Overview
overview
10Static
static
3BSOD/BSOD/...OD.exe
windows7-x64
1BSOD/BSOD/...OD.exe
windows10-2004-x64
BSOD/BSOD/...OD.exe
windows10-ltsc 2021-x64
1BSOD/BSOD/...OD.exe
windows11-21h2-x64
1RANSOMWARE....0.exe
windows7-x64
10RANSOMWARE....0.exe
windows10-2004-x64
10RANSOMWARE....0.exe
windows10-ltsc 2021-x64
10RANSOMWARE....0.exe
windows11-21h2-x64
10Analysis
-
max time kernel
1799s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BSOD/BSOD/bin/Debug/BSOD.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral2
Sample
BSOD/BSOD/bin/Debug/BSOD.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral3
Sample
BSOD/BSOD/bin/Debug/BSOD.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
BSOD/BSOD/bin/Debug/BSOD.exe
Resource
win11-20241007-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
RANSOMWARE3.0/RANSOMWARE3.0/obj/Debug/RANSOMWARE3.0.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
1800 seconds
Behavioral task
behavioral6
Sample
RANSOMWARE3.0/RANSOMWARE3.0/obj/Debug/RANSOMWARE3.0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
1800 seconds
Behavioral task
behavioral7
Sample
RANSOMWARE3.0/RANSOMWARE3.0/obj/Debug/RANSOMWARE3.0.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
15 signatures
1800 seconds
Behavioral task
behavioral8
Sample
RANSOMWARE3.0/RANSOMWARE3.0/obj/Debug/RANSOMWARE3.0.exe
Resource
win11-20241007-en
windows11-21h2-x64
15 signatures
1800 seconds
General
-
Target
RANSOMWARE3.0/RANSOMWARE3.0/obj/Debug/RANSOMWARE3.0.exe
-
Size
206KB
-
MD5
d82aef6e33a9bb4bbbec1e38547b1a47
-
SHA1
bb74e90eab11ecc0a2e3702882489a2523949315
-
SHA256
9cff1ba17b83e537751fe1cd414690c3aa9627f06899afd906efaa114575d42d
-
SHA512
88e61e2a6ce3fe80f4ce77493254fcd56476ffc1e6a36a7f4f063757c6fd2cd1332f2a1d71222cbae244b294dcc5b56b8a83e53e15138a4ef1c3fbd56690f804
-
SSDEEP
3072:qRkbWhQAqY5+I00000000000000cGh4u3J+QGAqYVZmXMZhGq4ziqY:qSbsqgP4QbqS1ZhGq4Gq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "BSOD.exe" RANSOMWARE3.0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\BSOD.exe" RANSOMWARE3.0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RANSOMWARE3.0.exe -
Renames multiple (302) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" RANSOMWARE3.0.exe -
Disables Task Manager via registry modification
-
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll RANSOMWARE3.0.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.exe RANSOMWARE3.0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BSOD.exe RANSOMWARE3.0.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RANSOMWARE3.0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RANSOMWARE3.0.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Users\Admin\Videos\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Program Files\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Program Files (x86)\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Users\Admin\Documents\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Users\Admin\Music\desktop.ini RANSOMWARE3.0.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\C_10008.NLS.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\mfc120rus.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\mscories.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\raserver.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\cliconfg.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\simpdata.tlb.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\xwizard.dtd RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\tcmsetup.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\wmpps.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\C_1257.NLS RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\KBDBHC.DLL RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\onexui.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\perfhost.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\sbe.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\TimeDateMUICallback.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\xwizard.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\irprops.cpl.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\security.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\setupugc.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\subst.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\mfc120cht.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\msexcl40.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\ntlanman.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\ole2disp.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\wfapigp.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\iTVData.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\shlwapi.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\unregmp2.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\untfs.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\WMNetMgr.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\Display.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\KBDDV.DLL.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\MRINFO.EXE.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\taskschd.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\dispex.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\mssprxy.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\NativeHooks.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\NlsLexicons0049.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\gpedit.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\icardie.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\isoburn.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\license.rtf RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\newdev.exe RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\help.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\sud.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\WcnEapPeerProxy.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\txfw32.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\wshqos.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\auditpolmsg.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\csrr.rs.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\photowiz.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\QUTIL.DLL RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\radarrs.dll RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\mmcshext.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\NlsData0416.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\wimgapi.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\netcfgx.dll.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\SysWOW64\NlsLexicons0022.dll RANSOMWARE3.0.exe File created C:\Windows\SysWOW64\svchost.exe.CLUTTER RANSOMWARE3.0.exe -
Drops file in Program Files directory 40 IoCs
