Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2023, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe
Resource
win10v2004-20220812-en
General
-
Target
bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe
-
Size
724KB
-
MD5
58fb8f1de6fd72b8bd70fec491c82d9f
-
SHA1
57b94454411933ee426a92caccbda1d2ee1e7111
-
SHA256
bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de
-
SHA512
421732608584150c4c60e11fe6acaf950633bc9dc03fb18cae3487b480edee0814d38bab18b7d6c991c9388546bcd23d4a88fdd858a2b6368678bedff1ee3ba9
-
SSDEEP
12288:aMrFy90sXdu5RCJEQ6iL43GguCicpvj59qtLS8sZo+ee83EqIvg:7yptxjL43FicBmo9ZoTe83ENI
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Extracted
amadey
3.66
193.233.20.4/t6r48nSa/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" iHw91JK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" iHw91JK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" iHw91JK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" iHw91JK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" iHw91JK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection iHw91JK.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation nVj65zm.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 9 IoCs
pid Process 2468 sxN48qS.exe 2404 sxL14RK.exe 4108 iHw91JK.exe 4976 kmV92oi.exe 3512 lMh40va.exe 3932 nVj65zm.exe 4700 mnolyk.exe 4916 mnolyk.exe 4800 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 3988 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iHw91JK.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sxN48qS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sxN48qS.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sxL14RK.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sxL14RK.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4108 iHw91JK.exe 4108 iHw91JK.exe 4976 kmV92oi.exe 4976 kmV92oi.exe 3512 lMh40va.exe 3512 lMh40va.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4108 iHw91JK.exe Token: SeDebugPrivilege 4976 kmV92oi.exe Token: SeDebugPrivilege 3512 lMh40va.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2468 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 79 PID 2180 wrote to memory of 2468 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 79 PID 2180 wrote to memory of 2468 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 79 PID 2468 wrote to memory of 2404 2468 sxN48qS.exe 80 PID 2468 wrote to memory of 2404 2468 sxN48qS.exe 80 PID 2468 wrote to memory of 2404 2468 sxN48qS.exe 80 PID 2404 wrote to memory of 4108 2404 sxL14RK.exe 81 PID 2404 wrote to memory of 4108 2404 sxL14RK.exe 81 PID 2404 wrote to memory of 4976 2404 sxL14RK.exe 82 PID 2404 wrote to memory of 4976 2404 sxL14RK.exe 82 PID 2404 wrote to memory of 4976 2404 sxL14RK.exe 82 PID 2468 wrote to memory of 3512 2468 sxN48qS.exe 85 PID 2468 wrote to memory of 3512 2468 sxN48qS.exe 85 PID 2468 wrote to memory of 3512 2468 sxN48qS.exe 85 PID 2180 wrote to memory of 3932 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 86 PID 2180 wrote to memory of 3932 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 86 PID 2180 wrote to memory of 3932 2180 bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe 86 PID 3932 wrote to memory of 4700 3932 nVj65zm.exe 87 PID 3932 wrote to memory of 4700 3932 nVj65zm.exe 87 PID 3932 wrote to memory of 4700 3932 nVj65zm.exe 87 PID 4700 wrote to memory of 2720 4700 mnolyk.exe 88 PID 4700 wrote to memory of 2720 4700 mnolyk.exe 88 PID 4700 wrote to memory of 2720 4700 mnolyk.exe 88 PID 4700 wrote to memory of 1692 4700 mnolyk.exe 90 PID 4700 wrote to memory of 1692 4700 mnolyk.exe 90 PID 4700 wrote to memory of 1692 4700 mnolyk.exe 90 PID 1692 wrote to memory of 3204 1692 cmd.exe 92 PID 1692 wrote to memory of 3204 1692 cmd.exe 92 PID 1692 wrote to memory of 3204 1692 cmd.exe 92 PID 1692 wrote to memory of 3844 1692 cmd.exe 93 PID 1692 wrote to memory of 3844 1692 cmd.exe 93 PID 1692 wrote to memory of 3844 1692 cmd.exe 93 PID 1692 wrote to memory of 2592 1692 cmd.exe 94 PID 1692 wrote to memory of 2592 1692 