Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 11:17
Behavioral task
behavioral1
Sample
6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe
-
Size
941KB
-
MD5
da438e70421f3aba0c8f797111208327
-
SHA1
ddae71afdcb1cf566c8348314feba24f9bf943ab
-
SHA256
6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5
-
SHA512
2b196df7b5df7cad8f91a57911a1c8cbc51ef79dbb6bc2b5449ed151c1f5189d6de32181f0f9f1c60b323feabbeca866ff1581177bb70c2b020346a7f0781856
-
SSDEEP
24576:YNGsFQuK47Uh2CubV4+TQzJcrPes0pFQ97vbUkKAjG:Y8sFQ3pqbq+TYJcrW1FUj
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\pkl.dll 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44492B01-5DE1-11ED-BD84-7E4CDA66D2DC} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000d797a2c5016964731a11eaa23f6d10fb8ea8d867a3b41fa736f61d0124555506000000000e8000000002000020000000ab3599a20ad5680b1c93248dea9c86077688f4b804d06b59353fec5391a85c2d2000000068ededaaae030e77cc9496ef58afb2db00fc2ba8086407d3a20274ce0290a3ef40000000d129b63eb03e9b1fada050920bfad56c1e5b02025e5a46b14e4659de176a6a059ca6ab818713cb4e96246dc425e0aeea1584b7dbf1e7cff2bec289878fd92857 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000eca6e7e04a8522001f868c3e2e8dc11b340ad0e69c0da963283148df29d1f1c9000000000e8000000002000020000000bc8b60ce3affa5bb8ef0e11639c0638657c404da1dd9a64adaf0bf1c3b82a7c490000000de8bab81f231bd2f14e48c831e6def9408ac00711f30f0136c854a294225e27fe7cc692f5087ed266df99c00cba41051ba9739837da6b7d91ac392c8c75bc3a2dcdf536c6feef15922576fa10a78ee432cdc93bca68b5e11e203e1202e2ba4f84bb9150dbe5c3dd5e8582415136e9d2915b70e9ce258d739cc940878a9cfc5df5a0e0a96eaa0f560dd58387862c20e804000000004aef942fcb2f9a3d39779c6e4a0ecb6b029f4c3e951f3713f592395baf83b3dcfab0b4a2e75f7f67affa693b579a6be26b4e2bd6ae99e7240d649fb7a42ba6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e83717eef1d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44495211-5DE1-11ED-BD84-7E4CDA66D2DC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374510737" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1296 iexplore.exe 1396 iexplore.exe 1396 iexplore.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 1296 iexplore.exe 1396 iexplore.exe 1296 iexplore.exe 1396 iexplore.exe 620 IEXPLORE.EXE 620 IEXPLORE.EXE 1488 IEXPLORE.EXE 1488 IEXPLORE.EXE 1396 iexplore.exe 1396 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 1632 IEXPLORE.EXE 1632 IEXPLORE.EXE 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1296 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 28 PID 1968 wrote to memory of 1296 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 28 PID 1968 wrote to memory of 1296 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 28 PID 1968 wrote to memory of 1296 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 28 PID 1968 wrote to memory of 1396 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 29 PID 1968 wrote to memory of 1396 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 29 PID 1968 wrote to memory of 1396 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 29 PID 1968 wrote to memory of 1396 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 29 PID 1296 wrote to memory of 620 1296 iexplore.exe 31 PID 1396 wrote to memory of 1488 1396 iexplore.exe 32 PID 1396 wrote to memory of 1488 1396 iexplore.exe 32 PID 1396 wrote to memory of 1488 1396 iexplore.exe 32 PID 1396 wrote to memory of 1488 1396 iexplore.exe 32 PID 1296 wrote to memory of 620 1296 iexplore.exe 31 PID 1296 wrote to memory of 620 1296 iexplore.exe 31 PID 1296 wrote to memory of 620 1296 iexplore.exe 31 PID 1968 wrote to memory of 1924 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 34 PID 1968 wrote to memory of 1924 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 34 PID 1968 wrote to memory of 1924 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 34 PID 1968 wrote to memory of 1924 1968 6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe 34 PID 1296 wrote to memory of 1632 1296 iexplore.exe 36 PID 1296 wrote to memory of 1632 1296 iexplore.exe 36 PID 1296 wrote to memory of 1632 1296 iexplore.exe 36 PID 1296 wrote to memory of 1632 1296 iexplore.exe 36 PID 1396 wrote to memory of 1072 1396 iexplore.exe 37 PID 1396 wrote to memory of 1072 1396 iexplore.exe 37 PID 1396 wrote to memory of 1072 1396 iexplore.exe 37 PID 1396 wrote to memory of 1072 1396 iexplore.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe"C:\Users\Admin\AppData\Local\Temp\6045f4c84d9884ced4863591d4f5d1de92b5473ff71e221a0992b730565f38f5.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.pekalongan-kommunity.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:620
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:603143 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://goo.gl/VTRUf72⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1488
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:537603 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1072
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.pekalongan-kommunity.com/2⤵PID:1924
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD51e7ebd9baeb8ea5c970f44bc8abd107b
SHA18b0c9d384721c284c7bbdab48aada1112e33c09b
SHA256aab011a7c46819f4f2af0f3691a591e3b1e7d395f78a926123d8f370eac71843
SHA5127a2e9b051cb658ef8c6ecb71b6364e452e4e6706adb894799c2ecf67c0a535420113f95260b26bd08c2cc6663d9ec6dc463ce061554198bfd7c70ec270e96abc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{44492B01-5DE1-11ED-BD84-7E4CDA66D2DC}.dat
Filesize3KB
MD5bd9102e72937ce4260c0d90c18b1a541
SHA1c3faa9464bb6d6d691a35345c1b9cdecc0dc17d8
SHA2567d6ea21a2338669a6d6c3164708293969b3574680fc2dbc6d5969ca350c646d6
SHA51275946d1cedb21afe19af894272fad78a337cdf5870a76b24350539080f215f0769109e7496b838d1ec614c4bc8f3904be78c82f4a7c58cce1c9dfb5057352dfe
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{44495211-5DE1-11ED-BD84-7E4CDA66D2DC}.dat
Filesize5KB
MD5e64d589333d66d832ce60df425aa884e
SHA1bc0356d25343e5d3807fb80d4523922c01666566
SHA256dcf5b94788d40503f82a0f4b4e802146084ed413ff0d588906d5bd321116051a
SHA51213badf2d972ac25f578c52e3db4e8174001f8dbb4347f3a1df577bbff308567be33ea1e20ba1318061d128be3f6b70b2a0046a79a6be7dded99057931c691fd7
-
Filesize
603B
MD5ad5e9dc82ad013c4be5a2f54145266e8
SHA17428eea944a27cc01345ae78eb426dabd9dfcb25
SHA256a1ffd5f07574c61f0244b0bc9cdbb0489a7ba59c56cc5014eb50cff14fa50461
SHA512ff33b09323123bebcf7c821d3d3fd3aff837b4e2b74db81b667dd66e11009d52da644f7f6fd793457315618336d16517ed760192de48067adec24e8b5e67276a