Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 00:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
General
-
Target
8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe
-
Size
1.5MB
-
MD5
2a4364298a4c39150726789ed6f8b761
-
SHA1
3db55edbf09535eff8e55fdee7b6b96e9cf7e1ae
-
SHA256
8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa
-
SHA512
70e1ffc70437f10cbfb660de42f2cb525af06c497b60afd261dce3add158d27ec0d87361163580c79feaabf17b174596688bcc360b042e221b067fe88ab04e54
-
SSDEEP
24576:hFQeYLbKKEPS1bvKE2JCavnObjq2R19fiMFOWExOYww4r:hFQzKKEP2biE2JCavnOnT9fbkCYTI
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
choco378787.no-ip.biz:1606
Mutex
DC_MUTEX-9SWT19V
Attributes
-
gencode
6jeW0kHnheiZ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qAe77Jk = "C:\\Users\\Admin\\iSt28Sz\\svchost.exe.exe" 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key deleted \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\y: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\a: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\e: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\m: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\s: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\t: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\h: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\j: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\n: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\r: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\x: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\b: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\g: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\i: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\q: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\v: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\z: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\k: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\l: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\o: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\p: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe File opened (read-only) \??\w: 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4844 set thread context of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeIncreaseQuotaPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeSecurityPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeTakeOwnershipPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeLoadDriverPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeSystemProfilePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeSystemtimePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeProfSingleProcessPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeIncBasePriorityPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeCreatePagefilePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeBackupPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeRestorePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeShutdownPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeDebugPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeSystemEnvironmentPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeChangeNotifyPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeRemoteShutdownPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeUndockPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeManageVolumePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeImpersonatePrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: SeCreateGlobalPrivilege 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: 33 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: 34 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: 35 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe Token: 36 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4728 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86 PID 4844 wrote to memory of 4728 4844 8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe"C:\Users\Admin\AppData\Local\Temp\8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe"C:\Users\Admin\AppData\Local\Temp\8e62ca1802bb4f7510305c74defe9521a0fbc3d4884a2460dfb6f3bfaec34faa.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
662KB
MD517acb6bd3357d69307a24b344df505fa
SHA11ef133d1088e2a43262323ff96156888837e2fa3
SHA256093b83fea21e1cb9f474f9322147c3b41c28dfc6dcbef187e8c1f088d03cd219
SHA51217762f240f94806a4533667702dd147d1203273b3e53b210ec5c791e25bea8e6272e8aedba02fdfb5ddcfe5ed581ca4da6c65367d677965afbc2007e9ecbbafc