Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe
-
Size
1.3MB
-
MD5
397f5c91fd7cafc22c3fe28bc8fe675a
-
SHA1
02e127ae9c5a55e9b48731a3d47220cdb056f3eb
-
SHA256
b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3
-
SHA512
fdb348e8d451e68f59c02c57dcc788e486f7244211687b854463768961c50bd70fad6e5e0e2e66dd3c42666fa6d04fcf1014e3dd356011eeaba4a6a7031bf311
-
SSDEEP
24576:dA1MqYjjU6kS6e5jB/n4L6JXWutEcPO6KhepiKnG/hnPrdSkl+j9aTw1OquD:d4dK756e5VgL6JXWutEcLmesKG/hQzj4
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3524 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1636 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 988 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3776 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4832 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3692 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3340 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3508 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 860 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1292 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5024 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2008 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1340 400 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 380 400 schtasks.exe 91 -
resource yara_rule behavioral2/files/0x000600000002322f-4.dat dcrat behavioral2/files/0x000600000002322f-8.dat dcrat behavioral2/files/0x000600000002322f-10.dat dcrat behavioral2/files/0x0006000000023233-21.dat dcrat behavioral2/files/0x0006000000023233-22.dat dcrat behavioral2/memory/4796-23-0x0000000000A80000-0x0000000000B56000-memory.dmp dcrat behavioral2/files/0x0006000000023239-28.dat dcrat behavioral2/files/0x0006000000023252-52.dat dcrat behavioral2/files/0x0006000000023252-53.dat dcrat -
Executes dropped EXE 3 IoCs
pid Process 3388 prikol.exe 4796 agentServer.exe 4352 dwm.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe agentServer.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\c5b4cb5e9653cc agentServer.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\DiagTrack\Scenarios\services.exe agentServer.exe File created C:\Windows\DiagTrack\Scenarios\c5b4cb5e9653cc agentServer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 380 schtasks.exe 1892 schtasks.exe 3340 schtasks.exe 2584 schtasks.exe 2664 schtasks.exe 3524 schtasks.exe 3316 schtasks.exe 1292 schtasks.exe 1340 schtasks.exe 988 schtasks.exe 4832 schtasks.exe 4060 schtasks.exe 2008 schtasks.exe 3012 schtasks.exe 3776 schtasks.exe 3508 schtasks.exe 860 schtasks.exe 3812 schtasks.exe 3068 schtasks.exe 1764 schtasks.exe 4980 schtasks.exe 5024 schtasks.exe 1668 schtasks.exe 4740 schtasks.exe 1636 schtasks.exe 3692 schtasks.exe 1488 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings prikol.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4796 agentServer.exe 4796 agentServer.exe 4796 agentServer.exe 4796 agentServer.exe 4796 agentServer.exe 4796 agentServer.exe 4796 agentServer.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe 4352 dwm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4352 dwm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4796 agentServer.exe Token: SeDebugPrivilege 4352 dwm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3388 1820 b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe 83 PID 1820 wrote to memory of 3388 1820 b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe 83 PID 1820 wrote to memory of 3388 1820 b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe 83 PID 3388 wrote to memory of 4312 3388 prikol.exe 84 PID 3388 wrote to memory of 4312 3388 prikol.exe 84 PID 3388 wrote to memory of 4312 3388 prikol.exe 84 PID 4312 wrote to memory of 3180 4312 WScript.exe 87 PID 4312 wrote to memory of 3180 4312 WScript.exe 87 PID 4312 wrote to memory of 3180 4312 WScript.exe 87 PID 3180 wrote to memory of 4796 3180 cmd.exe 90 PID 3180 wrote to memory of 4796 3180 cmd.exe 90 PID 4796 wrote to memory of 4352 4796 agentServer.exe 119 PID 4796 wrote to memory of 4352 4796 agentServer.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe"C:\Users\Admin\AppData\Local\Temp\b134e4e5d74eb1a5ddd66625837b44ed6d23fbac004bbaae91ece785b7c574e3_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\prikol.exe"C:\Users\Admin\AppData\Local\Temp\prikol.