Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 16:44
Static task
static1
Behavioral task
behavioral1
Sample
54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
Resource
win10v2004-20231023-en
General
-
Target
54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
-
Size
292KB
-
MD5
7aac4fbe5c22841c84e8690a836e46af
-
SHA1
27e470e94a988e4a6d6bccf8b862d59e66c409d0
-
SHA256
54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4
-
SHA512
25b6ac5bc1ee8132443c88e0c65069e8eff1314152b4688dfc00ddb75723c16025fb5b9f1af6b29eed78ca9d152912ed57c7b3100bad1f6357a18808738f0d41
-
SSDEEP
3072:UftffjmNSGNWHDzttk5pLzSMEjF47yctMYTWfYj9DfWxRmY7jyP0ejUl:sVfjmNfNmZtb4wNQBDfWxRvs0ewl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2688 Logo1_.exe 4728 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\legal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ru-RU\View3d\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\th-TH\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe File created C:\Windows\Logo1_.exe 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe 2688 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4088 wrote to memory of 1780 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 89 PID 4088 wrote to memory of 1780 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 89 PID 4088 wrote to memory of 1780 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 89 PID 4088 wrote to memory of 2688 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 91 PID 4088 wrote to memory of 2688 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 91 PID 4088 wrote to memory of 2688 4088 54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe 91 PID 2688 wrote to memory of 3312 2688 Logo1_.exe 92 PID 2688 wrote to memory of 3312 2688 Logo1_.exe 92 PID 2688 wrote to memory of 3312 2688 Logo1_.exe 92 PID 3312 wrote to memory of 3116 3312 net.exe 94 PID 3312 wrote to memory of 3116 3312 net.exe 94 PID 3312 wrote to memory of 3116 3312 net.exe 94 PID 1780 wrote to memory of 4728 1780 cmd.exe 95 PID 1780 wrote to memory of 4728 1780 cmd.exe 95 PID 1780 wrote to memory of 4728 1780 cmd.exe 95 PID 2688 wrote to memory of 3292 2688 Logo1_.exe 60 PID 2688 wrote to memory of 3292 2688 Logo1_.exe 60
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CA.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe"4⤵
- Executes dropped EXE
PID:4728
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3116
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5533ce215a7c274602dc456ca375cef93
SHA176c502d7c45eca3fd96f6b04eb850e751bc785dd
SHA256d70c9f73bbeed5cbc0df4a4d14bae68789f84d8092281337d2919322b288ce9c
SHA51209d9dee36c48567921de4b7c31c4a822d5f9ed5e0b1cb0330031b320f40b5ba9b15e89dc37d52561094642c0ff16c14d32e81ed5b1dac06150fefbbd6f3365bf
-
Filesize
484KB
MD5fd58f71e0890b5a3ac35509793a22fc4
SHA1551de654d702a61a909c4d0d1950b8a4f7e371af
SHA2562196336905b9d8d2cfd886bc18e4f2b9bd503e1a9fa29c66f8390075157f34e8
SHA512682604f8be963b826da1d002d0e7f953255fa26301b3715821df1023ecba66c5aca289ac9ae4acddefd0588e2bd13b921f3bc32b8fb90f00d00bf6ad33ba3fb6
-
Filesize
721B
MD5fac5bb090c2c8ccd3a3140566ffe3ebb
SHA147657e786de2327f208fba97b8f9d40fc51ed713
SHA256d5a21cbab8d8b2cd481a0be4f18c240d44ae3d0705684d57d82df5969152f80f
SHA512f887fc271f1667d6de402669ecef621bdeb52b8259384e3a5a9530d93fe6b5bd76ad1aea811115e3a25a01ee82471943bd60680602e5d22f6b11ce5e74859233
-
C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe
Filesize266KB
MD5b0dcc380e6b5d51460eafeba2a4c0d3b
SHA11fedbf0b02f7a7ce4149b96ff6b296f81574a7e1
SHA256ebffb0122f9787bf691068614d576a634fdc0c6bb28ba565ecc3d7d49b41001c
SHA5126d098af85eb8e12da482ec6347f4c19a8f75c72cdcfa0885a7a0f5a6b3718417bfdce1009648b9a29e64b61d1b1c5bd76744596f4182816171863fa8b72245d2
-
C:\Users\Admin\AppData\Local\Temp\54bad935a11a0d5e7a8d12a023c486ca87e310bd1168ecd7bb7f0203218f20a4.exe.exe
Filesize266KB
MD5b0dcc380e6b5d51460eafeba2a4c0d3b
SHA11fedbf0b02f7a7ce4149b96ff6b296f81574a7e1
SHA256ebffb0122f9787bf691068614d576a634fdc0c6bb28ba565ecc3d7d49b41001c
SHA5126d098af85eb8e12da482ec6347f4c19a8f75c72cdcfa0885a7a0f5a6b3718417bfdce1009648b9a29e64b61d1b1c5bd76744596f4182816171863fa8b72245d2
-
Filesize
26KB
MD5ed9c69fcace8a0c07f7596f17c76cd92
SHA131fe334a5cd033d7688ae7cbf49b78db9f888cec
SHA2560cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073
SHA51280a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf
-
Filesize
26KB
MD5ed9c69fcace8a0c07f7596f17c76cd92
SHA131fe334a5cd033d7688ae7cbf49b78db9f888cec
SHA2560cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073
SHA51280a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf
-
Filesize
26KB
MD5ed9c69fcace8a0c07f7596f17c76cd92
SHA131fe334a5cd033d7688ae7cbf49b78db9f888cec
SHA2560cff4e74e436b6c06ff1c99d2e9a605d6ecc4fcfb6fc20fd3942c19cee76e073
SHA51280a86988ca56652428132faf8169a156d4ce88c7cc7a6c1cc825f120ec8e813d261fcaccdb462969346d690b6c14b60e40bbe421933fc68627fc975b9036ffdf
-
Filesize
10B
MD57af371ae7aad351d505f1b26382de243
SHA10a19bf0a1ccfb902a03b3da68bdd289190e62f5f
SHA2564fcc643d52dbc25dd57a011e27cbb0503711cf1a2ad1610a4f9e7b9f17c5bc1b
SHA5121127b9c88de9e2d58f7a512dd52c31bb9d96b0543f13e4cfff59ca2b73e60307538dd9bcd1c480e6d260fe45b44208a5554a5a60e8c2e3da8385b2cdd0e77d3e