Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/10/2024, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe
Resource
win10v2004-20241007-en
General
-
Target
8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe
-
Size
2.3MB
-
MD5
822db8eb88a164fd728c6f95bf2ecd57
-
SHA1
7cc5bd501e50b83b07ac8672968b72e0b0344fef
-
SHA256
8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501
-
SHA512
36039a61a6635de9dcc315db138e48442eb276419a4a065eb88280c7fd9c79708dec502845025fc0fffc688e8e5efa8362b247f3e354d41e6411d985288f5445
-
SSDEEP
49152:sJpFFF8WhsN7o3owasuJZvjrUXZArwJDKIyeR:sJpF81o3owasuJZvjrUXZAMBKIy
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2912 CS16Launcher.exe 908 hl.exe -
Loads dropped DLL 12 IoCs
pid Process 2844 cmd.exe 2844 cmd.exe 2912 CS16Launcher.exe 2912 CS16Launcher.exe 908 hl.exe 908 hl.exe 908 hl.exe 908 hl.exe 908 hl.exe 908 hl.exe 908 hl.exe 908 hl.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 hl.exe -
Enumerates processes with tasklist 1 TTPs 4 IoCs
pid Process 2836 tasklist.exe 1572 tasklist.exe 2896 tasklist.exe 2740 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CS16Launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2628 PING.EXE 1612 PING.EXE 1036 PING.EXE 1116 PING.EXE 3056 PING.EXE 2732 PING.EXE 1864 PING.EXE 1988 PING.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe -
Runs ping.exe 1 TTPs 8 IoCs
pid Process 2628 PING.EXE 1612 PING.EXE 1036 PING.EXE 1116 PING.EXE 3056 PING.EXE 2732 PING.EXE 1864 PING.EXE 1988 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2836 tasklist.exe Token: SeDebugPrivilege 1572 tasklist.exe Token: SeDebugPrivilege 2896 tasklist.exe Token: SeDebugPrivilege 2740 tasklist.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 908 hl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 276 wrote to memory of 2844 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 33 PID 276 wrote to memory of 2844 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 33 PID 276 wrote to memory of 2844 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 33 PID 276 wrote to memory of 2844 276 8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe 33 PID 2844 wrote to memory of 2828 2844 cmd.exe 35 PID 2844 wrote to memory of 2828 2844 cmd.exe 35 PID 2844 wrote to memory of 2828 2844 cmd.exe 35 PID 2844 wrote to memory of 2828 2844 cmd.exe 35 PID 2828 wrote to memory of 2836 2828 cmd.exe 36 PID 2828 wrote to memory of 2836 2828 cmd.exe 36 PID 2828 wrote to memory of 2836 2828 cmd.exe 36 PID 2828 wrote to memory of 2836 2828 cmd.exe 36 PID 2828 wrote to memory of 2676 2828 cmd.exe 37 PID 2828 wrote to memory of 2676 2828 cmd.exe 37 PID 2828 wrote to memory of 2676 2828 cmd.exe 37 PID 2828 wrote to memory of 2676 2828 cmd.exe 37 PID 2844 wrote to memory of 2732 2844 cmd.exe 39 PID 2844 wrote to memory of 2732 2844 cmd.exe 39 PID 2844 wrote to memory of 2732 2844 cmd.exe 39 PID 2844 wrote to memory of 2732 2844 cmd.exe 39 PID 2844 wrote to memory of 3048 2844 cmd.exe 40 PID 2844 wrote to memory of 3048 2844 cmd.exe 40 PID 2844 wrote to memory of 3048 2844 cmd.exe 40 PID 2844 wrote to memory of 3048 2844 cmd.exe 40 PID 3048 wrote to memory of 1572 3048 cmd.exe 41 PID 3048 wrote to memory of 1572 3048 cmd.exe 41 PID 3048 wrote to memory of 1572 3048 cmd.exe 41 PID 3048 wrote to memory of 1572 3048 cmd.exe 41 PID 3048 wrote to memory of 2368 3048 cmd.exe 42 PID 3048 wrote to memory of 2368 3048 cmd.exe 42 PID 3048 wrote to memory of 2368 3048 cmd.exe 42 PID 3048 wrote to memory of 2368 3048 cmd.exe 42 PID 2844 wrote to memory of 