Overview
overview
8Static
static
807-30 B �... B.exe
windows7-x64
807-30 B �... B.exe
windows10-2004-x64
807-30 B �...ne.exe
windows7-x64
807-30 B �...ne.exe
windows10-2004-x64
807-30 B �...��.bat
windows7-x64
807-30 B �...��.bat
windows10-2004-x64
8@创e下�...��.url
windows7-x64
1@创e下�...��.url
windows10-2004-x64
1安卓手�...��.url
windows7-x64
1安卓手�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
246s -
max time network
341s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 01:42
Behavioral task
behavioral1
Sample
07-30 B 周年稳定版)/DNF飞机 07-30 B.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
07-30 B 周年稳定版)/DNF飞机 07-30 B.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
07-30 B 周年稳定版)/Theplane.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
07-30 B 周年稳定版)/Theplane.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral5
Sample
07-30 B 周年稳定版)/打不开飞机-点击我启动飞机.bat
Resource
win7-20221111-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
07-30 B 周年稳定版)/打不开飞机-点击我启动飞机.bat
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
@创e下载┆9年绿色无弹窗安全.url
Resource
win7-20221111-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
@创e下载┆9年绿色无弹窗安全.url
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
安卓手机版本下载.url
Resource
win7-20221111-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
安卓手机版本下载.url
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
07-30 B 周年稳定版)/打不开飞机-点击我启动飞机.bat
-
Size
6KB
-
MD5
f29563cfcfec1de3fe022b6dcf417abe
-
SHA1
a1ccda74ca6a010aedf20b827031ec433c2a0af3
-
SHA256
6c3fcc35e321e5accb37bb9bf52cc02eaf99dea6658c1f27efd77091fff60eff
-
SHA512
c86b468a15922a9a99e8a534b18dc474b702de98309750f351016115753d48bb8588b1f9810436d4f3b9fdcbbe68e2c32b08189924511fcf25599ed0ff6a934e
-
SSDEEP
24:9QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQj:XePJ1O32B8PNn
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1692 Theplane.exe 1540 Theplane.exe -
resource yara_rule behavioral5/memory/1540-63-0x00000000021B0000-0x0000000002222000-memory.dmp upx behavioral5/memory/1540-64-0x00000000021B0000-0x0000000002222000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 4 IoCs
pid Process 268 taskkill.exe 1076 taskkill.exe 396 taskkill.exe 1360 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb800000000020000000000106600000001000020000000ef2ac75d3e9f08f286fe487638d2e6f4dca4c11a64551329f371c854b57e794e000000000e80000000020000200000002e2fff8d04a02183b77cb0d1942ea79df750aa7ead928406e54f33ed71afa60420000000edd9a0acdfbcc8e7ef5fd87f1bb12b8019e639afa140a65077fa3b4d9b23cf6b40000000872b56c8bf06f075f7a0e270e25ace1ab09f1ff4b062704e8aa57e6383ccb5d0043241e35c6ea3959205dee01f0a403055adbd3aa4c1977610b1c17242a8eec9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main Theplane.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0072a79a402d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003bad9e5810411a41b405bdc87c3b0eb8000000000200000000001066000000010000200000005c8d229fb5f8bcae99b1a141c4ef778615c303e4999f07348828faabb10ccdf8000000000e8000000002000020000000c67089ee61308f5bd395988f550bf726c5c23c559843bb94c591ea49e61af0ea90000000caf6b97faf043c3196ba0db8c3e498a092c972df3048afa90683f5a41aa59fc4454eb0c4a8dfd0e8d58a2343d9e5e7709891b0ac241ad57a1f2e0520cfdbb0adff06dae4112b967af045b1739306c8d93b7a4f097cef5ecfcc97576cb4286f1796b2c1671baa18a9234ad7cf144edc5808639531efaeadd830d245a13c129e388d11ad581f38014bf0539bb18a5c768e40000000fca99d1b6b2b74f30f8a6c0b402bd456ac50a76d8d8e36fc08bc220bdc0456f8be2f1e629aeb5d1b25579a4b7f6da7603b9ff04e5d74d3d68fab45c905cfc396 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0FF14B1-6E97-11ED-AC54-767CA9D977BF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376348281" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 1692 Theplane.exe 1540 Theplane.