Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 11:00
Static task
static1
Behavioral task
behavioral1
Sample
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe
Resource
win10v2004-20220812-en
General
-
Target
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe
-
Size
446KB
-
MD5
516ea7974e64a77641ddae2190b31091
-
SHA1
e747ba55b0f5a02157a60c12341e6d51bf92b248
-
SHA256
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436
-
SHA512
b678831be939e44adda0c5236d9aa239d23e113317203b5dde93c5407b48ebfcc6263f32bc402aef3d2b30accd04adf22e794ac40b860bdaefb6dd2d1aebf9e4
-
SSDEEP
12288:V5dlwBR/J1ygItISdHArUR+BIHAsyOhN3UlBOn:V5de434Bu5hVCcn
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 816 installd.exe 3692 nethtsrv.exe 320 netupdsrv.exe 2688 nethtsrv.exe 732 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exeinstalld.exenethtsrv.exenethtsrv.exepid process 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 816 installd.exe 3692 nethtsrv.exe 3692 nethtsrv.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 2688 nethtsrv.exe 2688 nethtsrv.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Windows\SysWOW64\hfpapi.dll 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Windows\SysWOW64\installd.exe 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Windows\SysWOW64\nethtsrv.exe 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Windows\SysWOW64\netupdsrv.exe 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe -
Drops file in Program Files directory 3 IoCs
Processes:
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\ver.xml 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe File created C:\Program Files (x86)\Common Files\Config\data.xml 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 2688 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3040 wrote to memory of 4360 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 4360 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 4360 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 4360 wrote to memory of 808 4360 net.exe net1.exe PID 4360 wrote to memory of 808 4360 net.exe net1.exe PID 4360 wrote to memory of 808 4360 net.exe net1.exe PID 3040 wrote to memory of 4864 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 4864 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 4864 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 4864 wrote to memory of 2260 4864 net.exe net1.exe PID 4864 wrote to memory of 2260 4864 net.exe net1.exe PID 4864 wrote to memory of 2260 4864 net.exe net1.exe PID 3040 wrote to memory of 816 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe installd.exe PID 3040 wrote to memory of 816 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe installd.exe PID 3040 wrote to memory of 816 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe installd.exe PID 3040 wrote to memory of 3692 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe nethtsrv.exe PID 3040 wrote to memory of 3692 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe nethtsrv.exe PID 3040 wrote to memory of 3692 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe nethtsrv.exe PID 3040 wrote to memory of 320 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe netupdsrv.exe PID 3040 wrote to memory of 320 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe netupdsrv.exe PID 3040 wrote to memory of 320 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe netupdsrv.exe PID 3040 wrote to memory of 2780 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 2780 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 2780 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 2780 wrote to memory of 3140 2780 net.exe net1.exe PID 2780 wrote to memory of 3140 2780 net.exe net1.exe PID 2780 wrote to memory of 3140 2780 net.exe net1.exe PID 3040 wrote to memory of 2704 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 2704 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 3040 wrote to memory of 2704 3040 07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe net.exe PID 2704 wrote to memory of 2384 2704 net.exe net1.exe PID 2704 wrote to memory of 2384 2704 net.exe net1.exe PID 2704 wrote to memory of 2384 2704 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe"C:\Users\Admin\AppData\Local\Temp\07d34f6a2aa730c8e738765802c547d5bccc22a8d25b80b48f178e94c9cc2436.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:808
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:2260
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3692 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:320 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3140
