Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2023, 01:05
Static task
static1
General
-
Target
7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe
-
Size
940KB
-
MD5
5ecbb5b5488ac14dab93399b21c16db3
-
SHA1
a5e534c28a775553faa9ebddef9fcd56dd8dc0b8
-
SHA256
7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2
-
SHA512
9957bceea81cac651468d23010fa08ef4ca0fc2b41461567587408933b50b50f18629f5e0d6a6ae9379721c19bbd27ba417138405bd7c1c158444435ea0c34e9
-
SSDEEP
24576:OyuCmgtSfHUBbx4EajU+vIZMFk18McPUcP:ddmgqCbCE/qkKV
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" w32OK15.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" w32OK15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" w32OK15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" w32OK15.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" w32OK15.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation xeeqk45.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 2364 za503785.exe 4088 za510957.exe 2964 61280844.exe 4060 w32OK15.exe 4652 xeeqk45.exe 2580 oneetx.exe 1120 ys122856.exe 692 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3808 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 61280844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" w32OK15.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za503785.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za503785.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za510957.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za510957.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1400 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1204 4060 WerFault.exe 88 4648 1120 WerFault.exe 94 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4732 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2964 61280844.exe 2964 61280844.exe 4060 w32OK15.exe 4060 w32OK15.exe 1120 ys122856.exe 1120 ys122856.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2964 61280844.exe Token: SeDebugPrivilege 4060 w32OK15.exe Token: SeDebugPrivilege 1120 ys122856.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4652 xeeqk45.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 380 wrote to memory of 2364 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 82 PID 380 wrote to memory of 2364 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 82 PID 380 wrote to memory of 2364 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 82 PID 2364 wrote to memory of 4088 2364 za503785.exe 83 PID 2364 wrote to memory of 4088 2364 za503785.exe 83 PID 2364 wrote to memory of 4088 2364 za503785.exe 83 PID 4088 wrote to memory of 2964 4088 za510957.exe 84 PID 4088 wrote to memory of 2964 4088 za510957.exe 84 PID 4088 wrote to memory of 2964 4088 za510957.exe 84 PID 4088 wrote to memory of 4060 4088 za510957.exe 88 PID 4088 wrote to memory of 4060 4088 za510957.exe 88 PID 4088 wrote to memory of 4060 4088 za510957.exe 88 PID 2364 wrote to memory of 4652 2364 za503785.exe 91 PID 2364 wrote to memory of 4652 2364 za503785.exe 91 PID 2364 wrote to memory of 4652 2364 za503785.exe 91 PID 4652 wrote to memory of 2580 4652 xeeqk45.exe 93 PID 4652 wrote to memory of 2580 4652 xeeqk45.exe 93 PID 4652 wrote to memory of 2580 4652 xeeqk45.exe 93 PID 380 wrote to memory of 1120 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 94 PID 380 wrote to memory of 1120 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 94 PID 380 wrote to memory of 1120 380 7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe 94 PID 2580 wrote to memory of 4732 2580 oneetx.exe 95 PID 2580 wrote to memory of 4732 2580 oneetx.exe 95 PID 2580 wrote to memory of 4732 2580 oneetx.exe 95 PID 2580 wrote to memory of 3808 2580 oneetx.exe 103 PID 2580 wrote to memory of 3808 2580 oneetx.exe 103 PID 2580 wrote to memory of 3808 2580 oneetx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe"C:\Users\Admin\AppData\Local\Temp\7bc8a8c2582cbc3bbaeb0a14666527ad5f267b49c331a54d9af6c544d5eef7f2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za503785.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za510957.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\61280844.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w32OK15.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 10805⤵