description ioc Process File opened for modification C:\Program Files\LockPing.vsdm RANSOMWARE3.0.exe File created C:\Program Files\OutSelect.xml.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\FindStop.mpg RANSOMWARE3.0.exe File created C:\Program Files\LockPing.vsdm.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Program Files\GetGrant.ini RANSOMWARE3.0.exe File created C:\Program Files\GetSearch.dot.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\OutSelect.xml RANSOMWARE3.0.exe File created C:\Program Files\PushMount.easmx.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\ReceiveApprove.otf RANSOMWARE3.0.exe File opened for modification C:\Program Files\SearchComplete.asf RANSOMWARE3.0.exe File opened for modification C:\Program Files\AssertNew.mht RANSOMWARE3.0.exe File created C:\Program Files\BlockWrite.mpg.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\StopComplete.mpeg2 RANSOMWARE3.0.exe File created C:\Program Files\FindStop.mpg.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\StopComplete.mpeg2.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\DisableInstall.xml RANSOMWARE3.0.exe File created C:\Program Files\DismountApprove.docx.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\PushMount.easmx RANSOMWARE3.0.exe File opened for modification C:\Program Files\RevokeImport.jpeg RANSOMWARE3.0.exe File created C:\Program Files\BlockUndo.M2T.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\BlockUndo.M2T RANSOMWARE3.0.exe File opened for modification C:\Program Files\SwitchInitialize.aif RANSOMWARE3.0.exe File created C:\Program Files\UnblockSplit.vsdx.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\UnblockSplit.vsdx RANSOMWARE3.0.exe File created C:\Program Files\DisableInstall.xml.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\ReceiveApprove.otf.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\GetSearch.dot RANSOMWARE3.0.exe File created C:\Program Files\RevokeImport.jpeg.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\SwitchInitialize.aif.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\UseInstall.vdw.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\AssertNew.mht.CLUTTER RANSOMWARE3.0.exe File created C:\Program Files\GetGrant.ini.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\DismountApprove.docx RANSOMWARE3.0.exe File created C:\Program Files\SearchComplete.asf.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files\UseInstall.vdw RANSOMWARE3.0.exe File created C:\Program Files (x86)\desktop.ini.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Program Files (x86)\desktop.ini RANSOMWARE3.0.exe File opened for modification C:\Program Files\BlockWrite.mpg RANSOMWARE3.0.exe File created C:\Program Files\desktop.ini.CLUTTER RANSOMWARE3.0.exe -
Drops file in Windows directory 58 IoCs
description ioc Process File opened for modification C:\Windows\Starter.xml RANSOMWARE3.0.exe File opened for modification C:\Windows\bootstat.dat RANSOMWARE3.0.exe File opened for modification C:\Windows\PFRO.log RANSOMWARE3.0.exe File opened for modification C:\Windows\splwow64.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\twain.dll RANSOMWARE3.0.exe File created C:\Windows\Ultimate.xml.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\WMSysPr9.prx RANSOMWARE3.0.exe File opened for modification C:\Windows\DtcInstall.log RANSOMWARE3.0.exe File opened for modification C:\Windows\notepad.exe RANSOMWARE3.0.exe File created C:\Windows\WindowsShell.Manifest.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\twunk_16.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\twunk_32.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\bfsvc.exe RANSOMWARE3.0.exe File created C:\Windows\mib.bin.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\TSSysprep.log.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\win.ini.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\WindowsUpdate.log.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\explorer.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\setupact.log RANSOMWARE3.0.exe File opened for modification C:\Windows\Ultimate.xml RANSOMWARE3.0.exe File created C:\Windows\PFRO.log.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\twain.dll.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\winhlp32.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\win.ini RANSOMWARE3.0.exe File opened for modification C:\Windows\fveupdate.exe RANSOMWARE3.0.exe File created C:\Windows\HelpPane.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\notepad.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\DtcInstall.log.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\setuperr.log.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\WindowsUpdate.log RANSOMWARE3.0.exe File created C:\Windows\fveupdate.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\HelpPane.exe RANSOMWARE3.0.exe File created C:\Windows\msdfmap.ini.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\twain_32.dll RANSOMWARE3.0.exe File created C:\Windows\twunk_16.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\winhlp32.exe RANSOMWARE3.0.exe File created C:\Windows\explorer.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\mib.bin RANSOMWARE3.0.exe File opened for modification C:\Windows\system.ini RANSOMWARE3.0.exe File opened for modification C:\Windows\BSOD.exe RANSOMWARE3.0.exe File created C:\Windows\bfsvc.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\hh.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\write.exe RANSOMWARE3.0.exe File created C:\Windows\setupact.log.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\twunk_32.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\write.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\bootstat.dat.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\regedit.exe.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\splwow64.exe.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\msdfmap.ini RANSOMWARE3.0.exe File opened for modification C:\Windows\TSSysprep.log RANSOMWARE3.0.exe File opened for modification C:\Windows\WindowsShell.Manifest RANSOMWARE3.0.exe File created C:\Windows\Starter.xml.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\system.ini.CLUTTER RANSOMWARE3.0.exe File created C:\Windows\WMSysPr9.prx.CLUTTER RANSOMWARE3.0.exe File opened for modification C:\Windows\hh.exe RANSOMWARE3.0.exe File opened for modification C:\Windows\setuperr.log RANSOMWARE3.0.exe File created C:\Windows\twain_32.dll.CLUTTER RANSOMWARE3.0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RANSOMWARE3.0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2648 RANSOMWARE3.0.exe -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RANSOMWARE3.0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1" RANSOMWARE3.0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RANSOMWARE3.0\RANSOMWARE3.0\obj\Debug\RANSOMWARE3.0.exe"C:\Users\Admin\AppData\Local\Temp\RANSOMWARE3.0\RANSOMWARE3.0\obj\Debug\RANSOMWARE3.0.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Manipulates Digital Signatures
- Drops startup file
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2648
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54ec85cec090259e2ad98bc922a70cc5c
SHA17fbc4d3a11395f373d6bb40ad7f8bdf9088853e4
SHA256dc0e9cae1e53b8f74c9bda8fc5c76c9f8a925e29275bbca0b4e35204af6c3fa3
SHA512df72554135d7dd06e60b8bb4b98617b16693127b91889a188cedc80a3e85ac3fb578ed9261bd54de465387f0cc755916dc5eb15b24e0350c91f188bc4b703cfb
-
Filesize
11KB
MD5a64bf6219271dc73115f7fc51d2b4333
SHA161b0d665f61876bc2b0629833d64d18928c55d2d
SHA2561dcb242a128330bd9cf72ae38629b50ce8f9fb539fb759e6c83f682a3d585cd9
SHA5128277322c17a2de52f46a7979a3a5a0ad010742de42bae80b5ac2e67251d08ad4b2ffe8672979ffaa909550301ce752b2ca96a8106192995ae19ea640d4386932