Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
RustAnticheat.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
RustAnticheat.exe
Resource
win10v2004-20240802-en
General
-
Target
RustAnticheat.exe
-
Size
1.1MB
-
MD5
6d63fe8c87e642d9e380a13803aa6858
-
SHA1
5652877b527da6cec16dfa7e9653d3657fedea8b
-
SHA256
066692a03f240a40c237f5ec3270d27cac1fda40630dd29f40db006b79a542a8
-
SHA512
32ad077db3f44cd184f60a715464a0540615fee76cbb4de20c6a2703b1ef2a74391adfad0e77a4c3b2340f9bafbc18238445f19e7fcebf2c11e76e66376d000d
-
SSDEEP
24576:Ucvup1OydVxYPtGU8ynaQpLUcgs5JTqzCZxGcQVyULZ6U6/:U/1OydfMrgsfX04KZ69/
Malware Config
Extracted
xworm
expected-schema.gl.at.ply.gg:2980
-
Install_directory
%LocalAppData%
-
install_file
USB.exe
Extracted
umbral
https://discord.com/api/webhooks/1286299751637192826/RNAV05TJwC7uQTEETo8ZiWSJKOrj5gYY87jlWomaK7jJ1jmuh7qm4pMjcc2ZUhDh6jxd
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016d42-17.dat family_umbral behavioral1/memory/1940-19-0x0000000000870000-0x00000000008B0000-memory.dmp family_umbral -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral1/files/0x000700000001211a-5.dat family_xworm behavioral1/memory/2276-9-0x0000000000A80000-0x0000000000A9C000-memory.dmp family_xworm behavioral1/memory/2328-98-0x0000000000C40000-0x0000000000C5C000-memory.dmp family_xworm -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2156 powershell.exe 2056 powershell.exe 1724 powershell.exe 2060 powershell.exe 1852 powershell.exe 2016 powershell.exe 2132 powershell.exe 1856 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk RuntimeBroker.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk RuntimeBroker.exe -
Executes dropped EXE 5 IoCs
pid Process 2276 RuntimeBroker.exe 2516 RustAntich1eat.exe 1940 Umbral.exe 2328 RuntimeBroker 1652 RuntimeBroker -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Local\\RuntimeBroker" RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 12 discord.com 13 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com 7 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RustAntich1eat.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2236 cmd.exe 744 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2320 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 744 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 876 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1940 Umbral.exe 2156 powershell.exe 2016 powershell.exe 2132 powershell.exe 2096 powershell.exe 2056 powershell.exe 1724 powershell.exe 2060 powershell.exe 1856 powershell.exe 1852 powershell.exe 2276 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2276 RuntimeBroker.exe Token: SeDebugPrivilege 1940 Umbral.exe Token: SeIncreaseQuotaPrivilege 1028 wmic.exe Token: SeSecurityPrivilege 1028 wmic.exe Token: SeTakeOwnershipPrivilege 1028 wmic.exe Token: SeLoadDriverPrivilege 1028 wmic.exe Token: SeSystemProfilePrivilege 1028 wmic.exe Token: SeSystemtimePrivilege 1028 wmic.exe Token: SeProfSingleProcessPrivilege 1028 wmic.exe Token: SeIncBasePriorityPrivilege 1028 wmic.exe Token: SeCreatePagefilePrivilege 1028 wmic.exe Token: SeBackupPrivilege 1028 wmic.exe Token: SeRestorePrivilege 1028 wmic.exe Token: SeShutdownPrivilege 1028 wmic.exe Token: SeDebugPrivilege 1028 wmic.exe Token: SeSystemEnvironmentPrivilege 1028 wmic.exe Token: SeRemoteShutdownPrivilege 1028 wmic.exe Token: SeUndockPrivilege 1028 wmic.exe Token: SeManageVolumePrivilege 1028 wmic.exe Token: 33 1028 wmic.exe Token: 34 1028 wmic.exe Token: 35 1028 wmic.exe Token: SeIncreaseQuotaPrivilege 1028 wmic.exe Token: SeSecurityPrivilege 1028 wmic.exe Token: SeTakeOwnershipPrivilege 1028 wmic.exe Token: SeLoadDriverPrivilege 1028 wmic.exe Token: SeSystemProfilePrivilege 1028 wmic.exe Token: SeSystemtimePrivilege 1028 wmic.exe Token: SeProfSingleProcessPrivilege 1028 wmic.exe Token: SeIncBasePriorityPrivilege 1028 wmic.exe Token: SeCreatePagefilePrivilege 1028 wmic.exe Token: SeBackupPrivilege 1028 wmic.exe Token: SeRestorePrivilege 1028 wmic.exe Token: SeShutdownPrivilege 1028 wmic.exe Token: SeDebugPrivilege 1028 wmic.exe Token: SeSystemEnvironmentPrivilege 1028 wmic.exe Token: SeRemoteShutdownPrivilege 1028 wmic.exe Token: SeUndockPrivilege 1028 wmic.exe Token: SeManageVolumePrivilege 1028 wmic.exe Token: 33 1028 wmic.exe Token: 34 1028 wmic.exe Token: 35 1028 wmic.exe Token: SeDebugPrivilege 2156 powershell.