Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe
Resource
win10v2004-20231130-en
General
-
Target
a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe
-
Size
7.5MB
-
MD5
8a3e847cfd7a77890d19dcd5bc6510a9
-
SHA1
5bc04fe33664e8d5be738e91c037dcd50ae5f8f1
-
SHA256
a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1
-
SHA512
30775b2382c43f6a654bfe4c1665aae98d3e02a17a017b9d07982fe6c677c3aa447360cebafe0d972abfc4dffcf95833103aee479dfdf50b8d3088fad76e800f
-
SSDEEP
196608:xq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:xHC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 2412 gifplayer.exe 4204 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.49.94.194 Destination IP 45.155.250.90 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\stuff\is-8UE0R.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3PO31.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BBL48.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-78QR5.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PPL7G.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NC65L.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-JON6S.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DE44T.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JGLU6.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ABU8Q.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8L6TA.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JL8B1.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-H6IF8.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-NLB8B.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DA3OI.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5HUMQ.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\is-G9L4A.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-T20HH.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-7NBLA.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CAKHA.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-N970A.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0MVFS.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DI4EQ.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-QMKO7.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1UGAO.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-95N08.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-P6TC5.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DAPJP.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-M7ATA.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-KMPUI.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LVUB4.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-Q033O.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-H8RIU.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-4SO22.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-SMR6U.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9IP0F.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-9KIRR.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-31UCS.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-V60V9.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RK37J.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-9D0O7.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BE0AC.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-AS1KE.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0UQR4.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-C9TCT.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-F6MU5.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-409MF.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HG7OU.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DQOI0.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-4LLSO.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1KHP6.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JMPHA.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-T3M0M.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-48P14.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-DA81M.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-6P5OB.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-D13Q7.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FCU89.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-P1DOO.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-U7PFT.tmp a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4408 4020 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe 87 PID 4020 wrote to memory of 4408 4020 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe 87 PID 4020 wrote to memory of 4408 4020 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe 87 PID 4408 wrote to memory of 5040 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 91 PID 4408 wrote to memory of 5040 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 91 PID 4408 wrote to memory of 5040 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 91 PID 4408 wrote to memory of 2412 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 93 PID 4408 wrote to memory of 2412 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 93 PID 4408 wrote to memory of 2412 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 93 PID 4408 wrote to memory of 4220 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 96 PID 4408 wrote to memory of 4220 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 96 PID 4408 wrote to memory of 4220 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 96 PID 4408 wrote to memory of 4204 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 95 PID 4408 wrote to memory of 4204 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 95 PID 4408 wrote to memory of 4204 4408 a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp 95 PID 4220 wrote to memory of 2936 4220 net.exe 97 PID 4220 wrote to memory of 2936 4220 net.exe 97 PID 4220 wrote to memory of 2936 4220 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe"C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp"C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp" /SL5="$70056,7577497,68096,C:\Users\Admin\AppData\Local\Temp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:5040
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:2412
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:4204
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:2936
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD50df5ae7d31189bca070f416939aabd7d
SHA169703079139d359103bf6e5c655bfadccda40a79
SHA25662a4ee9b77ad187406574f7dfd008f4ffdcec6a7098277b7344675619584f08a
SHA512f88a7d0ccc0a85af7024196cf2444e14408263dd470cffa733d8f65ba35b51d986e261e094438a14705fb9cf7dc0580e591331007e8edd07a4524baa25b007e9
-
Filesize
1.1MB
MD5ee24f4d625de23700978d65863af9164
SHA109effc5d8ccc9949cda23450e29f0cc52d573957
SHA256301585317ddec7a6f879a249d5cf2de034e7f4e30745691a0994608fc95de9ac
SHA512630c911be16423ed8491c743993f1cc1f046fd56545733988a23922c2aa05f6a4da694f08afafc5281b5b7e74c1a320a94dd213880bbb67df18ae6ce11a98698
-
Filesize
533KB
MD5e845af7523dc1830108e5ff194376082
SHA1b403642fd73a5ec958c0270802dd44c18f760320
SHA256d40be29551079587ec95f5b4c455ca98b56cfb93f48f3633f9c374f9126809eb
SHA5127b966fa2236ad81c40360a7df13b049b8bec78c4b059b6c6143d2d2b3a82c3bbf7857a305910ff1eda3dc956951ea09c6579b4b53c13c83ae90b0411f62ade3d
-
C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp
Filesize448KB
MD5e2bbe2ff3a975baf7e2ed94b4760519a
SHA1842fae703269a343986b7fb77cf0862dd404c62e
SHA2565019563a037e4b6541aafc29c88af7500e8b7b3bf4e7dda726930ff1d6db9b05
SHA512ba08082d2c5ee85fc8461482bf56a371736af709d30e493f37ee430a56d7cf01111a36645dc65350f426762cf29161bcfa00d632bdc2119326e6fe8e7404cf17
-
C:\Users\Admin\AppData\Local\Temp\is-67AKG.tmp\a12b78a1cde7a7eb3a1384d07798cee2e3fd5bdd158645e09e284d65ff69bfc1.tmp
Filesize332KB
MD564c62186ce90da672cc15c4e48ade66a
SHA119029284b805e7c52dd57e177132612a967cefe6
SHA256dbd4abb988ece6e44a4c99ed12d1c49c3662c2ab9678e0961c0e152cce1c686c
SHA512148b39600361d0340e3ac8d489360afdb7b52dbe63421453214dbb3f4f4136f4d9fd730dc34d59fef844d7822284a0b6fe784c9e94890ef2c317ba2d7fa22572
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303