Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2023, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe
Resource
win10v2004-20230220-en
General
-
Target
63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe
-
Size
731KB
-
MD5
7f0752bddcf87cbf4afe0be56071270d
-
SHA1
7fff8faf0690d0040d54e72c87c4d26cb2ffb0ef
-
SHA256
63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558
-
SHA512
a44cf9388f8592fc4287973a72a14ed09df3a91160335fa11a2730f4edd1fe74f677348d41cea868bbaf2e2dec50bc3dd0c9dbd3104fd68b941aec665b482f51
-
SSDEEP
12288:d6dXxiiXlaX8tyT1t0Dw+60hOd2L4CUPKgCPsZ+vIjGUlQsh3:daBiawZkw+6iOG4ygCPWQIjG4Fh3
Malware Config
Extracted
redline
vina
193.233.20.28:4125
-
auth_value
7e90e85c9cea0965a2bfd23e1cfc6bc8
Extracted
amadey
3.68
31.41.244.200/games/category/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bus8956.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bus8956.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" con3920.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection bus8956.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bus8956.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bus8956.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bus8956.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation en894441.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation metafor.exe -
Executes dropped EXE 8 IoCs
pid Process 3520 film0968.exe 400 film3390.exe 4924 bus8956.exe 3588 con3920.exe 3760 dry40s70.exe 4880 en894441.exe 4776 metafor.exe 992 metafor.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" con3920.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" bus8956.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" film0968.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce film3390.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" film3390.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce film0968.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3080 3588 WerFault.exe 93 3884 1336 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2140 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4924 bus8956.exe 4924 bus8956.exe 3588 con3920.exe 3588 con3920.exe 3760 dry40s70.exe 3760 dry40s70.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4924 bus8956.exe Token: SeDebugPrivilege 3588 con3920.exe Token: SeDebugPrivilege 3760 dry40s70.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1336 wrote to memory of 3520 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 85 PID 1336 wrote to memory of 3520 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 85 PID 1336 wrote to memory of 3520 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 85 PID 3520 wrote to memory of 400 3520 film0968.exe 86 PID 3520 wrote to memory of 400 3520 film0968.exe 86 PID 3520 wrote to memory of 400 3520 film0968.exe 86 PID 400 wrote to memory of 4924 400 film3390.exe 87 PID 400 wrote to memory of 4924 400 film3390.exe 87 PID 400 wrote to memory of 3588 400 film3390.exe 93 PID 400 wrote to memory of 3588 400 film3390.exe 93 PID 400 wrote to memory of 3588 400 film3390.exe 93 PID 3520 wrote to memory of 3760 3520 film0968.exe 96 PID 3520 wrote to memory of 3760 3520 film0968.exe 96 PID 3520 wrote to memory of 3760 3520 film0968.exe 96 PID 1336 wrote to memory of 4880 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 100 PID 1336 wrote to memory of 4880 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 100 PID 1336 wrote to memory of 4880 1336 63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe 100 PID 4880 wrote to memory of 4776 4880 en894441.exe 101 PID 4880 wrote to memory of 4776 4880 en894441.exe 101 PID 4880 wrote to memory of 4776 4880 en894441.exe 101 PID 4776 wrote to memory of 2140 4776 metafor.exe 104 PID 4776 wrote to memory of 2140 4776 metafor.exe 104 PID 4776 wrote to memory of 2140 4776 metafor.exe 104 PID 4776 wrote to memory of 1508 4776 metafor.exe 106 PID 4776 wrote to memory of 1508 4776 metafor.exe 106 PID 4776 wrote to memory of 1508 4776 metafor.exe 106 PID 1508 wrote to memory of 528 1508 cmd.exe 108 PID 1508 wrote to memory of 528 1508 cmd.exe 108 PID 1508 wrote to memory of 528 1508 cmd.exe 108 PID 1508 wrote to memory of 432 1508 cmd.exe 109 PID 1508 wrote to memory of 432 1508 cmd.exe 109 PID 1508 wrote to memory of 432 1508 cmd.exe 109 PID 1508 wrote to memory of 4348 1508 cmd.exe 110 PID 1508 wrote to memory of 4348 1508 cmd.exe 110 PID 1508 wrote to memory of 4348 1508 cmd.exe 110 PID 1508 wrote to memory of 2176 1508 cmd.exe 111 PID 1508 wrote to memory of 2176 1508 cmd.exe 111 PID 1508 wrote to memory of 2176 1508 cmd.exe 111 PID 1508 wrote to memory of 1332 1508 cmd.exe 112 PID 1508 wrote to memory of 1332 1508 cmd.exe 112 PID 1508 wrote to memory of 1332 1508 cmd.exe 112 PID 1508 wrote to memory of 4436 1508 cmd.exe 113 PID 1508 wrote to memory of 4436 1508 cmd.exe 113 PID 1508 wrote to memory of 4436 1508 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe"C:\Users\Admin\AppData\Local\Temp\63f255b6099515b7a3a4d65aa37f6a205bac9373a1fdd8e5f3521ae97d0b3558.