Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:50
Static task
static1
Behavioral task
behavioral1
Sample
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
Resource
win10v2004-20220901-en
General
-
Target
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe
-
Size
446KB
-
MD5
5022ddd697aafffb0b26c3b1b9cf304d
-
SHA1
d80171e02cc5f788ec7cee640bf54c9e4984089d
-
SHA256
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90
-
SHA512
096555f7c3942c2822e0fe72d65c73dde1f26e1eefb456066c1e3278e87e746b5a60558ff64b6d309f128f007e509ed02d2e6b44eb1ef2b490eb126e65ce0ba5
-
SSDEEP
12288:8eB/W2xiFVzZ0vuPaxWml1YD5uBzPEH3xfKBYzuiHkMq:8s/8zaWP0Wml6D5u5CxfLaiu
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1472 installd.exe 2248 nethtsrv.exe 2952 netupdsrv.exe 1788 nethtsrv.exe 2732 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exeinstalld.exenethtsrv.exenethtsrv.exepid process 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 1472 installd.exe 2248 nethtsrv.exe 2248 nethtsrv.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 1788 nethtsrv.exe 1788 nethtsrv.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Windows\SysWOW64\hfpapi.dll ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Windows\SysWOW64\installd.exe ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Windows\SysWOW64\nethtsrv.exe ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Windows\SysWOW64\netupdsrv.exe ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe -
Drops file in Program Files directory 3 IoCs
Processes:
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 640 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1788 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4964 wrote to memory of 5024 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 5024 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 5024 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 5024 wrote to memory of 1652 5024 net.exe net1.exe PID 5024 wrote to memory of 1652 5024 net.exe net1.exe PID 5024 wrote to memory of 1652 5024 net.exe net1.exe PID 4964 wrote to memory of 404 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 404 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 404 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 404 wrote to memory of 396 404 net.exe net1.exe PID 404 wrote to memory of 396 404 net.exe net1.exe PID 404 wrote to memory of 396 404 net.exe net1.exe PID 4964 wrote to memory of 1472 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe installd.exe PID 4964 wrote to memory of 1472 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe installd.exe PID 4964 wrote to memory of 1472 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe installd.exe PID 4964 wrote to memory of 2248 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe nethtsrv.exe PID 4964 wrote to memory of 2248 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe nethtsrv.exe PID 4964 wrote to memory of 2248 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe nethtsrv.exe PID 4964 wrote to memory of 2952 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe netupdsrv.exe PID 4964 wrote to memory of 2952 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe netupdsrv.exe PID 4964 wrote to memory of 2952 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe netupdsrv.exe PID 4964 wrote to memory of 4328 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 4328 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 4328 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4328 wrote to memory of 4204 4328 net.exe net1.exe PID 4328 wrote to memory of 4204 4328 net.exe net1.exe PID 4328 wrote to memory of 4204 4328 net.exe net1.exe PID 4964 wrote to memory of 4244 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 4244 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4964 wrote to memory of 4244 4964 ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe net.exe PID 4244 wrote to memory of 3924 4244 net.exe net1.exe PID 4244 wrote to memory of 3924 4244 net.exe net1.exe PID 4244 wrote to memory of 3924 4244 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe"C:\Users\Admin\AppData\Local\Temp\ee0ab15289e71208d00d44f6aaf455e844b70c630eddc05aa347e49d1444de90.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:396
