Overview
overview
10Static
static
31d059ca891...d4.exe
windows10-2004-x64
101d90edda9f...51.exe
windows7-x64
31d90edda9f...51.exe
windows10-2004-x64
101e44c41d8d...91.exe
windows10-2004-x64
101ed736973c...3e.exe
windows10-2004-x64
10559234fc52...e2.exe
windows10-2004-x64
105a4570005d...a4.exe
windows7-x64
35a4570005d...a4.exe
windows10-2004-x64
1061f1a776dc...62.exe
windows10-2004-x64
1067045db960...01.exe
windows10-2004-x64
106d684b37ca...5c.exe
windows10-2004-x64
1077cbabe9fe...cf.exe
windows7-x64
377cbabe9fe...cf.exe
windows10-2004-x64
108a73bb4899...c3.exe
windows10-2004-x64
108db3c27c31...88.exe
windows7-x64
38db3c27c31...88.exe
windows10-2004-x64
10b72cfb2517...df.exe
windows10-2004-x64
10c2ef692d84...7e.exe
windows7-x64
3c2ef692d84...7e.exe
windows10-2004-x64
10c39106a352...4e.exe
windows7-x64
10c39106a352...4e.exe
windows10-2004-x64
10ca6d56a637...da.exe
windows10-2004-x64
10db14966ca7...cb.exe
windows7-x64
10db14966ca7...cb.exe
windows10-2004-x64
10e800205bb9...fd.exe
windows7-x64
3e800205bb9...fd.exe
windows10-2004-x64
10f8a2da44f9...41.exe
windows10-2004-x64
10fc8b501a18...d3.exe
windows7-x64
3fc8b501a18...d3.exe
windows10-2004-x64
10Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 11:48
Static task
static1
Behavioral task
behavioral1
Sample
1d059ca891566e0006cb4534dc4ff845fedd1d3d468c12366e12f98a815ed7d4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win7-20240419-en
Behavioral task
behavioral13
Sample
77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
8a73bb4899be69e1a77d74c46f81ca29b85b5c67b642e09f9735dec87b8b4cc3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe
Resource
win7-20240220-en
General
-
Target
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe
-
Size
515KB
-
MD5
1b6ca4b3887874447697d2dac0664cf5
-
SHA1
0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2
-
SHA256
f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41
-
SHA512
4435a0bfc90dd2574a28ce91d519a4566ff85413fb13b5c6690d2e868410abda41ebd05e4129f20fdfafb989d5f2bf424ef84234925ebb33123e0a434a4d6a5d
-
SSDEEP
12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ
Malware Config
Extracted
amadey
3.86
http://77.91.68.61
-
install_dir
925e7e99c5
-
install_file
pdates.exe
-
strings_key
ada76b8b0e1f6892ee93c20ab8946117
-
url_paths
/rock/index.php
Extracted
redline
lande
77.91.124.84:19071
-
auth_value
9fa41701c47df37786234f3373f21208
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral27/files/0x0008000000023439-19.dat healer behavioral27/memory/4836-22-0x00000000004B0000-0x00000000004BA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6513102.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a6513102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6513102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6513102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6513102.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6513102.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral27/files/0x0007000000023434-43.dat family_redline behavioral27/memory/2304-45-0x0000000000240000-0x0000000000270000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation b1736941.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 9 IoCs
pid Process 4336 v9071750.exe 4668 v1399127.exe 4836 a6513102.exe 4064 b1736941.exe 1860 pdates.exe 4220 c2251742.exe 2452 pdates.exe 2304 d4275669.exe 1468 pdates.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a6513102.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v9071750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v1399127.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2251742.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2251742.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c2251742.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4548 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4836 a6513102.exe 4836 a6513102.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4836 a6513102.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1448 wrote to memory of 4336 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 84 PID 1448 wrote to memory of 4336 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 84 PID 1448 wrote to memory of 4336 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 84 PID 4336 wrote to memory of 4668 4336 v9071750.exe 86 PID 4336 wrote to memory of 4668 4336 v9071750.exe 86 PID 4336 wrote to memory of 4668 4336 v9071750.exe 86 PID 4668 wrote to memory of 4836 4668 v1399127.exe 87 PID 4668 wrote to memory of 4836 4668 v1399127.exe 87 PID 4668 wrote to memory of 4064 4668 v1399127.exe 90 PID 4668 wrote to memory of 4064 4668 v1399127.exe 90 PID 4668 wrote to memory of 4064 4668 v1399127.exe 90 PID 