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:2384
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5abbe612f0bd3e761195cdeaa872dc364
SHA1da5589515978255d60af920808ff77d4b55584ac
SHA256bc3611d704ba9865999cd5b2b73e3926a7b6d872d427d2a689109abaeedeb81f
SHA51254d533e0862ad17fe9b8decfaf59ea7b9873e8c1af1506d447d1298c8663d5d480da753108fafd23be9fa610558a6f1567243a22d3001a5a08611e87ea6afb3e
-
Filesize
106KB
MD5abbe612f0bd3e761195cdeaa872dc364
SHA1da5589515978255d60af920808ff77d4b55584ac
SHA256bc3611d704ba9865999cd5b2b73e3926a7b6d872d427d2a689109abaeedeb81f
SHA51254d533e0862ad17fe9b8decfaf59ea7b9873e8c1af1506d447d1298c8663d5d480da753108fafd23be9fa610558a6f1567243a22d3001a5a08611e87ea6afb3e
-
Filesize
106KB
MD5abbe612f0bd3e761195cdeaa872dc364
SHA1da5589515978255d60af920808ff77d4b55584ac
SHA256bc3611d704ba9865999cd5b2b73e3926a7b6d872d427d2a689109abaeedeb81f
SHA51254d533e0862ad17fe9b8decfaf59ea7b9873e8c1af1506d447d1298c8663d5d480da753108fafd23be9fa610558a6f1567243a22d3001a5a08611e87ea6afb3e
-
Filesize
106KB
MD5abbe612f0bd3e761195cdeaa872dc364
SHA1da5589515978255d60af920808ff77d4b55584ac
SHA256bc3611d704ba9865999cd5b2b73e3926a7b6d872d427d2a689109abaeedeb81f
SHA51254d533e0862ad17fe9b8decfaf59ea7b9873e8c1af1506d447d1298c8663d5d480da753108fafd23be9fa610558a6f1567243a22d3001a5a08611e87ea6afb3e
-
Filesize
241KB
MD536cffcfa23da84cb8a01e4a43475feed
SHA12942be6b103a9cd45e97afe2f89690eb49be9b19
SHA25617c488c8043d81dbd00ae45930d9dec51e89f359555357e48801422d64aa0b6b
SHA51276e10c00681e944d1cbf1e9fd4a37d0acea38109dbb8142cc5d175aa118704e3935501428c96dcc79b1fd6d1f4789fec8d3dadd356455775d862a26d63ebb8fb
-
Filesize
241KB
MD536cffcfa23da84cb8a01e4a43475feed
SHA12942be6b103a9cd45e97afe2f89690eb49be9b19
SHA25617c488c8043d81dbd00ae45930d9dec51e89f359555357e48801422d64aa0b6b
SHA51276e10c00681e944d1cbf1e9fd4a37d0acea38109dbb8142cc5d175aa118704e3935501428c96dcc79b1fd6d1f4789fec8d3dadd356455775d862a26d63ebb8fb
-
Filesize
241KB
MD536cffcfa23da84cb8a01e4a43475feed
SHA12942be6b103a9cd45e97afe2f89690eb49be9b19
SHA25617c488c8043d81dbd00ae45930d9dec51e89f359555357e48801422d64aa0b6b
SHA51276e10c00681e944d1cbf1e9fd4a37d0acea38109dbb8142cc5d175aa118704e3935501428c96dcc79b1fd6d1f4789fec8d3dadd356455775d862a26d63ebb8fb
-
Filesize
108KB
MD5ed37773ae3e36fbc4d315725df848f87
SHA14f71820986f13b08088b4d9e038855b438c48bcb
SHA256a45f4bdb7e8dff6e42b4f4fa35f3b310854081c72c40c064d077320749f2f63b
SHA51293830a1895eb02ffeae6d5695246439992782651d702b43374a608b5481ae4f807455b2d5faf4ddd567e746d644175536dda5bddf3c225d337b26fe04ab26f39
-
Filesize
108KB
MD5ed37773ae3e36fbc4d315725df848f87
SHA14f71820986f13b08088b4d9e038855b438c48bcb
SHA256a45f4bdb7e8dff6e42b4f4fa35f3b310854081c72c40c064d077320749f2f63b
SHA51293830a1895eb02ffeae6d5695246439992782651d702b43374a608b5481ae4f807455b2d5faf4ddd567e746d644175536dda5bddf3c225d337b26fe04ab26f39
-
Filesize
176KB
MD5488cf783cbbf2bcc97c0ff3db660f458
SHA1b92b1c2303081f21dead4ecd5beb9d9f7519d164
SHA2562399b4a151dac64c192b511b5fa518ce3155644b2a68a34625132a1ab45ff05c
SHA5121ec395e0b32bb57beb258ee15df4691344ed71d698e7c009a9a04b05e2ca2e0f366741b941e9c082f3240f2869da47d2b53a60b38412686f9e6e228ec9c414ed
-
Filesize
176KB
MD5488cf783cbbf2bcc97c0ff3db660f458
SHA1b92b1c2303081f21dead4ecd5beb9d9f7519d164
SHA2562399b4a151dac64c192b511b5fa518ce3155644b2a68a34625132a1ab45ff05c
SHA5121ec395e0b32bb57beb258ee15df4691344ed71d698e7c009a9a04b05e2ca2e0f366741b941e9c082f3240f2869da47d2b53a60b38412686f9e6e228ec9c414ed
-
Filesize
176KB
MD5488cf783cbbf2bcc97c0ff3db660f458
SHA1b92b1c2303081f21dead4ecd5beb9d9f7519d164
SHA2562399b4a151dac64c192b511b5fa518ce3155644b2a68a34625132a1ab45ff05c
SHA5121ec395e0b32bb57beb258ee15df4691344ed71d698e7c009a9a04b05e2ca2e0f366741b941e9c082f3240f2869da47d2b53a60b38412686f9e6e228ec9c414ed
-
Filesize
158KB
MD58ae63a5b8d79c29fc35196dd03195207
SHA117d029ea11a6db4b31cec123fb480e57a221823f
SHA2564800a00ec1102964afd08360d44c1341dcd095255f108dab83822d93bb3fdc34
SHA512d6cf17cfbe9bd4bd6a61a3cb597f58812088dde81a074ccca5c1133642df688c5f9ff6a8da8d520716e8b05cb1a8ead0d90b3708d24add7508fd364222b96494
-
Filesize
158KB
MD58ae63a5b8d79c29fc35196dd03195207
SHA117d029ea11a6db4b31cec123fb480e57a221823f
SHA2564800a00ec1102964afd08360d44c1341dcd095255f108dab83822d93bb3fdc34
SHA512d6cf17cfbe9bd4bd6a61a3cb597f58812088dde81a074ccca5c1133642df688c5f9ff6a8da8d520716e8b05cb1a8ead0d90b3708d24add7508fd364222b96494
-
Filesize
158KB
MD58ae63a5b8d79c29fc35196dd03195207
SHA117d029ea11a6db4b31cec123fb480e57a221823f
SHA2564800a00ec1102964afd08360d44c1341dcd095255f108dab83822d93bb3fdc34
SHA512d6cf17cfbe9bd4bd6a61a3cb597f58812088dde81a074ccca5c1133642df688c5f9ff6a8da8d520716e8b05cb1a8ead0d90b3708d24add7508fd364222b96494