61e6240909a1e019718b9b1ae19ae8874e98ad5b3dc54446812a0ebe11aaaffe68804ca1
-
Filesize
176KB
MD5fb10b940a7643b0753fd6f0fa9e07564
SHA1362f709049e760f14226d250b5073ae1650cffa5
SHA25622317d1a19a6d210b3877ceab0d179293e8f18dd7bc7250939b4f3bff3f24514
SHA5120a75d7bd385938eb7bee796fbcd8e0ee915986a2b658e2a4dcc8597f2170f07d35b6251c8b7de20dc5bdd23af14e42f3cb4ce150e581f6afdce45298af1448e8
-
Filesize
176KB
MD5fb10b940a7643b0753fd6f0fa9e07564
SHA1362f709049e760f14226d250b5073ae1650cffa5
SHA25622317d1a19a6d210b3877ceab0d179293e8f18dd7bc7250939b4f3bff3f24514
SHA5120a75d7bd385938eb7bee796fbcd8e0ee915986a2b658e2a4dcc8597f2170f07d35b6251c8b7de20dc5bdd23af14e42f3cb4ce150e581f6afdce45298af1448e8
-
Filesize
176KB
MD5fb10b940a7643b0753fd6f0fa9e07564
SHA1362f709049e760f14226d250b5073ae1650cffa5
SHA25622317d1a19a6d210b3877ceab0d179293e8f18dd7bc7250939b4f3bff3f24514
SHA5120a75d7bd385938eb7bee796fbcd8e0ee915986a2b658e2a4dcc8597f2170f07d35b6251c8b7de20dc5bdd23af14e42f3cb4ce150e581f6afdce45298af1448e8
-
Filesize
159KB
MD5d372f89633453d139e31e7a3afec0da7
SHA1671fec1743cb3b5d0dd604466e7036fadccb6937
SHA25610a97334834242e712fc3ce6e4441ab1045ecebce3b9481e69cc5b4bbd4449b2
SHA5122374d79f81ff70af13a1b6324800d3e728fcf0f2b55f43deb8e59a374127fde4e67d264bc5629041eb099bee3bc47ec6ad8a093c46cc5eeecec952784fac0d4e
-
Filesize
159KB
MD5d372f89633453d139e31e7a3afec0da7
SHA1671fec1743cb3b5d0dd604466e7036fadccb6937
SHA25610a97334834242e712fc3ce6e4441ab1045ecebce3b9481e69cc5b4bbd4449b2
SHA5122374d79f81ff70af13a1b6324800d3e728fcf0f2b55f43deb8e59a374127fde4e67d264bc5629041eb099bee3bc47ec6ad8a093c46cc5eeecec952784fac0d4e
-
Filesize
159KB
MD5d372f89633453d139e31e7a3afec0da7
SHA1671fec1743cb3b5d0dd604466e7036fadccb6937
SHA25610a97334834242e712fc3ce6e4441ab1045ecebce3b9481e69cc5b4bbd4449b2
SHA5122374d79f81ff70af13a1b6324800d3e728fcf0f2b55f43deb8e59a374127fde4e67d264bc5629041eb099bee3bc47ec6ad8a093c46cc5eeecec952784fac0d4e