4064 wrote to memory of 1860 4064 b1736941.exe 91 PID 4064 wrote to memory of 1860 4064 b1736941.exe 91 PID 4064 wrote to memory of 1860 4064 b1736941.exe 91 PID 4336 wrote to memory of 4220 4336 v9071750.exe 92 PID 4336 wrote to memory of 4220 4336 v9071750.exe 92 PID 4336 wrote to memory of 4220 4336 v9071750.exe 92 PID 1860 wrote to memory of 4548 1860 pdates.exe 93 PID 1860 wrote to memory of 4548 1860 pdates.exe 93 PID 1860 wrote to memory of 4548 1860 pdates.exe 93 PID 1860 wrote to memory of 5032 1860 pdates.exe 95 PID 1860 wrote to memory of 5032 1860 pdates.exe 95 PID 1860 wrote to memory of 5032 1860 pdates.exe 95 PID 5032 wrote to memory of 616 5032 cmd.exe 97 PID 5032 wrote to memory of 616 5032 cmd.exe 97 PID 5032 wrote to memory of 616 5032 cmd.exe 97 PID 5032 wrote to memory of 856 5032 cmd.exe 98 PID 5032 wrote to memory of 856 5032 cmd.exe 98 PID 5032 wrote to memory of 856 5032 cmd.exe 98 PID 5032 wrote to memory of 4564 5032 cmd.exe 99 PID 5032 wrote to memory of 4564 5032 cmd.exe 99 PID 5032 wrote to memory of 4564 5032 cmd.exe 99 PID 5032 wrote to memory of 3152 5032 cmd.exe 100 PID 5032 wrote to memory of 3152 5032 cmd.exe 100 PID 5032 wrote to memory of 3152 5032 cmd.exe 100 PID 5032 wrote to memory of 932 5032 cmd.exe 101 PID 5032 wrote to memory of 932 5032 cmd.exe 101 PID 5032 wrote to memory of 932 5032 cmd.exe 101 PID 5032 wrote to memory of 2408 5032 cmd.exe 102 PID 5032 wrote to memory of 2408 5032 cmd.exe 102 PID 5032 wrote to memory of 2408 5032 cmd.exe 102 PID 1448 wrote to memory of 2304 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 106 PID 1448 wrote to memory of 2304 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 106 PID 1448 wrote to memory of 2304 1448 f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"C:\Users\Admin\AppData\Local\Temp\f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9071750.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1399127.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6513102.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1736941.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F6⤵
- Creates scheduled task(s)
PID:4548
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:616
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"7⤵PID:856
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E7⤵PID:4564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3152
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"7⤵PID:932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E7⤵PID:2408
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c2251742.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4220
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d4275669.exe2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:2452
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:1468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
174KB
MD535c0945f8c70c870c070eb2261d6bc04
SHA1bfc1ffae759330be5a50c22829fb342bfc644aab
SHA256e296c73bc0d4abe0e58a2200d0c1839c210debd4deb8b26aa83abc5a2f0aaa1d
SHA5128c9e5e646dfcd6b592d516524128d34af326c55a153d77d240ddbe6f418f01be473231e78a1707d72b0fbe3ad367085fc76ff329d8d80515ac07288b5eda73b7
-
Filesize
359KB
MD588bee46f431c014c1e45417f6b13e124
SHA107588e0723944e251a6a2d9db4ed8e45d5f563f1
SHA256f4dfc88066f344cec64c3c5076b4e1e051af9f333c455aa2f96daacc1d732999
SHA5125a0c53df34632e2d21c12e572460d54bfe7de21035d44bc36764ed3c6410d661ee50c758366cc8b86c2447b54efab7c41479fb04468afee6b70b9cbbaf55e79e
-
Filesize
36KB
MD588331cf94b56745070654ca04d4c7d98
SHA1248ac76afce09c34082bad3fbd01ce73e4056f65
SHA25632e850a828611bdf20e34f0ac6c397507ff4b140c2b13732b5bf389249693334
SHA512a3173aaeb138cb46f951d1e6b103a424c91ee05b416cdc9080e3ac5ba6db33dd0431d1ba0b8228b379f6ea6631b5c6622a4875459ce1105a0b959722e7717f96
-
Filesize
234KB
MD58f620f99bbeba489fc4bddc2af02f9b8
SHA12e97752a24581dd229306cfad5763cf82f9c4f96
SHA25626a1717813eedfd0569c474064d1e14eeba61b97bb26866c53a19428a448a3f5
SHA512b5065ed02a3bdcb68461265bb56f9173a7f9a1c75d12cf1ae53c43224cf2aada5586a4ee122779d7c83b8e8130cc6a980080cd03c2cc751ce19ac5ea3b2caa03
-
Filesize
13KB
MD512803f40ef0b813626de6e5eb0ec05b2
SHA127e32adac36ba9f4d54ecbf53e112158d4e988b5
SHA256d320fcef46ae85d5f06133a3b8d4f5a7d2dff0886a86d981f3186f464fbb7abb
SHA51284d7c28b03fdceb94e00fbcc838f203f6cd9e091b67b7ea8dad577a529a0d96eecf3b246a8548c9b7bef1e063aa96525f6b2148b5d0bb79b32a3415e9f151e0a
-
Filesize
225KB
MD52b7ed1055ddd27afe675dd11da92357a
SHA13809cb22cbdda5ba5707892163217563020df5ca
SHA2569d69e620d8bb7cb24c7d4831312351d09872badc8331594ce05afe46ff56ab3d
SHA512549602e7e10ae1b006fafe9d6c1c09d35280a3af8815157dfa9b7664f16bf1682cc782585a24202dd150955073b5e648f0ad8a39add3f95ceeb51a5eb26fc641