Analysis
-
max time kernel
131s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:44
Static task
static1
Behavioral task
behavioral1
Sample
05f8ad9172465b3119283167c1cc21a0.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
05f8ad9172465b3119283167c1cc21a0.html
Resource
win10v2004-20231222-en
General
-
Target
05f8ad9172465b3119283167c1cc21a0.html
-
Size
113KB
-
MD5
05f8ad9172465b3119283167c1cc21a0
-
SHA1
30bb85706bdc8ca94da50802ce4a4969cd7d5ab2
-
SHA256
65707b1b9211d8539f3400ee53003be11dace65cac64d7938352ccb550939bc5
-
SHA512
22bb373e7256e7218c07cf8578cca8cec4776c6777880fb243b57c86633cb846b61f7c9ff4f6403f508eb8cb531dee13db8f482225a900bf56e8e9274bbeba09
-
SSDEEP
3072:gk22sYJ6rHfgaToXdYK9GfC9a/4D/qIIO7VN+ABuENk:gvoaToAV/4D/qI4
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000e49ae1468d2465eb541228833b9288b23e29021c4e1bc2c23b34dd04b04a5299000000000e8000000002000020000000ead20378037040705424499148684480bb5fed26e9c0d171c695e681ccddeb8c90000000e9926cb9fd99f0fdddb19fd70271588461c0d3a345d58ebf823573e8c6bb38bef6388d6d374fae06e436d23bcfb4f71aed5fc9f3e6d896878461ff7efcde85ac67a6f7f27000b2ba677de6ba5502340fa0ee6543f881599bbd23544e377f29f0a5d8c0ffc70c46dea2e9603fde19bd9ef4963c04190f9a1afd089f70760c8b70764c0cc6a51f89e69073d181be8fe64f400000007ed894a09b70a9205757c142972393763a26d4a7f1ff6e25f88056852efbf4853f5b91b5ca05230075dfb7a93fd6c32173275ee08a4f8ad13ef65f48629da0a2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ed1ed1994703ccce66f843de2603ff6bd0c88ea179b2a471540605c028df2423000000000e8000000002000020000000a67fbef8ec054347db7763d9b3164fbc2a642e372915b92eebb6085eea5eb2c620000000d7c02b1c114ff2725468a89abf7a527972a9d3316acd550a3c652e88a65ffd1640000000cc730060a77fc1cd74d952ab5167d0ae1c52644380408820f314758ba88019806b02ad669e32c6da1f928453ee06a543220a3c8120692b85e67cb5a2f78a0283 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410075045" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00e90eede3ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13522E81-A6D2-11EE-8DE4-FA7CD17678B7} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3000 3044 iexplore.exe 28 PID 3044 wrote to memory of 3000 3044 iexplore.exe 28 PID 3044 wrote to memory of 3000 3044 iexplore.exe 28 PID 3044 wrote to memory of 3000 3044 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05f8ad9172465b3119283167c1cc21a0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD55f5670bf54d1b3403d310e4e28dddd00
SHA14ccbc41dc116b5dc3331eb74920dc94746d46a1d
SHA25682c6149040848e0f3a5277344793bc565468a910172a55133a5b1192fc1a44b1
SHA51285c43723ed087d9d2ba07bd4b42593203ce2a873a967b847a4a94a0c23df8b5449d9807f40975b4e81570db974e9ccf525e21ca0b950a65605e96417feaf3338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59497f551fa9ccd7c5c2b12117d571334
SHA1e91a053f784a4bdb66315001e30de4feba1fa4e7
SHA2569218e96f109dd29ee753d53953fbf8ff050a55d8d725f4e73bfac6b3261c064e
SHA51279f08990e4e26d82ae97d8cccec8644b14694036cba8b7f7889a79b82f07202505221c1966af725f344613ae1db5b51dcd11a0981414182d7f38654a8aafb87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ce3d68ab384b9297ecbf7efb4c75021
SHA1b7fb0e8444a42964bb847e4718a68428b6b54454
SHA256dc2c5de9437c3d30ddb30c6af2633dfb735dbdd0fc154574f3f2f5c17741f957
SHA5120eb789b270cd05433a48b34640bfb01ea7f9c211e815b77eeb88b569397bf9c530fc6bcacd8fe24fe353b3b75c3174216ee14b08300525cd3a4e8e2a9f971ddf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532012357262874b96e3bb8997f22e66b
SHA1aa9328bcdacba9fac1e24b65e1f43f8866f2d8f1
SHA256660efe83364bb33a5083e1570b50cfa60421b69ab88e665670991cf9acc4f1a3
SHA512fbfcae2018c4867c835f94c14902a3712d6970a4b5009828f0acfa5101edfc5e2165e2742ac7221ef4851e905ef22597ed4fbc91caf1f36843e35b30a023cc73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553a2426f5fd7f18d118981ababaf3c64
SHA18621c71749744e49ba1897b08c5249436f00c6cd
SHA256005491e38d5b202892f593ce309765c9fa084074aea1ffe2f3a30bcae77af2e1