- Program crash
PID:1204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xeeqk45.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F5⤵
- Creates scheduled task(s)
PID:4732
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3808
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys122856.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 13243⤵
- Program crash
PID:4648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4060 -ip 40601⤵PID:4604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1120 -ip 11201⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:692
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:1400
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
340KB
MD5924ac742c1e0b0c533632d5906183691
SHA1e9b4360552e93c60874502420eeff141449254d4
SHA256864df00082b1fa645d09d92ef7e39e6100930ae74ffbd284d3be962a852f8d63
SHA51252ced34574277f8d401558939f50977c2cd38d9124d38d6df5b39dd143b416157b30c8978e17d82ca054ab84f646a80369f619565255941f3be7f00d3f76ce1d
-
Filesize
340KB
MD5924ac742c1e0b0c533632d5906183691
SHA1e9b4360552e93c60874502420eeff141449254d4
SHA256864df00082b1fa645d09d92ef7e39e6100930ae74ffbd284d3be962a852f8d63
SHA51252ced34574277f8d401558939f50977c2cd38d9124d38d6df5b39dd143b416157b30c8978e17d82ca054ab84f646a80369f619565255941f3be7f00d3f76ce1d
-
Filesize
588KB
MD51ea84fc7060de6fc593002612e9d684e
SHA150cbd0f48c703dd999ff206cc3e8a856d4de9960
SHA256baf4dd56f8d5d64487b367a78e18f06edfa3cbdd53bde70a7ab72880642ce4d2
SHA5124f80eb844b86cc0fc4fdae0f0be69a127473dbc1d25f33b45d4b3a06dd41b176e1c554e67671a5b1669ddba8cfad9007991c2d3de7bc6e5c8e4aa8e37c7b37a5
-
Filesize
588KB
MD51ea84fc7060de6fc593002612e9d684e
SHA150cbd0f48c703dd999ff206cc3e8a856d4de9960
SHA256baf4dd56f8d5d64487b367a78e18f06edfa3cbdd53bde70a7ab72880642ce4d2
SHA5124f80eb844b86cc0fc4fdae0f0be69a127473dbc1d25f33b45d4b3a06dd41b176e1c554e67671a5b1669ddba8cfad9007991c2d3de7bc6e5c8e4aa8e37c7b37a5
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
229KB
MD53308051ded87b1863a8d92925202c4b3
SHA17834ddc23e7976b07118fb580ae38234466dbdfb
SHA25613b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4
SHA512f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc
-
Filesize
405KB
MD5770cf775b3a8bccae79e2a612ba0419b
SHA1a517e2388a08ea6f6b4dfd7b753350655f0fa51a
SHA256107a9a962ba91d1fb20a03adf4dccebb60d7f6318385393b0ce000318b2125a2
SHA51244f66759aba930ef0a574577a6227494de3083e7bb71400bfb988fe92226ef9848b36eadf7e8768c0a673394d91ffa6a457c1be4caec00e1300dc9f06007f64d
-
Filesize
405KB
MD5770cf775b3a8bccae79e2a612ba0419b
SHA1a517e2388a08ea6f6b4dfd7b753350655f0fa51a
SHA256107a9a962ba91d1fb20a03adf4dccebb60d7f6318385393b0ce000318b2125a2
SHA51244f66759aba930ef0a574577a6227494de3083e7bb71400bfb988fe92226ef9848b36eadf7e8768c0a673394d91ffa6a457c1be4caec00e1300dc9f06007f64d
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
176KB
MD52b71f4b18ac8214a2bff547b6ce2f64f
SHA1b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5
SHA256f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc
SHA51233518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177
-
Filesize
258KB
MD5a7dfcff7874309cbec4b225e948a6540
SHA12b4270d06402a14da601b2e5f95e4349d956da5e
SHA256d0673da5657a750c69d1dd0f56495ae6401f44353ec054b3d2868674c2b19b6a
SHA51240ac7c5b747cf2344f16d2e84832e42436e270a59a88d950407633fad6b786294746955a54f01eb2fa4825b8f87ba8a023abf4cedb14badf3eaba19e185a5f52
-
Filesize
258KB
MD5a7dfcff7874309cbec4b225e948a6540
SHA12b4270d06402a14da601b2e5f95e4349d956da5e
SHA256d0673da5657a750c69d1dd0f56495ae6401f44353ec054b3d2868674c2b19b6a
SHA51240ac7c5b747cf2344f16d2e84832e42436e270a59a88d950407633fad6b786294746955a54f01eb2fa4825b8f87ba8a023abf4cedb14badf3eaba19e185a5f52
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5