cmd.exe 94 PID 1692 wrote to memory of 2592 1692 cmd.exe 94 PID 1692 wrote to memory of 3864 1692 cmd.exe 95 PID 1692 wrote to memory of 3864 1692 cmd.exe 95 PID 1692 wrote to memory of 3864 1692 cmd.exe 95 PID 1692 wrote to memory of 4884 1692 cmd.exe 96 PID 1692 wrote to memory of 4884 1692 cmd.exe 96 PID 1692 wrote to memory of 4884 1692 cmd.exe 96 PID 1692 wrote to memory of 5096 1692 cmd.exe 97 PID 1692 wrote to memory of 5096 1692 cmd.exe 97 PID 1692 wrote to memory of 5096 1692 cmd.exe 97 PID 4700 wrote to memory of 3988 4700 mnolyk.exe 99 PID 4700 wrote to memory of 3988 4700 mnolyk.exe 99 PID 4700 wrote to memory of 3988 4700 mnolyk.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe"C:\Users\Admin\AppData\Local\Temp\bfb32eb266d8c4191b05f8bc9b004fd576f79e1c98fc020a750c837ee6e458de.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxN48qS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxN48qS.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxL14RK.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxL14RK.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iHw91JK.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iHw91JK.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kmV92oi.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kmV92oi.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lMh40va.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lMh40va.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVj65zm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nVj65zm.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:2720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3204
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:3844
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:2592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3864
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:4884
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:5096
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3988
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:4916
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:4800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
538KB
MD59d98217782795c17d1f4ac4ead1be3dc
SHA105fa9a2bda6a99a534dc4bdde9d5967160fbd653
SHA256a9c3baad72815c63fa8a71534a13c26b6b705f01a6d57e51a8b3004541266af0
SHA51204d58075b88521a40e60f2e412f68ed1e8b7578cd65266b789a4a6b215d19ad23622292dc767ab080c6f3073a51fba4e0b15b71432ba850c4cc1b957b234b5a1
-
Filesize
538KB
MD59d98217782795c17d1f4ac4ead1be3dc
SHA105fa9a2bda6a99a534dc4bdde9d5967160fbd653
SHA256a9c3baad72815c63fa8a71534a13c26b6b705f01a6d57e51a8b3004541266af0
SHA51204d58075b88521a40e60f2e412f68ed1e8b7578cd65266b789a4a6b215d19ad23622292dc767ab080c6f3073a51fba4e0b15b71432ba850c4cc1b957b234b5a1
-
Filesize
306KB
MD5e3bd469e3fd01ab3983d387a7f7c9074
SHA12f1b1a7599ec24688b797675477acdb121eb910d
SHA256301891941f3791dcf7239324e82bba9b891ab4fcc53c27f0944a775db3a66e61
SHA512782fbc92de0384d98f3e5b6831e608853640e41f264e5449c1a95343c80e39e1bdf1d039b83246a8f90aba37db306a14cf4ea3d51e7bf95ba8ae9fe62bb0d6db
-
Filesize
306KB
MD5e3bd469e3fd01ab3983d387a7f7c9074
SHA12f1b1a7599ec24688b797675477acdb121eb910d
SHA256301891941f3791dcf7239324e82bba9b891ab4fcc53c27f0944a775db3a66e61
SHA512782fbc92de0384d98f3e5b6831e608853640e41f264e5449c1a95343c80e39e1bdf1d039b83246a8f90aba37db306a14cf4ea3d51e7bf95ba8ae9fe62bb0d6db
-
Filesize
202KB
MD5b9ef6eee956ec6d2bf357dacdf94f088
SHA10b4b4fb852210de6e98fd88e17b9b6de06fc999a
SHA256757d0fcdfcdf18530a429d7ff0c754c5c3b97b5450e55872ec935394e4574141
SHA5127d50bcdecb3a945fc0d7e29292326e8a65ba17a5ca004edb5964b55acab41a26a9ac9feb692bb3dc988bfaca687349eafaaab0c179ee9fe16c3e9110e22d656b
-
Filesize
202KB
MD5b9ef6eee956ec6d2bf357dacdf94f088
SHA10b4b4fb852210de6e98fd88e17b9b6de06fc999a
SHA256757d0fcdfcdf18530a429d7ff0c754c5c3b97b5450e55872ec935394e4574141
SHA5127d50bcdecb3a945fc0d7e29292326e8a65ba17a5ca004edb5964b55acab41a26a9ac9feb692bb3dc988bfaca687349eafaaab0c179ee9fe16c3e9110e22d656b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38