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeDebugPrivilege 2096 powershell.exe Token: SeDebugPrivilege 2056 powershell.exe Token: SeDebugPrivilege 1724 powershell.exe Token: SeIncreaseQuotaPrivilege 840 wmic.exe Token: SeSecurityPrivilege 840 wmic.exe Token: SeTakeOwnershipPrivilege 840 wmic.exe Token: SeLoadDriverPrivilege 840 wmic.exe Token: SeSystemProfilePrivilege 840 wmic.exe Token: SeSystemtimePrivilege 840 wmic.exe Token: SeProfSingleProcessPrivilege 840 wmic.exe Token: SeIncBasePriorityPrivilege 840 wmic.exe Token: SeCreatePagefilePrivilege 840 wmic.exe Token: SeBackupPrivilege 840 wmic.exe Token: SeRestorePrivilege 840 wmic.exe Token: SeShutdownPrivilege 840 wmic.exe Token: SeDebugPrivilege 840 wmic.exe Token: SeSystemEnvironmentPrivilege 840 wmic.exe Token: SeRemoteShutdownPrivilege 840 wmic.exe Token: SeUndockPrivilege 840 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2276 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2276 2936 RustAnticheat.exe 30 PID 2936 wrote to memory of 2276 2936 RustAnticheat.exe 30 PID 2936 wrote to memory of 2276 2936 RustAnticheat.exe 30 PID 2936 wrote to memory of 2516 2936 RustAnticheat.exe 31 PID 2936 wrote to memory of 2516 2936 RustAnticheat.exe 31 PID 2936 wrote to memory of 2516 2936 RustAnticheat.exe 31 PID 2936 wrote to memory of 2516 2936 RustAnticheat.exe 31 PID 2936 wrote to memory of 1940 2936 RustAnticheat.exe 32 PID 2936 wrote to memory of 1940 2936 RustAnticheat.exe 32 PID 2936 wrote to memory of 1940 2936 RustAnticheat.exe 32 PID 1940 wrote to memory of 1028 1940 Umbral.exe 36 PID 1940 wrote to memory of 1028 1940 Umbral.exe 36 PID 1940 wrote to memory of 1028 1940 Umbral.exe 36 PID 1940 wrote to memory of 2984 1940 Umbral.exe 38 PID 1940 wrote to memory of 2984 1940 Umbral.exe 38 PID 1940 wrote to memory of 2984 1940 Umbral.exe 38 PID 1940 wrote to memory of 2156 1940 Umbral.exe 40 PID 1940 wrote to memory of 2156 1940 Umbral.exe 40 PID 1940 wrote to memory of 2156 1940 Umbral.exe 40 PID 1940 wrote to memory of 2016 1940 Umbral.exe 42 PID 1940 wrote to memory of 2016 1940 Umbral.exe 42 PID 1940 wrote to memory of 2016 1940 Umbral.exe 42 PID 1940 wrote to memory of 2132 1940 Umbral.exe 44 PID 1940 wrote to memory of 2132 1940 Umbral.exe 44 PID 1940 wrote to memory of 2132 1940 Umbral.exe 44 PID 1940 wrote to memory of 2096 1940 Umbral.exe 46 PID 1940 wrote to memory of 2096 1940 Umbral.exe 46 PID 1940 wrote to memory of 2096 1940 Umbral.exe 46 PID 2276 wrote to memory of 2056 2276 RuntimeBroker.exe 48 PID 2276 wrote to memory of 2056 2276 RuntimeBroker.exe 48 PID 2276 wrote to memory of 2056 2276 RuntimeBroker.exe 48 PID 2276 wrote to memory of 1724 2276 RuntimeBroker.exe 50 PID 2276 wrote to memory of 1724 2276 RuntimeBroker.exe 50 PID 2276 wrote to memory of 1724 2276 RuntimeBroker.exe 50 PID 2276 wrote to memory of 2060 2276 RuntimeBroker.exe 52 PID 2276 wrote to memory of 2060 2276 RuntimeBroker.exe 52 PID 2276 wrote to memory of 2060 2276 RuntimeBroker.exe 52 PID 1940 wrote to memory of 840 1940 Umbral.exe 54 PID 1940 wrote to memory of 840 1940 Umbral.exe 54 PID 1940 wrote to memory of 840 1940 Umbral.exe 54 PID 1940 wrote to memory of 1920 1940 Umbral.exe 56 PID 1940 wrote to memory of 1920 1940 Umbral.exe 56 PID 1940 wrote to memory of 1920 1940 Umbral.exe 56 PID 1940 wrote to memory of 1684 