Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe
-
Size
284KB
-
MD5
aa44e88f5d3d20b533d592de97c6ee36
-
SHA1
4c6fd6d3e59b280c7c021b0347c175d21fb272be
-
SHA256
436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5
-
SHA512
c201ae0d2878514de160ada7a6cf1cd45d65bf3b6eb9724ea33cf67e61d6f7ad943a5163cb2747bc08ce4d9d3ffe0cd189d6a55578ca17536cdfcb6f4d4f5b11
-
SSDEEP
3072:7nyyn+YSmpR1TmoNkMl4ymdu+sSi5KKGTKozEDGaKUa6xUgyX6lgq1Kx5RK1fYxe:9+BmVmoNkMl4ymdu+sSi5KKGsjO
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ghpuev.exe -
Executes dropped EXE 1 IoCs
pid Process 4616 ghpuev.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe -
Adds Run key to start application 2 TTPs 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /Z" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /U" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /j" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /h" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /M" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /e" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /L" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /x" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /z" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /c" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /f" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /q" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /y" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /R" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /K" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /Q" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /Y" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /o" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /n" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /I" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /l" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /D" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /X" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /g" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /m" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /t" ghpuev.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /A" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /B" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /b" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /N" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /a" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /P" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /G" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /F" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /k" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /i" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /J" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /v" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /E" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /O" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /W" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /H" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /T" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /S" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /C" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /V" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /w" ghpuev.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghpuev = "C:\\Users\\Admin\\ghpuev.exe /s" ghpuev.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe 4616 ghpuev.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4008 436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe 4616 ghpuev.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4008 wrote to memory of 4616 4008 436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe 78 PID 4008 wrote to memory of 4616 4008 436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe 78 PID 4008 wrote to memory of 4616 4008 436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe 78 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77 PID 4616 wrote to memory of 4008 4616 ghpuev.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe"C:\Users\Admin\AppData\Local\Temp\436c306f623470d69d8c7922303a7b2bac134815121ab908b472399b02da2fc5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\ghpuev.exe"C:\Users\Admin\ghpuev.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD56ed8ad0523b8397bf95450acfdfe92b2
SHA1b9a4cd550ee0c2adbc52ab443bdec636fdc8164c
SHA256d0a1699445e44f0bf18ede44791d17748b0f8d1d7fc61b7c5a1bf2aef6f90054
SHA512b2b7fe450b4d79397aba1950cd80966a852fedff90a16d7fd059081e8df03e806bcfcaa8876ae3b94f3278647cbcd3875167eed4132d124c5dfa0546af4653d1
-
Filesize
284KB
MD56ed8ad0523b8397bf95450acfdfe92b2
SHA1b9a4cd550ee0c2adbc52ab443bdec636fdc8164c
SHA256d0a1699445e44f0bf18ede44791d17748b0f8d1d7fc61b7c5a1bf2aef6f90054
SHA512b2b7fe450b4d79397aba1950cd80966a852fedff90a16d7fd059081e8df03e806bcfcaa8876ae3b94f3278647cbcd3875167eed4132d124c5dfa0546af4653d1