Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/01/2025, 15:25
250113-st1kpawrdv 1010/01/2025, 12:54
250110-p5j6asxjdk 1028/12/2024, 02:09
241228-clcwnatnby 10Analysis
-
max time kernel
94s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 02:09
Behavioral task
behavioral1
Sample
224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe
Resource
win10v2004-20241007-en
General
-
Target
224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe
-
Size
1.1MB
-
MD5
c1ea7d9d2b92b29bb016dc0c82ce0136
-
SHA1
0490c1a2a2ab084cb03bbb494454380eb0a4063f
-
SHA256
224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0
-
SHA512
51e7c868dd506de81112d18004f2dff73b0ef7a1b7614e94977c9e389919451a3c4bdda2668358999d490ca650a340305674d7c89212a33e8d111a8064a7a116
-
SSDEEP
24576:U2G/nvxW3Ww0tLh6X9jiDf3b8goWoMSCUH0N:UbA30cQoSP
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 112 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 776 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3376 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1332 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4440 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1820 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1008 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1100 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3624 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4092 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5000 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 436 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4384 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1696 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1164 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2652 4848 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 4848 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x000b000000023b9b-10.dat dcrat behavioral2/memory/4184-13-0x0000000000970000-0x0000000000A46000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation hyperserversvc.exe -
Executes dropped EXE 2 IoCs
pid Process 4184 hyperserversvc.exe 3900 csrss.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\conhost.exe hyperserversvc.exe File created C:\Program Files (x86)\Microsoft\088424020bedd6 hyperserversvc.exe File opened for modification C:\Program Files (x86)\Common Files\Java\WmiPrvSE.exe hyperserversvc.exe File created C:\Program Files (x86)\Common Files\Java\24dbde2999530e hyperserversvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe hyperserversvc.exe File created C:\Program Files (x86)\Microsoft\6203df4a6bafc7 hyperserversvc.exe File created C:\Program Files (x86)\Common Files\Java\WmiPrvSE.exe hyperserversvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\886983d96e3d3e hyperserversvc.exe File created C:\Program Files (x86)\Microsoft\lsass.exe hyperserversvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\DiagTrack\Settings\conhost.exe hyperserversvc.exe File created C:\Windows\DiagTrack\Settings\088424020bedd6 hyperserversvc.exe File created C:\Windows\Registration\CRMLog\conhost.exe hyperserversvc.exe File created C:\Windows\Registration\CRMLog\088424020bedd6 hyperserversvc.exe File created C:\Windows\Prefetch\ReadyBoot\WaaSMedicAgent.exe hyperserversvc.exe File created C:\Windows\Prefetch\ReadyBoot\c82b8037eab33d hyperserversvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings hyperserversvc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2652 schtasks.exe 1144 schtasks.exe 1696 schtasks.exe 3984 schtasks.exe 2792 schtasks.exe 1100 schtasks.exe 8 schtasks.exe 776 schtasks.exe 3376 schtasks.exe 1332 schtasks.exe 5000 schtasks.exe 2680 schtasks.exe 1820 schtasks.exe 436 schtasks.exe 4384 schtasks.exe 2288 schtasks.exe 652 schtasks.exe 1068 schtasks.exe 1008 schtasks.exe 4092 schtasks.exe 1968 schtasks.exe 3988 schtasks.exe 1164 schtasks.exe 3624 schtasks.exe 112 schtasks.exe 3288 schtasks.exe 4440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4184 hyperserversvc.exe 4184 hyperserversvc.exe 4184 hyperserversvc.exe 3900 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4184 hyperserversvc.exe Token: SeDebugPrivilege 3900 csrss.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3324 4068 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe 83 PID 4068 wrote to memory of 3324 4068 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe 83 PID 4068 wrote to memory of 3324 4068 224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe 83 PID 3324 wrote to memory of 4248 3324 WScript.exe 91 PID 3324 wrote to memory of 4248 3324 WScript.exe 91 PID 3324 wrote to memory of 4248 3324 WScript.exe 91 PID 4248 wrote to memory of 4184 4248 cmd.exe 93 PID 4248 wrote to memory of 4184 4248 cmd.exe 93 PID 4184 wrote to memory of 2340 4184 hyperserversvc.exe 123 PID 4184 wrote to memory of 2340 4184 hyperserversvc.exe 123 PID 2340 wrote to memory of 1808 2340 cmd.exe 125 PID 2340 wrote to memory of 1808 2340 cmd.exe 125 PID 2340 wrote to memory of 3900 2340 cmd.exe 131 PID 2340 wrote to memory of 3900 2340 cmd.exe 131 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe"C:\Users\Admin\AppData\Local\Temp\224c3666515e1602d6a4c8f6802d8ad2c597951e50cf4938e5ddc849702f1bd0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\crtnet\U4fZxuOVYXKrCZIgxMyzABwsANpU.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\crtnet\Bnw1HgIbKGac.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\crtnet\hyperserversvc.exe"C:\crtnet\hyperserversvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pl0bH09tRv.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1808
-
-
C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe"C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\Java\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Java\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Java\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\crtnet\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\crtnet\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\crtnet\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\DiagTrack\Settings\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Settings\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\DiagTrack\Settings\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Registration\CRMLog\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\CRMLog\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Oracle\Java\.oracle_jre_usage\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225B
MD5ffc50d4b6d671cade8aafd7923d432e9
SHA183936ad073a0eee67a764c01f3833a7d0577e366
SHA256477031392ec4fb166e5d6d952afc938cea90b0d086a41d4ec7d8d8a36dcc4911
SHA5127b39873fcb35e18d7796d83139beb99000384792534742d814c9aeb5f3e029e5868087a50459a672b9628da0126c4aa039efab347ae0cc6fd14961f900b874ad
-
Filesize
30B
MD5ad864158aece2c49b735cb6ddb40c692
SHA142cff4692d777de8a6e5dc42a48b95a00a4f74d0
SHA256d788ee93f4876edfdcc51052ee21680b067fee9071f2efa752608fe39af39c84
SHA512df2ce6df2fc21d23d91f869729c1bb5fbde0079d015d1b44a2679861a30a18b373bcdffe6f399964577a2b8f566d5373958c82e0917aa838b2e3f5705dc8e034
-
Filesize
195B
MD5d1e9f1bc4219b36665be0abca3f62ad2
SHA19ebf784c32f63049b3e39681015ee78350e04ee2
SHA2568736f9684770146460caaf01b7cc432b2dcf9faf5d398b27f9f58cd86d87e978
SHA512aeda85a9a5548a6eb44eb92c9839aa98e3e9932d9d0deb6a4fa9ec603438c85b38c1ab295cd10035b54e65453dd19da685457c82241caa369551df0ec75b2787
-
Filesize
828KB
MD5915963963f2bfe83c2f1a3a50cf042ca
SHA15b7ccdc34d46ff3d25752ae9f73ae6649e9ef791
SHA25628c32ebbf807cd3ed0a35ead7bef99665da102a85bdfe0f91cf7f92d167dfd40
SHA5127509a3ba3258848851c5315eecb1105ec10018c1012c244531a6250bcab84196378bd1fa9374c92ee3fa66f96433ddd17929875f37d2b272a97389abb6aa39b4