Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9862c8d1ed05b1f41aa58ffcd621c0c7.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9862c8d1ed05b1f41aa58ffcd621c0c7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
9862c8d1ed05b1f41aa58ffcd621c0c7.exe
-
Size
556KB
-
MD5
9862c8d1ed05b1f41aa58ffcd621c0c7
-
SHA1
b367426011a95facc927718018b7b214a40af948
-
SHA256
d000d9b44f81d02f49b76aea429c502c770834a29d9b2794e8d109e3b572f118
-
SHA512
5c07982b036fe7f1257d3c3a7d49556d69dd32abb04b4f6821a2156670122bf2f9a8a2234d0f48541eb358d94fecab2e91d859675de25638dd0813c90458d37f
-
SSDEEP
6144:twkajyiWz7KXsS5sTqPBpJdGE1zk08aR7xR3p73hwV:ujyfHSmbEp18aRdD0
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515} svcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe" svcr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 9862c8d1ed05b1f41aa58ffcd621c0c7.exe -
Executes dropped EXE 2 IoCs
pid Process 1684 svcr.exe 4052 svcr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" 9862c8d1ed05b1f41aa58ffcd621c0c7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" 9862c8d1ed05b1f41aa58ffcd621c0c7.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3820 set thread context of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 1684 set thread context of 4052 1684 svcr.exe 89 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\svcr.exe 9862c8d1ed05b1f41aa58ffcd621c0c7.exe File created C:\Windows\svcr.exe 9862c8d1ed05b1f41aa58ffcd621c0c7.exe File opened for modification C:\Windows\svcr.exe svcr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31088174" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3108149744" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3065961650" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3108149744" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31088174" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3066117033" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414560714" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E22343EF-CA21-11EE-B6AD-72AC86130FB1} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31088174" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31088174" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 4052 svcr.exe 4052 svcr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4052 svcr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 1684 svcr.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 4656 IEXPLORE.EXE 4656 IEXPLORE.EXE 4656 IEXPLORE.EXE 4656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 3820 wrote to memory of 2272 3820 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 84 PID 2272 wrote to memory of 4272 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 85 PID 2272 wrote to memory of 4272 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 85 PID 2272 wrote to memory of 4272 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 85 PID 4272 wrote to memory of 2696 4272 IEXPLORE.EXE 86 PID 4272 wrote to memory of 2696 4272 IEXPLORE.EXE 86 PID 2696 wrote to memory of 2056 2696 IEXPLORE.EXE 87 PID 2696 wrote to memory of 2056 2696 IEXPLORE.EXE 87 PID 2696 wrote to memory of 2056 2696 IEXPLORE.EXE 87 PID 2272 wrote to memory of 1684 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 88 PID 2272 wrote to memory of 1684 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 88 PID 2272 wrote to memory of 1684 2272 9862c8d1ed05b1f41aa58ffcd621c0c7.exe 88 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 1684 wrote to memory of 4052 1684 svcr.exe 89 PID 4052 wrote to memory of 892 4052 svcr.exe 90 PID 4052 wrote to memory of 892 4052 svcr.exe 90 PID 4052 wrote to memory of 892 4052 svcr.exe 90 PID 892 wrote to memory of 2064 892 IEXPLORE.EXE 91 PID 892 wrote to memory of 2064 892 IEXPLORE.EXE 91 PID 2696 wrote to memory of 4656 2696 IEXPLORE.EXE 92 PID 2696 wrote to memory of 4656 2696 IEXPLORE.EXE 92 PID 2696 wrote to memory of 4656 2696 IEXPLORE.EXE 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92 PID 4052 wrote to memory of 4656 4052 svcr.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9862c8d1ed05b1f41aa58ffcd621c0c7.exe"C:\Users\Admin\AppData\Local\Temp\9862c8d1ed05b1f41aa58ffcd621c0c7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\9862c8d1ed05b1f41aa58ffcd621c0c7.exeC:\Users\Admin\AppData\Local\Temp\9862c8d1ed05b1f41aa58ffcd621c0c7.exe2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"3⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:82948 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4656
-
-
-
-
C:\Windows\svcr.exe"C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\9862c8d1ed05b1f41aa58ffcd621c0c7.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\svcr.exeC:\Windows\svcr.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"5⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
PID:2064
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55d2e801ae3f7df50081e3bb1f01cdf68
SHA1147c54d6811b5f01c11705cc424d76ea6a548fa8
SHA2568faa139c1b9826ff7961dafdeba17f9c471b2b164313c0886f6e56a8222d354e
SHA512576aaeb9f7125142196029c9de82829a16ae85597592f2a83bd883e7ad5b2a6a71fecf7ead45a3c750ba4f9fc7a6f8c36826425c534a681610808633c01b2495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5a8e957188b83a6a03643b087c633e218
SHA151d20df2ba2e1225f43923b3765b0eff8b5c1992
SHA256f67f181075b0f11b485ecf3e84dd0cef501d7a269e658b2d4b0bef2502a15e5c
SHA512f0dc34df4002c4a906486a9584b20182235d3401a47d9f3763806d27aae99eb89ffc5582b787246ed1bdcb9e6a9b20046a889503f4bd5dde7ffe481a5d0aafcf
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
517KB
MD5582d9b12b22a4cd523c8666a81cfa112
SHA153193c7261c153602b97686765fc63e2a185856a
SHA2563fff95b372a26d0ce92e7004f505ac7663f007eb8f0d19fb158bca38a12b216f
SHA512763ca7ee7e8185ccd2ac3c7e032e001bc1285355c90f6c5c57339e40f287416c39cac895472f668dac1a68921795c461cc45f206427badeb75dc47ccb2509ebf
-
Filesize
556KB
MD59862c8d1ed05b1f41aa58ffcd621c0c7
SHA1b367426011a95facc927718018b7b214a40af948
SHA256d000d9b44f81d02f49b76aea429c502c770834a29d9b2794e8d109e3b572f118
SHA5125c07982b036fe7f1257d3c3a7d49556d69dd32abb04b4f6821a2156670122bf2f9a8a2234d0f48541eb358d94fecab2e91d859675de25638dd0813c90458d37f