Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
e1c448b6b98a231ca9a8529f82eb702d.exe
Resource
win7-20240221-en
General
-
Target
e1c448b6b98a231ca9a8529f82eb702d.exe
-
Size
166KB
-
MD5
e1c448b6b98a231ca9a8529f82eb702d
-
SHA1
8d57de92ce60fbca562fef596006c7aa28885ed7
-
SHA256
357ccf22db104e18215de1ee6e16817880594f488705b97f54d0b0599b2af29c
-
SHA512
f13bb4ae08353308e47e330647ab7a2d1675ad1b07588dea7b8cba98777cdabf2c227f3c70d74793408a8d00993c265661f7f51705020aee65d5c4995858e3ee
-
SSDEEP
3072:NdKFOoL16A4gVr9kYaQBqaFM2oVhyAn1+p:7KF/LAFgVrwwM2uf1W
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 2572 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe -
resource yara_rule behavioral1/memory/3016-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-11-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3016-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/3016-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2572-36-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2572-276-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2572-445-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\sbdrop.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Portable Devices\sqmapi.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html svchost.exe File opened for modification C:\Program Files\Internet Explorer\IEShims.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\wab32res.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchui.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\jsdbgui.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2572 WaterMark.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe 2948 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2572 WaterMark.exe Token: SeDebugPrivilege 2948 svchost.exe Token: SeDebugPrivilege 2572 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 2572 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3016 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 28 PID 1760 wrote to memory of 3016 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 28 PID 1760 wrote to memory of 3016 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 28 PID 1760 wrote to memory of 3016 1760 e1c448b6b98a231ca9a8529f82eb702d.exe 28 PID 3016 wrote to memory of 2572 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 29 PID 3016 wrote to memory of 2572 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 29 PID 3016 wrote to memory of 2572 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 29 PID 3016 wrote to memory of 2572 3016 e1c448b6b98a231ca9a8529f82eb702dmgr.exe 29 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 1984 2572 WaterMark.exe 30 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2572 wrote to memory of 2948 2572 WaterMark.exe 31 PID 2948 wrote to memory of 260 2948 svchost.exe 1 PID 2948 wrote to memory of 260 2948 svchost.exe 1 PID 2948 wrote to memory of 260 2948 svchost.exe 1 PID 2948 wrote to memory of 260 2948 svchost.exe 1 PID 2948 wrote to memory of 260 2948 svchost.exe 1 PID 2948 wrote to memory of 336 2948 svchost.exe 2 PID 2948 wrote to memory of 336 2948 svchost.exe 2 PID 2948 wrote to memory of 336 2948 svchost.exe 2 PID 2948 wrote to memory of 336 2948 svchost.exe 2 PID 2948 wrote to memory of 336 2948 svchost.exe 2 PID 2948 wrote to memory of 372 2948 svchost.exe 3 PID 2948 wrote to memory of 372 2948 svchost.exe 3 PID 2948 wrote to memory of 372 2948 svchost.exe 3 PID 2948 wrote to memory of 372 2948 svchost.exe 3 PID 2948 wrote to memory of 372 2948 svchost.exe 3 PID 2948 wrote to memory of 384 2948 svchost.exe 4 PID 2948 wrote to memory of 384 2948 svchost.exe 4 PID 2948 wrote to memory of 384 2948 svchost.exe 4 PID 2948 wrote to memory of 384 2948 svchost.exe 4 PID 2948 wrote to memory of 384 2948 svchost.exe 4 PID 2948 wrote to memory of 420 2948 svchost.exe 5 PID 2948 wrote to memory of 420 2948 svchost.exe 5 PID 2948 wrote to memory of 420 2948 svchost.exe 5 PID 2948 wrote to memory of 420 2948 svchost.exe 5 PID 2948 wrote to memory of 420 2948 svchost.exe 5 PID 2948 wrote to memory of 464 2948 svchost.exe 6 PID 2948 wrote to memory of 464 2948 svchost.exe 6 PID 2948 wrote to memory of 464 2948 svchost.exe 6 PID 2948 wrote to memory of 464 2948 svchost.exe 6 PID 2948 wrote to memory of 464 2948 svchost.exe 6 PID 2948 wrote to memory of 480 2948 svchost.exe 7 PID 2948 wrote to memory of 480 2948 svchost.exe 7 PID 2948 wrote to memory of 480 2948 svchost.exe 7 PID 2948 wrote to memory of 480 2948 svchost.exe 7 PID 2948 wrote to memory of 480 2948 svchost.exe 7 PID 2948 wrote to memory of 488 2948 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1992
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2328
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:744
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:868
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1960
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:1004
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:340
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:880
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1080
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1288
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1700
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\e1c448b6b98a231ca9a8529f82eb702d.exe"C:\Users\Admin\AppData\Local\Temp\e1c448b6b98a231ca9a8529f82eb702d.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\e1c448b6b98a231ca9a8529f82eb702dmgr.exeC:\Users\Admin\AppData\Local\Temp\e1c448b6b98a231ca9a8529f82eb702dmgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1984
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize206KB
MD5c79aec4be786dab2a610b7356b3a653c
SHA1a142b6593ee5378f262f925f5ae84db017f46d8c
SHA2567484c1d5e5d1fd4f0813b4dc203595eb99ddfeb2ecb9d42011b4bbd660e8c13c
SHA51269af7c1f7a6c436b087ad935fa64d8a3b0289f645db79a4a75a1a89b787e2aab90071cd77a216ed40042719c6cd05dd5abb0541f761776928c4c170460f78342
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize202KB
MD55baa99518f6d231393555a0286e4617a
SHA144ff088f35936e5a964ab57cf8f8202c33826a1a
SHA256b63f96e898b7d7b07fc65299247860a16eef9a95cb71177a7cf892164f3eac6f
SHA5121fa59f7bc4b632ccebdb84101dfb7abaafd18e059f1a49fcd63e36b7342e67abe714786178daa382629c5edb5c33837dc33e67f0b61e0972a318a6afcf2cff3f
-
Filesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837