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 268 taskkill.exe Token: SeDebugPrivilege 1076 taskkill.exe Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 1360 taskkill.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe Token: 33 1540 Theplane.exe Token: SeIncBasePriorityPrivilege 1540 Theplane.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1604 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1540 Theplane.exe 1604 iexplore.exe 1604 iexplore.exe 188 IEXPLORE.EXE 188 IEXPLORE.EXE 188 IEXPLORE.EXE 188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 756 wrote to memory of 268 756 cmd.exe 29 PID 756 wrote to memory of 268 756 cmd.exe 29 PID 756 wrote to memory of 268 756 cmd.exe 29 PID 756 wrote to memory of 1692 756 cmd.exe 31 PID 756 wrote to memory of 1692 756 cmd.exe 31 PID 756 wrote to memory of 1692 756 cmd.exe 31 PID 756 wrote to memory of 1692 756 cmd.exe 31 PID 756 wrote to memory of 1076 756 cmd.exe 32 PID 756 wrote to memory of 1076 756 cmd.exe 32 PID 756 wrote to memory of 1076 756 cmd.exe 32 PID 756 wrote to memory of 396 756 cmd.exe 33 PID 756 wrote to memory of 396 756 cmd.exe 33 PID 756 wrote to memory of 396 756 cmd.exe 33 PID 756 wrote to memory of 1360 756 cmd.exe 34 PID 756 wrote to memory of 1360 756 cmd.exe 34 PID 756 wrote to memory of 1360 756 cmd.exe 34 PID 756 wrote to memory of 1540 756 cmd.exe 35 PID 756 wrote to memory of 1540 756 cmd.exe 35 PID 756 wrote to memory of 1540 756 cmd.exe 35 PID 756 wrote to memory of 1540 756 cmd.exe 35 PID 1540 wrote to memory of 1604 1540 Theplane.exe 38 PID 1540 wrote to memory of 1604 1540 Theplane.exe 38 PID 1540 wrote to memory of 1604 1540 Theplane.exe 38 PID 1540 wrote to memory of 1604 1540 Theplane.exe 38 PID 1604 wrote to memory of 188 1604 iexplore.exe 39 PID 1604 wrote to memory of 188 1604 iexplore.exe 39 PID 1604 wrote to memory of 188 1604 iexplore.exe 39 PID 1604 wrote to memory of 188 1604 iexplore.exe 39
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\打不开飞机-点击我启动飞机.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\taskkill.exetaskkill /f /t /im Theplane.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exeTheplane.exe2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1692
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im Theplane.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im Theplane.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\system32\taskkill.exetaskkill /f /t /im conime.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\07-30 B 周年稳定版)\Theplane.exeTheplane.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.dnffeiji.com/dc.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:188
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5684c2b8d23e0d6260dc779537f427d66
SHA1eda84f364f01454b2da83bf0ae7dda6947fbfb7d
SHA2562e343b10a16e70ce73258a39ba382b7ca4405b745cf339b74fc4bf6bb4e019d8
SHA512e37bc0dc03d14f418dc46ad273fd9d97af08b4d2b4129e848a2693af42d84e8d879cacdf6d498155af328b2f92a0785c990eed82abe929b45b23f30133cc1cc8
-
Filesize
2.3MB
MD5684c2b8d23e0d6260dc779537f427d66
SHA1eda84f364f01454b2da83bf0ae7dda6947fbfb7d
SHA2562e343b10a16e70ce73258a39ba382b7ca4405b745cf339b74fc4bf6bb4e019d8
SHA512e37bc0dc03d14f418dc46ad273fd9d97af08b4d2b4129e848a2693af42d84e8d879cacdf6d498155af328b2f92a0785c990eed82abe929b45b23f30133cc1cc8
-
Filesize
608B
MD567009a9d23cc80d72a64808ac078a31e
SHA1fd8886ca83e7d1a43deec82bc40af54f25d22827
SHA256ee8684777da88ac56b5cba8cb00a6807f5f28003688d568edaee2548a3d86d58
SHA5126819887e66395d8ce2d960a1672ba3fccacc4c011a36cc213a503da5597c963e6d4d6705533351830b2fd4bb9c91b6039d6bf1f275b3340b469fa29f79ed78d0