Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 16:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e7dae10afec3e0c26f1842ca0a7d9c0N.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
120 seconds
General
-
Target
7e7dae10afec3e0c26f1842ca0a7d9c0N.exe
-
Size
178KB
-
MD5
7e7dae10afec3e0c26f1842ca0a7d9c0
-
SHA1
328fa95901d28a84d55afcda681016871a6a0b5a
-
SHA256
7a2d14aa628aab63b12c0508344b64bed41fca3716f67d62c18a955e1bae35f8
-
SHA512
ba7a05dc40656e0dd8be601232dadf8c309d394afc98732dba2ef73c1115ba9b8ebbc5d99ff7c0357ee4bdaef15b0c2eab05b385bc77481bbc91c545a2fce3d5
-
SSDEEP
3072:oi7oIVHpkiOQdhY2wO+IMsx0UCHsqqRDZ71Xh7uYYytjoutxb:oi7oIVJkiBE28QnDBuytjoSt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2100 AFKVY.zz -
Loads dropped DLL 5 IoCs
pid Process 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 2368 AdapterTroubleshooter.exe -
resource yara_rule behavioral1/memory/1812-3-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-14-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-12-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-10-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-8-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-6-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-4-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-30-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-32-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-28-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-26-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-24-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-20-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-34-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-36-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-35-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-18-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-16-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1812-22-0x00000000001B0000-0x0000000000206000-memory.dmp upx behavioral1/memory/1800-123-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-131-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-129-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-127-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-125-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-121-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-119-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-117-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-115-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-113-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-112-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-137-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-133-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-141-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-139-0x00000000005C0000-0x0000000000616000-memory.dmp upx behavioral1/memory/1800-135-0x00000000005C0000-0x0000000000616000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1800 set thread context of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 -
Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYmain.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\776F686578123.IMD AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\s2.txt AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\s.txt AdapterTroubleshooter.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\s.txt AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\CWU.SHZ AFKVY.zz File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYmain.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\$$.tmp AdapterTroubleshooter.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\s1.txt AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\ok.txt 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYmain.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\CWU.SHZ AdapterTroubleshooter.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYs1.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\s1.txt AdapterTroubleshooter.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\s2.txt AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYmain.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYs1.ini AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\776F686578123.IMD AdapterTroubleshooter.exe File created C:\Program Files (x86)\Tencent\qq\776F686578\AFKVYss1.ini 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\web\656961666166617C.tmp 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Windows\web\656961666166617C.tmp 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File created C:\Windows\web\656961666166617C.tmp 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe File opened for modification C:\Windows\web\656961666166617C.tmp 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdapterTroubleshooter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe 2368 AdapterTroubleshooter.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2368 AdapterTroubleshooter.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe Token: SeDebugPrivilege 2368 AdapterTroubleshooter.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2100 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 30 PID 1812 wrote to memory of 2100 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 30 PID 1812 wrote to memory of 2100 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 30 PID 1812 wrote to memory of 2100 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 30 PID 1812 wrote to memory of 1800 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 31 PID 1812 wrote to memory of 1800 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 31 PID 1812 wrote to memory of 1800 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 31 PID 1812 wrote to memory of 1800 1812 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 31 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32 PID 1800 wrote to memory of 2368 1800 7e7dae10afec3e0c26f1842ca0a7d9c0N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exe"C:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz"C:\Program Files (x86)\Tencent\qq\776F686578\AFKVY.zz" -z 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2100
-
-
C:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exeC:\Users\Admin\AppData\Local\Temp\7e7dae10afec3e0c26f1842ca0a7d9c0N.exe2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe -EMBEDDING 423B5D51736E6673606C2147686D64722129793937285D55646F62646F755D70705D363637473739373436395D4256542F52495B 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD53d98d29648003d42f51a59b8c01ef5c0
SHA1a4ac397b139c9b79a85afe7ce0482a8fe80f6b57
SHA256faaff60e29beb6d21fc324cff60246357d1ab42cbc2d50fc938bab4206303fe0
SHA512087eecc5f88837edd630f088f0e9111800b4e956d7b3874da31329d58ab55857d2179f578ecd516c2ac0671ffb08fa5f31f8c053bc24985481420fdbbab1bb92
-
Filesize
1KB
MD5f527f1cc382565a06de77bfbab213be6
SHA1e9dd470d06ae59eccb5aecc020a96a877ab841d6
SHA2566f1448d4216de766a41f29d11ece93ac15c6b597ce7d93120bc2e1a71bc67bda
SHA5127c8cee035033dfb67cc21e72a1dabe61ac2548d3b995adf544278d85a9f43ff0484b82a3428a41dbd53bd7b17dbac5e9197d2c2e7aedf1e4ba3884f4cb639ac5
-
Filesize
22B
MD577c001c62fb95d065e34ec25e5864fc0
SHA1bd38b0eb0e33ab931fb0d356358b9c086f4997f0
SHA256decfe4ed60f15089019fa10459c9541b270d767900078f420a4b07458d592c67
SHA512ca610a3e18f92731108c6038212256be655fc86c6e5284cfc4484e987f436aa1b3922feb623ed04888a5e80576cbd1beb5cee3c6200ba3c17b303e4b12306f1a
-
Filesize
109KB
MD500a51edfd6a21ef8bfaad17a05ee8776
SHA1aebbadb726daf64e65127bbd024cc56dcf41aea6
SHA25658dba017c96ef288d5ed3d46ce3d41a9e371933c355c515e4165e80acf564f58
SHA512cacc2be13301d5570a5260b6fa91be23273b5b7db26b57c1ba955b1c74b60c9659aa81146f4f23c82983a96ffe69b161576a20de09937eae8f6833ccf608ca9d
-
Filesize
178KB
MD5b2b4e838654d37a401da4b16c78b3ed6
SHA15ce9e311e9dc32b10f923445834000f908b70cb6
SHA25650e59d759d9cc430d7ac8dc17dc72b2371ed08db0ae520323942a16cc54d72fd
SHA5122917eb2eee4d53547c45d9e9c783ed0b364b622f0dafad6ac8e5f157c0d3c0593bc886ba5cca46bcdaf9902881b99d1e40fd2b776c31fed13cea4d0f214cffef
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94