Overview
overview
6Static
static
3Feather La....1.exe
windows7-x64
6Feather La....1.exe
windows10-2004-x64
6$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...64.exe
windows7-x64
1$PLUGINSDI...64.exe
windows10-2004-x64
1$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3Feather Launcher.exe
windows7-x64
5Feather Launcher.exe
windows10-2004-x64
5LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...up.exe
windows7-x64
1resources/...up.exe
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
148s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 05:50
Static task
static1
Behavioral task
behavioral1
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Feather Launcher.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Feather Launcher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win7-20240611-en
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win7-20240419-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240508-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240611-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
General
-
Target
Feather Launcher.exe
-
Size
145.0MB
-
MD5
9ef1ecce599882119c5a0715f66dcc55
-
SHA1
f6e57a26c0f353ae14302a0a08eed0b4d8946619
-
SHA256
4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
-
SHA512
f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
-
SSDEEP
3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Feather Launcher.exeFeather Launcher.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation Feather Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\International\Geo\Nation Feather Launcher.exe -
Loads dropped DLL 1 IoCs
Processes:
Feather Launcher.exepid process 2640 Feather Launcher.exe -
Modifies registry class 7 IoCs
Processes:
Feather Launcher.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Feather Launcher.exe\" \"%1\"" Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\URL Protocol Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\ = "URL:feathermc" Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\shell\open\command Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\shell Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\feathermc\shell\open Feather Launcher.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Feather Launcher.exeFeather Launcher.exeFeather Launcher.exepid process 1628 Feather Launcher.exe 2108 Feather Launcher.exe 1736 Feather Launcher.exe 1736 Feather Launcher.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Feather Launcher.exedescription pid process Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe Token: SeShutdownPrivilege 1736 Feather Launcher.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Feather Launcher.exeFeather Launcher.exedescription pid process target process PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2596 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2488 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2488 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2488 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2640 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2640 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 2640 1736 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 1628 2640 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 1628 2640 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 1628 2640 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 2108 2640 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 2108 2640 Feather Launcher.exe Feather Launcher.exe PID 2640 wrote to memory of 2108 2640 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe PID 1736 wrote to memory of 1196 1736 Feather Launcher.exe Feather Launcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1028 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1288 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1480 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1236 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
7.0MB
MD57c665f5be07c5c43fa97973838b6a8ce
SHA103a3d5c39fbe0c43fa1560ed63276d905b2b74e9
SHA2564b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815
SHA512c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d