Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
72s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe
Resource
win10v2004-20220812-en
General
-
Target
d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe
-
Size
168KB
-
MD5
6f712a49b0fc5e071c1888f663409a8e
-
SHA1
252a49be406cdab0b0c5fac2a2fddba2b2466ec3
-
SHA256
d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac
-
SHA512
f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c
-
SSDEEP
3072:ARqEC2Oi8NXC797F8TBfFvj4bq57441/ynWn1b1oHkay/0A:AHC2F8NXC796TB9vj484KyW/oRy/l
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winrar.exe -
Executes dropped EXE 1 IoCs
pid Process 1532 winrar.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 556 netsh.exe 468 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ce5c21bd74c042cdcd945e699c951c5.exe winrar.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ce5c21bd74c042cdcd945e699c951c5.exe winrar.exe -
Loads dropped DLL 2 IoCs
pid Process 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ce5c21bd74c042cdcd945e699c951c5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winrar.exe\" .." winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1ce5c21bd74c042cdcd945e699c951c5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winrar.exe\" .." winrar.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA winrar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winrar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\Assembly = "qcogjiwpbry, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/winrar.exe" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0 winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\ = "qcogjiwpbry.yhupkosdwm" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32 winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\ThreadingModel = "Both" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\Assembly = "qcogjiwpbry, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm\CLSID winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/winrar.exe" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq\CLSID winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32 winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\Class = "qcogjiwpbry.hskzyvwuvq" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0 winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\Implemented Categories winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\ = "qcogjiwpbry.hskzyvwuvq" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\RuntimeVersion = "v2.0.50727" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/winrar.exe" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\ProgId winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16} winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm\ = "qcogjiwpbry.yhupkosdwm" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\Class = "qcogjiwpbry.yhupkosdwm" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\ProgId\ = "qcogjiwpbry.yhupkosdwm" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0 winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\ThreadingModel = "Both" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\ProgId\ = "qcogjiwpbry.hskzyvwuvq" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\Implemented Categories winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303} winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\ProgId winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0\Class = "qcogjiwpbry.hskzyvwuvq" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq\CLSID winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\ProgId winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\Implemented Categories winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/winrar.exe" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16} winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\ = "mscoree.dll" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\RuntimeVersion = "v2.0.50727" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq\CLSID\ = "{0D1A6803-AC0B-30CA-A446-4408D0C44C16}" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\Implemented Categories winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\ProgId winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\0.0.0.0\Assembly = "qcogjiwpbry, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32 winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm\CLSID\ = "{14485989-58B8-3A41-8105-08172E9B8303}" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0\Class = "qcogjiwpbry.yhupkosdwm" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.yhupkosdwm\CLSID winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0\Assembly = "qcogjiwpbry, Version=0.0.0.0, Culture=neutral, PublicKeyToken=461d39c4a423da0b" winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32 winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\0 = ".NET Category" winrar.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303} winrar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{14485989-58B8-3A41-8105-08172E9B8303}\InprocServer32\0.0.0.0 winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\qcogjiwpbry.hskzyvwuvq\ = "qcogjiwpbry.hskzyvwuvq" winrar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0D1A6803-AC0B-30CA-A446-4408D0C44C16}\InprocServer32\ = "mscoree.dll" winrar.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1532 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe 27 PID 1640 wrote to memory of 1532 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe 27 PID 1640 wrote to memory of 1532 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe 27 PID 1640 wrote to memory of 1532 1640 d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe 27 PID 1532 wrote to memory of 556 1532 winrar.exe 28 PID 1532 wrote to memory of 556 1532 winrar.exe 28 PID 1532 wrote to memory of 556 1532 winrar.exe 28 PID 1532 wrote to memory of 556 1532 winrar.exe 28 PID 1532 wrote to memory of 468 1532 winrar.exe 30 PID 1532 wrote to memory of 468 1532 winrar.exe 30 PID 1532 wrote to memory of 468 1532 winrar.exe 30 PID 1532 wrote to memory of 468 1532 winrar.exe 30 PID 1532 wrote to memory of 844 1532 winrar.exe 32 PID 1532 wrote to memory of 844 1532 winrar.exe 32 PID 1532 wrote to memory of 844 1532 winrar.exe 32 PID 1532 wrote to memory of 844 1532 winrar.exe 32 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" winrar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe"C:\Users\Admin\AppData\Local\Temp\d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\winrar.exe"C:\Users\Admin\AppData\Local\Temp\winrar.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1532 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winrar.exe" "winrar.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:556
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:468
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\winrar.vbe"3⤵PID:844
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD56f712a49b0fc5e071c1888f663409a8e
SHA1252a49be406cdab0b0c5fac2a2fddba2b2466ec3
SHA256d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac
SHA512f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c
-
Filesize
168KB
MD56f712a49b0fc5e071c1888f663409a8e
SHA1252a49be406cdab0b0c5fac2a2fddba2b2466ec3
SHA256d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac
SHA512f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c
-
Filesize
54B
MD5952afda02bc1cd283a751deb49be3c31
SHA1d7c8f7db20e5b6936dbc7e14ed9110f809cf79f0
SHA2569a0ac6df92f923d3e8e272b0154ae572c70e4dba7a31042f6f37866780f61412
SHA5123460ff6ec848789aa16086c8c4d195ce623a5fa18ecfbdab127487ae155af9fd2a6b465f176ed68491281c1566da65662c5d02e1bebbfe66d20abfdde1ed0134
-
Filesize
168KB
MD56f712a49b0fc5e071c1888f663409a8e
SHA1252a49be406cdab0b0c5fac2a2fddba2b2466ec3
SHA256d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac
SHA512f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c
-
Filesize
168KB
MD56f712a49b0fc5e071c1888f663409a8e
SHA1252a49be406cdab0b0c5fac2a2fddba2b2466ec3
SHA256d9a09527ea29ed90ecc63ccd2f85ee6d4ceafe950c3535958611e28c7cd7d3ac
SHA512f98d2519e0419998614f790623e40adc80c6d0e1289eba342877374dab2b343f755450b852bbbd829bcda923fd97afff871e0799008b94c941d4e1a09ccd1d7c