1940 Umbral.exe 58 PID 1940 wrote to memory of 1684 1940 Umbral.exe 58 PID 1940 wrote to memory of 1684 1940 Umbral.exe 58 PID 2276 wrote to memory of 1852 2276 RuntimeBroker.exe 60 PID 2276 wrote to memory of 1852 2276 RuntimeBroker.exe 60 PID 2276 wrote to memory of 1852 2276 RuntimeBroker.exe 60 PID 1940 wrote to memory of 1856 1940 Umbral.exe 61 PID 1940 wrote to memory of 1856 1940 Umbral.exe 61 PID 1940 wrote to memory of 1856 1940 Umbral.exe 61 PID 1940 wrote to memory of 2320 1940 Umbral.exe 64 PID 1940 wrote to memory of 2320 1940 Umbral.exe 64 PID 1940 wrote to memory of 2320 1940 Umbral.exe 64 PID 1940 wrote to memory of 2236 1940 Umbral.exe 66 PID 1940 wrote to memory of 2236 1940 Umbral.exe 66 PID 1940 wrote to memory of 2236 1940 Umbral.exe 66 PID 2236 wrote to memory of 744 2236 cmd.exe 68 PID 2236 wrote to memory of 744 2236 cmd.exe 68 PID 2236 wrote to memory of 744 2236 cmd.exe 68 PID 2276 wrote to memory of 876 2276 RuntimeBroker.exe 69 PID 2276 wrote to memory of 876 2276 RuntimeBroker.exe 69 PID 2276 wrote to memory of 876 2276 RuntimeBroker.exe 69 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2984 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RustAnticheat.exe"C:\Users\Admin\AppData\Local\Temp\RustAnticheat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\RuntimeBroker.exe"C:\Users\Admin\RuntimeBroker.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\RuntimeBroker'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\RuntimeBroker"3⤵
- Scheduled Task/Job: Scheduled Task
PID:876
-
-
-
C:\Users\Admin\RustAntich1eat.exe"C:\Users\Admin\RustAntich1eat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Users\Admin\Umbral.exe"C:\Users\Admin\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\Umbral.exe"3⤵
- Views/modifies file attributes
PID:2984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:1920
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:1684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2320
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\Umbral.exe" && pause3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\system32\PING.EXEping localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:744
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E1ACF62E-C816-46F0-A400-8552F181E8A3} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]1⤵PID:2352
-
C:\Users\Admin\AppData\Local\RuntimeBrokerC:\Users\Admin\AppData\Local\RuntimeBroker2⤵
- Executes dropped EXE
PID:2328
-
-
C:\Users\Admin\AppData\Local\RuntimeBrokerC:\Users\Admin\AppData\Local\RuntimeBroker2⤵
- Executes dropped EXE
PID:1652
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5abdf4b7d6cc61b0f714bf6712f778de7
SHA18396ec844f9d610d0ca06ed7b2a37a294834cc47
SHA256fe9212ace0270e43f4caa5b5b3bef9ee81f52f19bec1bbf17d15955fc0e769ba
SHA5129fecc0b0f267879bcb66ace4759b5ca4493c5f517f09ef87c62b1b11875f41665cf00b0e6e32b874a7e59d79a906f1cdfac17219433004bb3feaa96125069228
-
Filesize
84KB
MD598ccb6806d126e3a211b963d3341efd7
SHA1108dfe1979c04c588f87d6fc2bb57c3ac10f6742
SHA25611f00d48ecd890e9b8658c652a6283ead05dea9bcd641d89d0bd7f0f618f3cd2
SHA512373caadac1ad290d60ea41663482946889ae9e0fea96115e21ba38d19d2bf6123c47501190c3fb33ef51aa07f6dbddc4eab43b82cbc008c4f83684707e1d3510
-
Filesize
827KB
MD5eefb801774c5ccb44153268a9357f5f1
SHA1b1906b22e14edd142c52808ab3e5ba9346b85de5
SHA256677aeb1981c58cba41a5d53ccbbf5b471e62dc49dc326570767da940560d840d
SHA5121cf162fe6184d68dca514059d2de1123e80d0faac401765a54224aa5a987c9454bc92263fbec566835aa7b402f1f63ba59bb425ccc139e0a7391e66991f270b7
-
Filesize
230KB
MD54647720ef8607199527cb3b0bc793587
SHA10728b0cc0fc7e0a1a8ed14c0861f8757780e4163
SHA256349bfc065bf0580379be8c6e0d0dca592deec1bfc104d8d28c70454436de6337
SHA512906baf94232c9f76d193021345259d01e23d81b3d9a948067035979235fd45e739e89b8047148f61d2f210c40e561067a040100ccacebbf8921050f12a0281f8