Overview
overview
10Static
static
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10a ton of y... -.exe
windows7-x64
10a ton of y... -.exe
windows10-2004-x64
10Analysis
-
max time kernel
1784s -
max time network
1793s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 02:08
Behavioral task
behavioral1
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral23
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral29
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral31
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
Resource
win10v2004-20240419-en
General
-
Target
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
-
Size
63KB
-
MD5
222c2d239f4c8a1d73c736c9cc712807
-
SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
-
SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
-
SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
SSDEEP
1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
Malware Config
Extracted
xworm
127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638
-
Install_directory
%LocalAppData%
-
install_file
uwumonster.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral20/memory/4088-1-0x0000000000470000-0x0000000000486000-memory.dmp family_xworm behavioral20/files/0x0008000000022958-9.dat family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe -
Executes dropped EXE 30 IoCs
pid Process 2720 uwumonster.exe 1672 uwumonster.exe 4556 uwumonster.exe 324 uwumonster.exe 1580 uwumonster.exe 2388 uwumonster.exe 1332 uwumonster.exe 1440 uwumonster.exe 796 uwumonster.exe 4908 uwumonster.exe 4568 uwumonster.exe 2372 uwumonster.exe 2352 uwumonster.exe 3460 uwumonster.exe 2716 uwumonster.exe 1140 uwumonster.exe 1844 uwumonster.exe 3328 uwumonster.exe 1944 uwumonster.exe 4924 uwumonster.exe 4868 uwumonster.exe 4632 uwumonster.exe 1152 uwumonster.exe 4304 uwumonster.exe 4920 uwumonster.exe 1984 uwumonster.exe 2744 uwumonster.exe 1508 uwumonster.exe 4276 uwumonster.exe 5000 uwumonster.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uwumonster = "C:\\Users\\Admin\\AppData\\Local\\uwumonster.exe" ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4120 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 4088 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe Token: SeDebugPrivilege 4088 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe Token: SeDebugPrivilege 2720 uwumonster.exe Token: SeDebugPrivilege 1672 uwumonster.exe Token: SeDebugPrivilege 4556 uwumonster.exe Token: SeDebugPrivilege 324 uwumonster.exe Token: SeDebugPrivilege 1580 uwumonster.exe Token: SeDebugPrivilege 2388 uwumonster.exe Token: SeDebugPrivilege 1332 uwumonster.exe Token: SeDebugPrivilege 1440 uwumonster.exe Token: SeDebugPrivilege 796 uwumonster.exe Token: SeDebugPrivilege 4908 uwumonster.exe Token: SeDebugPrivilege 4568 uwumonster.exe Token: SeDebugPrivilege 2372 uwumonster.exe Token: SeDebugPrivilege 2352 uwumonster.exe Token: SeDebugPrivilege 3460 uwumonster.exe Token: SeDebugPrivilege 2716 uwumonster.exe Token: SeDebugPrivilege 1140 uwumonster.exe Token: SeDebugPrivilege 1844 uwumonster.exe Token: SeDebugPrivilege 3328 uwumonster.exe Token: SeDebugPrivilege 1944 uwumonster.exe Token: SeDebugPrivilege 4924 uwumonster.exe Token: SeDebugPrivilege 4868 uwumonster.exe Token: SeDebugPrivilege 4632 uwumonster.exe Token: SeDebugPrivilege 1152 uwumonster.exe Token: SeDebugPrivilege 4304 uwumonster.exe Token: SeDebugPrivilege 4920 uwumonster.exe Token: SeDebugPrivilege 1984 uwumonster.exe Token: SeDebugPrivilege 2744 uwumonster.exe Token: SeDebugPrivilege 1508 uwumonster.exe Token: SeDebugPrivilege 4276 uwumonster.exe Token: SeDebugPrivilege 5000 uwumonster.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4088 wrote to memory of 4120 4088 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 85 PID 4088 wrote to memory of 4120 4088 ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"2⤵
- Creates scheduled task(s)
PID:4120
-
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:324
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:796
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
63KB
MD5222c2d239f4c8a1d73c736c9cc712807
SHA1c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA5121f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02