-
-
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472
-
-
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248
-
-
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:2952
-
-
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:4204
-
-
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:3924
-
-
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:2732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5c81f56666e2d2899988c58012de346b1
SHA1be458b935b1869168ff6d571aab029b6719cda53
SHA2561ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4
SHA5122c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96
-
Filesize
106KB
MD5c81f56666e2d2899988c58012de346b1
SHA1be458b935b1869168ff6d571aab029b6719cda53
SHA2561ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4
SHA5122c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96
-
Filesize
106KB
MD5c81f56666e2d2899988c58012de346b1
SHA1be458b935b1869168ff6d571aab029b6719cda53
SHA2561ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4
SHA5122c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96
-
Filesize
106KB
MD5c81f56666e2d2899988c58012de346b1
SHA1be458b935b1869168ff6d571aab029b6719cda53
SHA2561ead8851828e6caeca922717c17f525fbb2f3c21f0b5293c2ef2b8b39d87b3e4
SHA5122c8adec007efd1e33d4add4cb76cc9a4ab815f2606bb1a7f22a1ecbc76ae47df57e31eb8c2ec710e34e4e5741aa687ff1628494989d140a368193b41b719ee96
-
Filesize
244KB
MD56f69effe3d80211c4a88b67f07c98dac
SHA183daa68cb2570ccfb3248d4e3e9ec0a278344273
SHA256c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c
SHA512f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58
-
Filesize
244KB
MD56f69effe3d80211c4a88b67f07c98dac
SHA183daa68cb2570ccfb3248d4e3e9ec0a278344273
SHA256c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c
SHA512f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58
-
Filesize
244KB
MD56f69effe3d80211c4a88b67f07c98dac
SHA183daa68cb2570ccfb3248d4e3e9ec0a278344273
SHA256c4582e9fe401ea97d1dd812842c22eef4c5d271ab243a1b2abe72ccbaca7291c
SHA512f19015722bbdd89f1a68a42ba8c7b7701a2c6f79a486b2406faa7a5eabc727fc941fe82398c1807fdb9c0d3efdb402d707d6c5a1df811c285410a45c7b847d58
-
Filesize
108KB
MD521f92086cf1141727d513054ae2e1d40
SHA18b934f130e765d697aae285de2d975c95248ea82
SHA2561d140d485b4d54e19883569b8ccd205e149ee4563cddbbec2701ecb7e7004210
SHA512c54c609b8ad5f268c22aa3616c1293d28b80e3f4692b5d49a3326a39ac9db1a75446a8f3106a87a37866dff2c1120f7a1066061e7658427583ff89df6036d5c9
-
Filesize
108KB
MD521f92086cf1141727d513054ae2e1d40
SHA18b934f130e765d697aae285de2d975c95248ea82
SHA2561d140d485b4d54e19883569b8ccd205e149ee4563cddbbec2701ecb7e7004210
SHA512c54c609b8ad5f268c22aa3616c1293d28b80e3f4692b5d49a3326a39ac9db1a75446a8f3106a87a37866dff2c1120f7a1066061e7658427583ff89df6036d5c9
-
Filesize
176KB
MD5dc385f28a1bfd46aec8b6ea70f04cff6
SHA170fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1
SHA256a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0
SHA5128fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93
-
Filesize
176KB
MD5dc385f28a1bfd46aec8b6ea70f04cff6
SHA170fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1
SHA256a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0
SHA5128fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93
-
Filesize
176KB
MD5dc385f28a1bfd46aec8b6ea70f04cff6
SHA170fbd3dfc1f1b8fee9d98c24ee75c145bc0b9aa1
SHA256a046cede829395906080a2162de2a20a3209b2371a98413e666190e319dea0a0
SHA5128fd1b871523827419bfca24a492eeb0008555345cbf669f87b1d33ad64ba6fd52d56091fd8bdf42908c6cf74cda777c47e40b1bcadede416fc35fb162dc21a93
-
Filesize
158KB
MD5359e61de232b33baf33363c25dc0966c
SHA11247715208e4809667c8fd9497032dfeb73e6092
SHA2568fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf
SHA51288a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285
-
Filesize
158KB
MD5359e61de232b33baf33363c25dc0966c
SHA11247715208e4809667c8fd9497032dfeb73e6092
SHA2568fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf
SHA51288a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285
-
Filesize
158KB
MD5359e61de232b33baf33363c25dc0966c
SHA11247715208e4809667c8fd9497032dfeb73e6092
SHA2568fc60bccc83f75bfec7a766114d458974bd3eeb7a5256efc1bb07784da665caf
SHA51288a5627f8b47b4d7d4cb5a2c1b7ce6909d07f50c2dc8a06f0e94658067c3e8ba498df2158e85a2263f2e6ae105dbd3bcf6dc50934fa7ceb1ab081fac9d2c7285