1864 2844 cmd.exe 43 PID 2844 wrote to memory of 1864 2844 cmd.exe 43 PID 2844 wrote to memory of 1864 2844 cmd.exe 43 PID 2844 wrote to memory of 1864 2844 cmd.exe 43 PID 2844 wrote to memory of 2748 2844 cmd.exe 44 PID 2844 wrote to memory of 2748 2844 cmd.exe 44 PID 2844 wrote to memory of 2748 2844 cmd.exe 44 PID 2844 wrote to memory of 2748 2844 cmd.exe 44 PID 2748 wrote to memory of 2896 2748 cmd.exe 45 PID 2748 wrote to memory of 2896 2748 cmd.exe 45 PID 2748 wrote to memory of 2896 2748 cmd.exe 45 PID 2748 wrote to memory of 2896 2748 cmd.exe 45 PID 2748 wrote to memory of 2884 2748 cmd.exe 46 PID 2748 wrote to memory of 2884 2748 cmd.exe 46 PID 2748 wrote to memory of 2884 2748 cmd.exe 46 PID 2748 wrote to memory of 2884 2748 cmd.exe 46 PID 2844 wrote to memory of 1988 2844 cmd.exe 47 PID 2844 wrote to memory of 1988 2844 cmd.exe 47 PID 2844 wrote to memory of 1988 2844 cmd.exe 47 PID 2844 wrote to memory of 1988 2844 cmd.exe 47 PID 2844 wrote to memory of 2648 2844 cmd.exe 48 PID 2844 wrote to memory of 2648 2844 cmd.exe 48 PID 2844 wrote to memory of 2648 2844 cmd.exe 48 PID 2844 wrote to memory of 2648 2844 cmd.exe 48 PID 2648 wrote to memory of 2740 2648 cmd.exe 49 PID 2648 wrote to memory of 2740 2648 cmd.exe 49 PID 2648 wrote to memory of 2740 2648 cmd.exe 49 PID 2648 wrote to memory of 2740 2648 cmd.exe 49 PID 2648 wrote to memory of 1720 2648 cmd.exe 50 PID 2648 wrote to memory of 1720 2648 cmd.exe 50 PID 2648 wrote to memory of 1720 2648 cmd.exe 50 PID 2648 wrote to memory of 1720 2648 cmd.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"C:\Users\Admin\AppData\Local\Temp\8e7bdf6f8b347cad8593178316b332824ca8d370e283aa46d88f79182baaa501.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\~E31E.bat" -game cstrike -noipx -nojoy -noforcemparms -noforcemaccel"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\tasklist.exetasklist /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR /I /C:"CS16Launcher.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\tasklist.exetasklist /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR /I /C:"CS16Launcher.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2368
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1864
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\tasklist.exetasklist /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR /I /C:"CS16Launcher.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2884
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fo csv |FINDSTR /I /C:"CS16Launcher.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\tasklist.exetasklist /fo csv4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR /I /C:"CS16Launcher.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1720
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 33⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2628
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1612
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1036
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\CS16Launcher.exe"CS16Launcher.exe" -game cstrike3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\hl.exe"CS16Launcher.exe" -game cstrike4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:908
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5002569d719a892cefdee47b40fb9de9d
SHA1c87baaf1db6f143eafceafb0e10be366a729cff7
SHA256a8b816e969bbb052ac822e0dcd4ef7021dd0e14bde5a17e58f9756cfd4209746
SHA51200f19ef8b9ef56a889f31896bfba7171bb43e48a2fc2d514a38952c6d1ce122b53a516b2425cd2ff2313f2aec834bf5a438450cb12248719200bfce89e128321