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\comhostDhcpcommon\2tGgrQ6HpW.vbe"3⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\comhostDhcpcommon\V15q6MjWRY5zvqjkxpp.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\comhostDhcpcommon\agentServer.exe"C:\comhostDhcpcommon\agentServer.exe"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\comhostDhcpcommon\dwm.exe"C:\comhostDhcpcommon\dwm.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\DiagTrack\Scenarios\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\DiagTrack\Scenarios\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\comhostDhcpcommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\comhostDhcpcommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\comhostDhcpcommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\comhostDhcpcommon\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\comhostDhcpcommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\comhostDhcpcommon\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\comhostDhcpcommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\comhostDhcpcommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\comhostDhcpcommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\comhostDhcpcommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\comhostDhcpcommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\comhostDhcpcommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD51df91d3d9db8d531d84c3090af0c5399
SHA1d5289bf48dc32630219ca3fb50b9509e40a61d82
SHA256a6e63a37391179fcb2b624a4e3a12a2d59fcd2479b79d8e0d117facd0b6b4948
SHA51285762e86d9aeb7d8360af01405e90fd5a06c1b5f53c5c913b1a2d025361bed7e3bb8cfca05e23c3ae87fe9fec8073e4687d5700d88b29adaa027186186288979
-
Filesize
1.1MB
MD51df91d3d9db8d531d84c3090af0c5399
SHA1d5289bf48dc32630219ca3fb50b9509e40a61d82
SHA256a6e63a37391179fcb2b624a4e3a12a2d59fcd2479b79d8e0d117facd0b6b4948
SHA51285762e86d9aeb7d8360af01405e90fd5a06c1b5f53c5c913b1a2d025361bed7e3bb8cfca05e23c3ae87fe9fec8073e4687d5700d88b29adaa027186186288979
-
Filesize
1.1MB
MD51df91d3d9db8d531d84c3090af0c5399
SHA1d5289bf48dc32630219ca3fb50b9509e40a61d82
SHA256a6e63a37391179fcb2b624a4e3a12a2d59fcd2479b79d8e0d117facd0b6b4948
SHA51285762e86d9aeb7d8360af01405e90fd5a06c1b5f53c5c913b1a2d025361bed7e3bb8cfca05e23c3ae87fe9fec8073e4687d5700d88b29adaa027186186288979
-
Filesize
829KB
MD59bc17f902aa42e14e3942b2895bbcd50
SHA1a9ae75b0ec339a7fbbde2dc67fbf3639fdf046c2
SHA2566133eab082730a37822829c47341c6f0d4dfd8fcec990e9d1a29067dcb32421b
SHA512a9b0918cb2add3fd507b38d929b1dff8f433020fa885f2b76c79d8bd8e471d4baa6df7f8d1f3a09397d7d10c03b2f49c4870646d6225d0e22de0806ae5a9de46
-
Filesize
213B
MD5c0dbb672804e81ed5bdc6ae50ec4b16a
SHA1df8bfc820f8de52ce8293395446991e5e5c43125
SHA2563a91849c1602a6fd0556663ea487f01d64fe4828f619ed5eb3f13c67c20dd905
SHA5126546e2c5c95f5bab69f7664cd4a0850a55554a1394a3dfe8252d048227df6ca8f0aec034f5954dbfc8eaf2137e642970364f71c1a5be5d5a68b6e5c32858f9e7
-
Filesize
38B
MD59daeb83018f1b30f4911748df09b9fa5
SHA16162370200b2c9e65620291d6ff114236492824e
SHA256c85b773f45f51d07874769ea344f153f63709b38f04cfc4180a7791392dcd5bb
SHA5121ec027262ba1aca607e00d00afb4cff5f471f39fb76760a1ac7af1437bd23814f0cb1ef8cad2211db104772ba02501812ba8e96f41ee3e0da56a7aac3ef5bced
-
Filesize
829KB
MD59bc17f902aa42e14e3942b2895bbcd50
SHA1a9ae75b0ec339a7fbbde2dc67fbf3639fdf046c2
SHA2566133eab082730a37822829c47341c6f0d4dfd8fcec990e9d1a29067dcb32421b
SHA512a9b0918cb2add3fd507b38d929b1dff8f433020fa885f2b76c79d8bd8e471d4baa6df7f8d1f3a09397d7d10c03b2f49c4870646d6225d0e22de0806ae5a9de46
-
Filesize
829KB
MD59bc17f902aa42e14e3942b2895bbcd50
SHA1a9ae75b0ec339a7fbbde2dc67fbf3639fdf046c2
SHA2566133eab082730a37822829c47341c6f0d4dfd8fcec990e9d1a29067dcb32421b
SHA512a9b0918cb2add3fd507b38d929b1dff8f433020fa885f2b76c79d8bd8e471d4baa6df7f8d1f3a09397d7d10c03b2f49c4870646d6225d0e22de0806ae5a9de46
-
Filesize
829KB
MD59bc17f902aa42e14e3942b2895bbcd50
SHA1a9ae75b0ec339a7fbbde2dc67fbf3639fdf046c2
SHA2566133eab082730a37822829c47341c6f0d4dfd8fcec990e9d1a29067dcb32421b
SHA512a9b0918cb2add3fd507b38d929b1dff8f433020fa885f2b76c79d8bd8e471d4baa6df7f8d1f3a09397d7d10c03b2f49c4870646d6225d0e22de0806ae5a9de46
-
Filesize
829KB
MD59bc17f902aa42e14e3942b2895bbcd50
SHA1a9ae75b0ec339a7fbbde2dc67fbf3639fdf046c2
SHA2566133eab082730a37822829c47341c6f0d4dfd8fcec990e9d1a29067dcb32421b
SHA512a9b0918cb2add3fd507b38d929b1dff8f433020fa885f2b76c79d8bd8e471d4baa6df7f8d1f3a09397d7d10c03b2f49c4870646d6225d0e22de0806ae5a9de46