Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 10:01
Behavioral task
behavioral1
Sample
f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
Resource
win10v2004-20220901-en
General
-
Target
f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe
-
Size
390KB
-
MD5
033edeec6f38f5783124a6ba7a4d2458
-
SHA1
b80175459763f17888c2750bf64e4bc618b161c7
-
SHA256
f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
-
SHA512
add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22
-
SSDEEP
6144:RI9ZZnC96fyE805tgxegdUD657DqjDIsQ8n0gsAqcnnOBCp6t6+J5WI8F4:R+C96hj5tg1o65NsQ8mAqcnOoQ6+AF4
Malware Config
Extracted
cybergate
v1.07.5
Hunter
Huntercyber.no-ip.org:100
R8404M34PKSOB4
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
System
-
install_file
javaw.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
Xboxlivemw2
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
resource yara_rule behavioral2/files/0x0001000000022e6e-150.dat modiloader_stage2 behavioral2/files/0x0001000000022e6e-152.dat modiloader_stage2 behavioral2/files/0x0001000000022e6e-156.dat modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\System\\javaw.exe" f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
Executes dropped EXE 2 IoCs
pid Process 3780 javaw.exe 5024 javaw.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W} f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0KV2236-F086-3OJ5-IQ38-6MRR5E3YV44W}\StubPath = "C:\\Windows\\system32\\System\\javaw.exe Restart" f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
resource yara_rule behavioral2/memory/4556-139-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4556-144-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/916-147-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/916-153-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/916-161-0x0000000010480000-0x00000000104E5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\System\\javaw.exe" f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\WinDbg\\windbg.exe\" " reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\System\\javaw.exe" f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\System\javaw.exe f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe File opened for modification C:\Windows\SysWOW64\System\javaw.exe f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4548 set thread context of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 3780 set thread context of 5024 3780 javaw.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 1936 5024 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 916 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 916 explorer.exe Token: SeRestorePrivilege 916 explorer.exe Token: SeDebugPrivilege 916 explorer.exe Token: SeDebugPrivilege 916 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1724 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 82 PID 4548 wrote to memory of 1724 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 82 PID 4548 wrote to memory of 1724 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 82 PID 4548 wrote to memory of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 4548 wrote to memory of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 4548 wrote to memory of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 4548 wrote to memory of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 4548 wrote to memory of 4556 4548 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 84 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30 PID 4556 wrote to memory of 652 4556 f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Debugger" /t reg_sz /d """"C:\Users\Admin\AppData\Roaming\WinDbg\windbg.exe"""3⤵
- Adds Run key to start application
PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"C:\Users\Admin\AppData\Local\Temp\f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:916 -
C:\Windows\SysWOW64\System\javaw.exe"C:\Windows\system32\System\javaw.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3780 -
C:\Windows\SysWOW64\System\javaw.exe"C:\Windows\SysWOW64\System\javaw.exe"6⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 5967⤵
- Program crash
PID:1936
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5024 -ip 50241⤵PID:2816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD508b1acf06b2540d855699c2efc46f2dd
SHA17d872f354870f4bb8a725ca7278fa3c50400413e
SHA2561de38c6609db5c8da1f60a0928540ffe760b7b7678a9f932d46332ff88ade9f8
SHA5129108c962a11d11f6146ac231ae9867a579c54fb3f8994acc0592f06f78c826829b278b9275f2af3b7bcdceb98c755f476b2ec9fad3fc715702a75eee9cd13387
-
Filesize
390KB
MD5033edeec6f38f5783124a6ba7a4d2458
SHA1b80175459763f17888c2750bf64e4bc618b161c7
SHA256f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22
-
Filesize
390KB
MD5033edeec6f38f5783124a6ba7a4d2458
SHA1b80175459763f17888c2750bf64e4bc618b161c7
SHA256f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22
-
Filesize
390KB
MD5033edeec6f38f5783124a6ba7a4d2458
SHA1b80175459763f17888c2750bf64e4bc618b161c7
SHA256f8eb291372d3523cdd65cdab4cdc0624f99e8a79a175f9b860f3ff3e7d2c3e9c
SHA512add1ce886dc59cd69e27ac22f7c9525b2e1c16418e06e2732d109c7b4741a7d3ab4cfa8f2d5ff8367decf3f3674120b3d169f12cb664d2b177c75e8db50d8d22