-
Filesize
322KB
MD594d9e620da6bd5fe5a4d20aebb15ec6d
SHA13c63d12fd2fda36048461c3a74ef228bb58da61a
SHA25688f7c7fe458ec238599dc57063a69b6417902f1e3591c6239af7c400954f764e
SHA512d1fe188954b45d2db40dcb06b44fb60dfe09fd0e0118ddebb27cb294202c2f59b49009e99d28e200078b22061d48d5b3de6251f255426087337c9fc462a74af7
-
Filesize
356B
MD549b89267ce7c9daee488b41c7ecbae66
SHA18686b5c577bd192e68a5a7bcb5b08c8395d27812
SHA2565b1b2dd68c2ff1fc6cda3f415cfa7087884ca075c371574aa19c1e4474c4d540
SHA5129790a5b972e94f1809f56c73c27d622a3829a182c7710cbbc4c5f9039337d2f498cdadbfe1930b2b20ce450234638e30eef5873a6e10411555c3ce4181a60d47
-
Filesize
1.8MB
MD5a0bc2e53bb55121719af9386ac2ff588
SHA11642aa1bfd63585fb324b8d23806efead856a3c9
SHA2567802a1fcc2ab1749399e455faae907c0df3194386160dc4fa0164c427662fdc2
SHA512e3a2b2ed965d15833ded927c6566a5facf11d1d654b65f2bbce70405013f2fe13009fe61b5488821f0846fd6cf0a5c5f2fd15a1a93c61c97540c917bd5040c92
-
Filesize
69KB
MD53531565d73be13ffdeabc638d0d32ece
SHA159e17ec1365012e143b559a5e33ea1792f5264e0
SHA256ad16e56157ceae1169edb1bfa6c902ce85d3f5e23815403d27ccff32efb1a4f2
SHA5125dc99ef4a12f0feb05f78b911fed456cb81470caf011ecdc5b75485b29e3b4025ff9ae6a51870a9752cbd66f13971b06dd74e6c803ede7c5a4dc0371a2d18235
-
Filesize
343KB
MD5f520185e02e8a5d85860669176bc4adc
SHA1cea8e9ff14994c89ad86cf891c89fea42a39250a
SHA256fe62f1eb6ba407df77619d16927abbefad3c726014f6bd1f8c37a7c3d6b781cc
SHA512b434e77a17cdac0109b698d0fccdd25dcdb15090a9fd0427504cc7f616673fa6c7307f07fb22cc2fc1e915887c0f9dc025aa8d38f51503f91df6a9ccee5ebe58
-
Filesize
257B
MD579e8cbef4f9bcae4515d77059f2a5cd4
SHA129f708d3dd29e1a47837b75c4bd40d95661d563e
SHA256127c6947762873f0056b613de689c6788d64d311cb8d6c48076ca0c9986c173d
SHA512849d7dcea9a2f3adc7204903530c9cc5d254b9e32135dfb0afa070a845f51daccb45f1ff6d145b942e918c51caa1b091ee331b0f2f10fb26fc6b9b888032551b
-
Filesize
68KB
MD56baefb250616105b06438d6742d1ebde
SHA1bd5b8f0113ab76dd8e35d6c446ab0286450f5666
SHA25602fe1504d1ff75a0ed34e4cd8000639711d0481b9ad888dc96ccf8eadddc4753
SHA5124389235cd5077f5fa9774f5ef2b4a2122de357c897b30658ad3c581e8d8991cf987159849392fd6776a80bc57ab563eda5b0c1e6e167e4a61954e117ac963a45
-
Filesize
344KB
MD5d44ee82601ae62ede3e224269a0bbf53
SHA12d00b1d5e052584c6c86ec08795d56d2181a91ee
SHA2560d4472d21443de839080860a300cca6b9436508f329d33d712e5c9bc07d4d998
SHA51200dba1a1d88bbc8f77f86ac45068d3f071805a13bf30c7f5c3f3168d3b799e773a1a3a7decab7931a9104bfe91dc8d60cc54b9e82a12e01b29dfe13c4fd1d398
-
Filesize
1KB
MD506f5083aa187ad4018d322e79d725e05
SHA12473e9179f8e68a2a68ccfab0b97eb3335fec55d
SHA256de86746cb9010b0ee4251499d1427d0f59364e7843b2164521b3bf10a9698a23
SHA512406c80a3ba9a6c9ba427f595f3ae9f2253107665c04832431324be035eb58b00e521825a1a964b8a6de94d9297ba18c7e1b7cbf443713058c4561f7ff936264c
-
Filesize
116KB
MD5d9c4a776f838733c64331db0c87af459
SHA1480aedeccdf5845de06c7bf39f59783a8fe92b1a
SHA2564f7dca9537cdf20b65da599ffc33ea69e8a132239cfb6a3d0b1b623359dcda85
SHA5125996c9a5cc5bc459b4dcdd7961690cbefdb741dd19338bfb4d1a864ce265e623f4e204dc6f1d4b0b84e66d0ae2f56b4f9bdb3cd7355f8a450703d0a2614d8d82
-
Filesize
84KB
MD52098ccf443433129b556c2849fe99e26
SHA1074ddbaff48c88b3b5c8f881c35d2be2bb19a249
SHA2564a899986a879ffd4b7e2d819c49b47cb362d849e86917da1f1931ef476b414af
SHA512fb4dcfd5371c89af775367d9f2ba72bfd42f8b483ba31b0e839b66f065e5e7a1ec34bf4504aaad17e38502be6917f0b3e415add81dc84fc6942996c0a8f95a10
-
Filesize
40KB
MD5e1cd35bbc28f73b7481e8835ee0f0b13
SHA1ef40d489c61b178b54f8116548662ee876e0133f
SHA2566ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf
SHA512baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3