Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 21:18
Static task
static1
Behavioral task
behavioral1
Sample
9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe
Resource
win7-20220812-en
General
-
Target
9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe
-
Size
345KB
-
MD5
6ea49203166f1850b63635d550283586
-
SHA1
66452419b37aecd2bd6c9d0a3cff50798edf61b9
-
SHA256
9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
-
SHA512
9da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196
-
SSDEEP
6144:+L9qDwTgZKzltsoNeM2wdE2TfRpOu4epdetelUr21JR23JIShC8S:+Ll0ZKzFP2WAYOElLbOa
Malware Config
Extracted
cybergate
v1.07.5
PCmio
carlostutor.no-ip.biz:8080
W8K50KBIH20R0D
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
666666
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Executes dropped EXE 2 IoCs
pid Process 1488 server.exe 1128 server.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB032W65-2O22-Y4E8-D863-4HG27BHO86H5} 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB032W65-2O22-Y4E8-D863-4HG27BHO86H5}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB032W65-2O22-Y4E8-D863-4HG27BHO86H5} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DB032W65-2O22-Y4E8-D863-4HG27BHO86H5}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
resource yara_rule behavioral1/memory/1476-63-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/1476-72-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1936-77-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1936-78-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1476-82-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1476-88-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1092-93-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1092-95-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/1936-110-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1092-111-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe File opened for modification C:\Windows\SysWOW64\install\ 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1504 set thread context of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1488 set thread context of 1128 1488 server.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1936 explorer.exe Token: SeRestorePrivilege 1936 explorer.exe Token: SeBackupPrivilege 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Token: SeRestorePrivilege 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Token: SeDebugPrivilege 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe Token: SeDebugPrivilege 1092 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 1488 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1504 wrote to memory of 1476 1504 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 26 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13 PID 1476 wrote to memory of 1396 1476 9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"C:\Users\Admin\AppData\Local\Temp\9523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1092 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"6⤵
- Executes dropped EXE
PID:1128
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5e52404f08e9187be66bcc9f7092ed35f
SHA1963c4fd2d1adfa52041aea9e4777285f9b30c5ec
SHA2561a2b061f599ec193be7091fffeadb8cb797a3856fcf4f3726f044a819f3b12f4
SHA5128b7c55b97c2440b754d307b2a664bc44bed30c81c266559b329220bdb7ed6449528555f7f2eeca538a7608a6397a9b559a4fef189c78e281179f96be7cd6512b
-
Filesize
345KB
MD56ea49203166f1850b63635d550283586
SHA166452419b37aecd2bd6c9d0a3cff50798edf61b9
SHA2569523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
SHA5129da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196
-
Filesize
345KB
MD56ea49203166f1850b63635d550283586
SHA166452419b37aecd2bd6c9d0a3cff50798edf61b9
SHA2569523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
SHA5129da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196
-
Filesize
345KB
MD56ea49203166f1850b63635d550283586
SHA166452419b37aecd2bd6c9d0a3cff50798edf61b9
SHA2569523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
SHA5129da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196
-
Filesize
345KB
MD56ea49203166f1850b63635d550283586
SHA166452419b37aecd2bd6c9d0a3cff50798edf61b9
SHA2569523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
SHA5129da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196
-
Filesize
345KB
MD56ea49203166f1850b63635d550283586
SHA166452419b37aecd2bd6c9d0a3cff50798edf61b9
SHA2569523f709722096407cf0f190159bd7c8d40feadb6665ba08e3869382d6c626ab
SHA5129da9aec9789a7f1871edabea879643b6bbca5ea29e9af3a2178d996e7a0dd43c45e9fcf231c2ae0c45d5e2fc96ef999a7c69f70a7277a05cef428edaad345196