SHA512a7fdbcce51e1a624c01918d2970b18fdb5dcb89ec666773151d77e08b56895e9c8a0219e15b89847ec4060548d2d000a73d466f05b6cd4bce25dda0a55c0c75d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559fef1fcdd919080c0e952983a67ca49
SHA17017d92ca50273e55742585dfd0ca021dc5b99a3
SHA2568ddd075ee696c0763bf36fe25cad342f6f3149bbfe0a8202c11f499b08e644a8
SHA5125af1f55f98c6045213fe9d4f9d7b624a00b3dedbc9b0a6ad6a693b793b9f97455af474c9f88809f7e5411fba3ac8da6d1083ce698ecc945906fc58c38216e552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ffe00f768f262f98f7cf2072fa4f74e
SHA1719c1802e9d34827876581767dac7a78bbbfcc6c
SHA256cc5aeadb1cfdcd34f7e743e4d1845573c9c54c43645591891b274222b816fa8e
SHA5121cc0c477f60516b9e45e59be121d2c59f57f8c7e2b5c130a496dc2dd523609e157bb4beb1b0b92cf7b734d1c17f6c14f94960bd9ec8c23a2716bd8a6cf4b8f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dd832e1741f560f6dc445a7219d4ccc
SHA1fcd7b48c9eb0f9e6bdb89859c3ea35d0762a7ced
SHA2560b78057446e936b0ac545451f6309426851ff4e406948be5e5b6b51ddfac8c9c
SHA5120a4abff01d34d1d64b8e3705a816eeae9c38e558cdf50990f31bb2b5520964daf002b70ad51a8931a942d01bd9067932fb4540b9e6ab8bc0097acf5eb285dd34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3e29e18dc3889f90bb65f7caa3bf130
SHA1b83de2bd5efb922717d3c1784901006c4864c011
SHA2566058876c0dcb8aca9fced3d154acf229d3b9a44fbb0bd57a6694287272dcaa02
SHA512172b448466673e47ef69d07c26b5e5c23e2a1d569e99a43a372b2a8ddeea7be1de7fba10390f8c5e3999aa35204e110f1158e3ce9fd76c47993446336323c2fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5516b22a60e5cfcccfb1ab8225d663647
SHA12a1f16d4e52fe377256a7ec7a332a5d535562563
SHA256a832e33aae6a51c84d9b052449de9ac89fd5c46548095bbc6ef83cd775a139e2
SHA5122aee0ed01747e685010dc9dcf02eeec4d4a110013f5fce820a0eede36198da8d0519791552cfa4983f0fe122f252fc99531644d3ba675429b289fdddc60673a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53926b459311c7c6f731baaf6cbef0861
SHA12d4759b05902446a3018b630f6a80fb18cc93539
SHA256e93df931ea8dc72a03d50ceef059006e07dd9e2be08c81a934ed3c57fc0a5b97
SHA5126a2ef9109ee09768ffce49eac91205aef491497174aba644b61f067b878de5f15dcf294463ddb0fe4c2b7f11a2644499130cb4093f41efaf43327688496062d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f06ad20fc0af4ad24085a17938f6d1a
SHA1ca26cc51ed4ede95c16943d63bf48cd0f8fefce3
SHA256e6c6e7bae3f662d2a07206c76ff49ba5dfadfbe83fb97a4e04a92784b4f0a3cd
SHA512f993980c8a07be61e5b1e707d551b9d890e18ed39457306e3b644db9785eb4058b795c28105c498e2e97d60ce41f129fa2e5c7a2b97431b144accc466206d20c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d12e54550393c4acc466b51b98aa2070
SHA1446973c832e3d4fd789ae7075cbe0ead02f4c1da
SHA256b5471bf5e2431bab30d42fbc9c6c0a181f15d35faa81dffdd1095edd29566460
SHA5120242fab8e163584f75a0971b2940a35ef9920beb95ea8258694449e7cf3be87b84f1bb315f3890ce49d029cf06e96bd14b0a0901944e76bfe0ad350a0c0be47a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5288cc397d28f9456aeb950956a5af3da
SHA1edfbf2ab82871e6f917255441ea8a6b33811bbef
SHA256f76f6cf18bec0036f1473e31b3addce3a8db98b74f52e36c29ed51a82ea7ea50
SHA5128eb1355be31ff73206779da247a68883cc79f75233991d09f896846db972aff7a0f0b063ed7b3c8bbb1a44c6de5e346dc2b564bd65245687b74394ebe9da7c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHW3VR8J\jquery.min[1].js
Filesize89KB
MD5a1a8cb16a060f6280a767187fd22e037
SHA17622c9ac2335be6dcd3ab8b47132e94089cef931
SHA256d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
SHA512252476e9f94a6db579e14cdf1197555e856e6b80dbcd78c46b9345ce6605a1cd69da0dab2a4c475b51d2103404d2c61acd18490e005d625eca06afe4d75c8a6c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XP2B38AI\204402360-widget_css_bundle[1].css
Filesize30KB
MD5123e73e213c43b44b9b248dbfe063dcd
SHA1766a241b6502e19de002c08ca1fefb413d3fc28f
SHA256eac64365f691073d4103638d8087cf35fd9e91fb0f5b2f7a219ea2bc39f782b5
SHA512829a32e2312bcd9edd4d58720a12a9017b005e95ead1e0ba245ce92fc5f9619226dfd986e1aaa6f047b5c4e2cc2c639a02ee7bdde7a85062e02141d217e05dd6
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06