Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
11/12/2023, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe
Resource
win10-20231129-en
General
-
Target
3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe
-
Size
7.6MB
-
MD5
21f8f09df645fe6d8266e32b42983080
-
SHA1
6f73a2d809738c71706dbfd92456ad563e05f43e
-
SHA256
3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1
-
SHA512
35aec72a84d5d532aae3b69a8e2fc5da7f005d9545df05410556228355099cf8d98d35851ff1c21145cc85653cf20df6500ac26b68485e2c5b4ef49299e3b0ac
-
SSDEEP
196608:fnnY8NWvGpWTTlm0OxwW+nFnfZsMUdFt30Dzj:fnnY8NELTIrxwlxQWDzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 1108 gifplayer.exe 2404 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 194.49.94.194 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7CIOI.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NTDN7.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-70HA7.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BP6F3.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-A40LD.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-C1H7I.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-A2O1G.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-OKT3U.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-VGCN1.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PII53.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-0JKL4.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-M269S.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QM717.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-72RTV.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-83CGA.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IEOLD.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-R5SVH.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LI77D.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4AGT3.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-OHUV1.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PR379.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CRR82.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UC74V.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-R03HJ.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-K0AVS.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-V71LJ.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-47V26.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-C1P45.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3QL1N.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NI4SH.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9JHKV.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HHRRN.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9AOL2.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UBC55.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-G3Q60.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-F3BGK.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-B62L1.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-TRA2E.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-T28L7.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-4NSJ3.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7I0KE.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MRBIA.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-P84TI.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-C0QJ3.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0QAMK.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\is-225L0.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-DSVTP.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-KD9RQ.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-D7ON9.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-557P8.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4CQMC.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-OCSTV.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BCM5L.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JLIEB.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RDP0L.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ATS21.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4MRVM.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-AVITV.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-87N2N.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-VFFTJ.tmp 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3600 wrote to memory of 3284 3600 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe 74 PID 3600 wrote to memory of 3284 3600 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe 74 PID 3600 wrote to memory of 3284 3600 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe 74 PID 3284 wrote to memory of 4112 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 75 PID 3284 wrote to memory of 4112 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 75 PID 3284 wrote to memory of 4112 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 75 PID 3284 wrote to memory of 1108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 77 PID 3284 wrote to memory of 1108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 77 PID 3284 wrote to memory of 1108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 77 PID 3284 wrote to memory of 5108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 80 PID 3284 wrote to memory of 5108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 80 PID 3284 wrote to memory of 5108 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 80 PID 3284 wrote to memory of 2404 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 79 PID 3284 wrote to memory of 2404 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 79 PID 3284 wrote to memory of 2404 3284 3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp 79 PID 5108 wrote to memory of 876 5108 net.exe 81 PID 5108 wrote to memory of 876 5108 net.exe 81 PID 5108 wrote to memory of 876 5108 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp"C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp" /SL5="$60188,7715663,68096,C:\Users\Admin\AppData\Local\Temp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:4112
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:1108
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:876
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
970KB
MD5b3af7e960026b31827e298c4e5514480
SHA16c9403d5de419780707c798e16f93ce698009bde
SHA256a27b94673bff5a891ae159aa7d21de18f98fd42eecf8482a7879c43d094c965e
SHA512def1ec4d3745bcfca308acc15c21b764cf877bcb7607b499fcce7a0e45523f1d404465522ef527311ff895c4869ac409c1627e9b9575805a2c57383423fe9f8a
-
Filesize
851KB
MD54ea6b12e7ff65045f8dfa55f1ec4bf71
SHA149e9f07bb33d921c1f78d7a640118ecbf0c63980
SHA256a2ddb4617ffbeec2140e943b9f7dbb3f4645971b86c59b5c1ec01b71a4f98b8d
SHA512afe72a42b2bd160f7f1a1603d0a1843e46ade40df7af6ed2d33b077ff50238b9bdea9f1e0e7791126337a9b87499eac720fc81dcb2b7feb81fab3edb14a8078c
-
Filesize
816KB
MD531bda5c86e5781b9e0a8f36014481fc9
SHA1c38c7b05551d698504f3f0eb971af04e897b5079
SHA256394de657e5d80462bcc6e75f4438ac185b2b6e1f575f7a7f4ac9d3c4f5458892
SHA51217c7446c9f11f597078aaae1dd8100e2b41e58b118a64cbbc86325aed53ff2eb096c16beaffeabf311378d50e756f599ced3348ee36628c1eaa1bb9801b496c5
-
C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp
Filesize444KB
MD51502ea7e29989eb930df6e9c135fe1a4
SHA1c443aec51251ee642d8cc6aa9f8291b71c645186
SHA2560805d4989664a4aaaa3cd446a04a09a103619c39349e1a8f06e9cab22c613f7d
SHA51250b85936d04dc971d4bf1a898faea4d73f88d566631063c72137dd065a2ac7231bdf4756403b3864e0b0afe9e3f922862e72db0b9ddad908bb0a48ca62952bfb
-
C:\Users\Admin\AppData\Local\Temp\is-02FKI.tmp\3787bb4e56b93a5d003dcbeb2ee1e6867131ab3c7421737192d8eb4ea42d02d1.tmp
Filesize412KB
MD55bb6216ca71740697ca565c5aa72f7a1
SHA1d55ba5e15c175cc7394ed6eb708f907792f5f21a
SHA2562c0490b7aac90f39c8a3c3e56b77baac43f33b3117b94d563374f354d415786d
SHA512deb46475d4896735bb8106e29cefeb8054528234b5b3d958ee44e0904829ebf31e0b0ab9ea929c7a6e481107b89f60dde28c9dd3572cd8614425dfc544b6694a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303