Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 20:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe
-
Size
2.1MB
-
MD5
a0535458543a549e1b70f1b11a6c3046
-
SHA1
2199c6ae8417504a88414df68f842cd500de59c9
-
SHA256
47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e
-
SHA512
5238b65736c5148718e742df03801d07a4a6da5e37f9973f0276db3d69ded8548129e9dd97d141c5478ef5a0755848ab11b51fa2effa5af2409bcb4a6a7af443
-
SSDEEP
24576:hpo/2+ttPJLfpRK3C1Slt78Yt78k/eXV6KIv0gE4MMqbb0uoJbLO1xfvMeHININq:ge2PJLa3C1W7v7Ve4L44KQucbLO/0cq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\s: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\w: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\z: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\a: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\e: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\l: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\n: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\q: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\r: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\y: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\g: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\h: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\m: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\o: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\v: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\x: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\b: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\j: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\k: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\p: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\t: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened (read-only) \??\u: 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/620-0-0x0000000000400000-0x0000000000511000-memory.dmp autoit_exe behavioral2/files/0x000900000002340c-10.dat autoit_exe behavioral2/memory/620-30-0x0000000000400000-0x0000000000511000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File created \??\f:\autorun.inf 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe File opened for modification F:\\autorun.inf 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 620 wrote to memory of 3960 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 82 PID 620 wrote to memory of 3960 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 82 PID 620 wrote to memory of 3960 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 82 PID 3960 wrote to memory of 4900 3960 cmd.exe 84 PID 3960 wrote to memory of 4900 3960 cmd.exe 84 PID 3960 wrote to memory of 4900 3960 cmd.exe 84 PID 620 wrote to memory of 460 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 85 PID 620 wrote to memory of 460 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 85 PID 620 wrote to memory of 460 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 85 PID 460 wrote to memory of 4036 460 cmd.exe 87 PID 460 wrote to memory of 4036 460 cmd.exe 87 PID 460 wrote to memory of 4036 460 cmd.exe 87 PID 620 wrote to memory of 768 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 93 PID 620 wrote to memory of 768 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 93 PID 620 wrote to memory of 768 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 93 PID 768 wrote to memory of 1804 768 cmd.exe 95 PID 768 wrote to memory of 1804 768 cmd.exe 95 PID 768 wrote to memory of 1804 768 cmd.exe 95 PID 620 wrote to memory of 2408 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 96 PID 620 wrote to memory of 2408 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 96 PID 620 wrote to memory of 2408 620 47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe 96 PID 2408 wrote to memory of 1080 2408 cmd.exe 98 PID 2408 wrote to memory of 1080 2408 cmd.exe 98 PID 2408 wrote to memory of 1080 2408 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe"C:\Users\Admin\AppData\Local\Temp\47ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵
- System Location Discovery: System Language Discovery
PID:4036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5948c74cd98911b420ff89dac13399bcb
SHA176dfc73518f003953923b1b4f2b973f4bb56a411
SHA25694a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
SHA512b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
-
Filesize
2.1MB
MD5a0535458543a549e1b70f1b11a6c3046
SHA12199c6ae8417504a88414df68f842cd500de59c9
SHA25647ae2f954bdd1bb145271f717531c6aeb133936d92b9e6a94219fe0f74676f9e
SHA5125238b65736c5148718e742df03801d07a4a6da5e37f9973f0276db3d69ded8548129e9dd97d141c5478ef5a0755848ab11b51fa2effa5af2409bcb4a6a7af443