Analysis
-
max time kernel
188s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe
Resource
win7-20221111-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe
-
Size
1.3MB
-
MD5
55247e810afac66a7de437793bede516
-
SHA1
41261fddbd211b9032a17b83f0a5130f2a2a3050
-
SHA256
853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f
-
SHA512
a2e4a9c2e864231fa40b0d08df6ed47683036f295df5b5f0de95b2611a77e975398938b5c8fe7b53400b8122e50c5093af5b9051b60e44a610f531bf12a36585
-
SSDEEP
24576:Ntb20pkaCqT5TBWgNQ7a2Ikh9mR87qoz16A:+Vg5tQ7a2Ik7moR5
Score
10/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2612 Tempjavacontroller.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winx64proc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe" 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrx64p = "C:\\Users\\Admin\\AppData\\Roaming\\Java Map\\winx64proc.exe" vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrx64p = "\\Java Map\\winx64proc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 228 set thread context of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 944 vbc.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 944 vbc.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 944 vbc.exe 4620 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 944 vbc.exe Token: SeDebugPrivilege 944 vbc.exe Token: SeDebugPrivilege 4620 Taskmgr.exe Token: SeSystemProfilePrivilege 4620 Taskmgr.exe Token: SeCreateGlobalPrivilege 4620 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe 4620 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 944 vbc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2612 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 83 PID 2788 wrote to memory of 2612 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 83 PID 2788 wrote to memory of 2612 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 83 PID 2788 wrote to memory of 228 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 85 PID 2788 wrote to memory of 228 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 85 PID 2788 wrote to memory of 228 2788 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 85 PID 228 wrote to memory of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 PID 228 wrote to memory of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 PID 228 wrote to memory of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 PID 228 wrote to memory of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 PID 228 wrote to memory of 944 228 853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe 86 PID 944 wrote to memory of 4620 944 vbc.exe 89 PID 944 wrote to memory of 4620 944 vbc.exe 89 PID 944 wrote to memory of 4620 944 vbc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe"C:\Users\Admin\AppData\Local\Temp\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Tempjavacontroller.exe"C:\Users\Admin\AppData\Local\Tempjavacontroller.exe"2⤵
- Executes dropped EXE
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exeC:\Users\Admin\AppData\Local\Temp\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\b" "C:\Users\Admin\AppData\Local\Temp\853b532081ea4cb76aa086634bd5d07ca095bebbad7258fb5fb9ef6fb9a2746f.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4620
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5bfd6856090dde147316faa457b740dda
SHA1bce44b153e3412703d8f9157740a7ef500dcb0ca
SHA2568d7a4b756a7651913c5cd614a5b722d7db80f3ff082222ee80a19837e42588cd
SHA512c549b5285e66d90aa35e7fad0c8072a2ff1c2320c4a3b3167808fd95aa6e86d6c8799cf8bd85b3059926b731e249f8181e1788f0a35540b6f5aa8764b9b4f056
-
Filesize
12KB
MD52ca76a6543e1e644d5eec2a8620149d2
SHA142a03dfd435742c27da9997f71df44f7ab7d3c8d
SHA2564ed7f61d00ca189aa15394ddbbee18afb8196509b23ce736646dbca8a84d9f37
SHA512247d42a210e6c1d5185e96e94942871a76df598f8faf07ee59bd7c40349210a07fe492865d9dbefd27965828d2deed50af0dd6a17e30c93196a43dccc3a01761
-
Filesize
272KB
MD5ac789c4f220f9c698c12e46c003d4d1a
SHA1fd15c2413d0da384a9dad009068d6732c6a94215
SHA2560c12b95b8d635c5e0c3ce9294a6a9de14d00f8f13b1ef86cf08d83b09e50d6ae
SHA5125df3f57407a3f5a836f105eb22f9ef668a811dd74e706bc494c47915a97e19e96073ca5447898f9d7a0bd3aef13665ff0a39df5a1149ce464b6d187d1797843b
-
Filesize
56KB
MD55ff6df9ebd3e8a21b5fd48be336846ee
SHA15bfdb145ea63874a70c8a3a2ba39e8dd826114bb
SHA256af76777bbc3d2ea3e0e02c6dbe717e4d5d5458ecd1bb0baa2ce9367771d3fcab
SHA512431c527e5426bd985eec15d385fbf195901e0e98815d35563c732d97497e19bf3d3d06e82be3509a9961be60a53d5d4ab227259ea839c6cb253e7449883492e9
-
Filesize
56KB
MD55ff6df9ebd3e8a21b5fd48be336846ee
SHA15bfdb145ea63874a70c8a3a2ba39e8dd826114bb
SHA256af76777bbc3d2ea3e0e02c6dbe717e4d5d5458ecd1bb0baa2ce9367771d3fcab
SHA512431c527e5426bd985eec15d385fbf195901e0e98815d35563c732d97497e19bf3d3d06e82be3509a9961be60a53d5d4ab227259ea839c6cb253e7449883492e9