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film0968.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\film0968.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\film3390.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\film3390.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bus8956.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bus8956.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\con3920.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\con3920.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 10805⤵
- Program crash
PID:3080
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry40s70.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry40s70.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en894441.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en894441.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metafor.exe /TR "C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe" /F4⤵
- Creates scheduled task(s)
PID:2140
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metafor.exe" /P "Admin:N"&&CACLS "metafor.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5975271bda" /P "Admin:N"&&CACLS "..\5975271bda" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:528
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:N"5⤵PID:432
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "metafor.exe" /P "Admin:R" /E5⤵PID:4348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2176
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:N"5⤵PID:1332
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5975271bda" /P "Admin:R" /E5⤵PID:4436
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 5322⤵
- Program crash
PID:3884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3588 -ip 35881⤵PID:976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1336 -ip 13361⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exeC:\Users\Admin\AppData\Local\Temp\5975271bda\metafor.exe1⤵
- Executes dropped EXE
PID:992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
226KB
MD58627ebe3777cc777ed2a14b907162224
SHA106eeed93eb3094f9d0b13ac4a6936f7088fbbdaa
SHA256319b22945beeb7424fe6db1e9953ad5f2dc12cbba2fe24e599c3deda678893bb
SHA5129de429300c95d52452caeb80c9d44ff72714f017319e416649c2100f882c394f5ab9f3876cc68d338f4b5a3cd58337defff9405be64c87d078edd0d86259c845
-
Filesize
463KB
MD5ab98f0a23e34e41d60e3981b396bcfe8
SHA1d72f31c12ea1dc73ad564d8286d5b7f1a5c480c6
SHA25633adc9f681877d4394db053315c8c60675e0ddcf3a6757dcebd029cbadb0c73c
SHA512707b4d5cef562c6989c18fd9ea3089404a30e88487425473a93e44fcf400def6b98917f111bd1a383877ad929af828d17f9ec0814ff209bbd9a6e7a88ba6b083
-
Filesize
463KB
MD5ab98f0a23e34e41d60e3981b396bcfe8
SHA1d72f31c12ea1dc73ad564d8286d5b7f1a5c480c6
SHA25633adc9f681877d4394db053315c8c60675e0ddcf3a6757dcebd029cbadb0c73c
SHA512707b4d5cef562c6989c18fd9ea3089404a30e88487425473a93e44fcf400def6b98917f111bd1a383877ad929af828d17f9ec0814ff209bbd9a6e7a88ba6b083
-
Filesize
175KB
MD59796505f0e48281006d920d7c01dfe7b
SHA1409d6a3760f682cc6e10c4f63e16755081d1342e
SHA256acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479
SHA512c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72
-
Filesize
175KB
MD59796505f0e48281006d920d7c01dfe7b
SHA1409d6a3760f682cc6e10c4f63e16755081d1342e
SHA256acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479
SHA512c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72
-
Filesize
320KB
MD53eab9fb9dabff63301055cee511946b9
SHA149947ab52b7407a5bd2035d6e3c4973476c36775
SHA2567d9795f3ad12f86eda5156134b0735f70d6385105cf7e538c4f370be3d26f3f8
SHA5121b74da72dc502fa5d10b55603ce29132a4443356cda915e51bf776f05a4108cb00a691b5e4e3690be0ad4f2f890b274c0a1a6f28ec00b2d5e60ecc89952c9f03
-
Filesize
320KB
MD53eab9fb9dabff63301055cee511946b9
SHA149947ab52b7407a5bd2035d6e3c4973476c36775
SHA2567d9795f3ad12f86eda5156134b0735f70d6385105cf7e538c4f370be3d26f3f8
SHA5121b74da72dc502fa5d10b55603ce29132a4443356cda915e51bf776f05a4108cb00a691b5e4e3690be0ad4f2f890b274c0a1a6f28ec00b2d5e60ecc89952c9f03
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
244KB
MD58c3da4fde67dab8fea04b4af2c764a5a
SHA1181e260267b830693a5d248437132266598791c5
SHA256bc0f0235f08fe97304b69898987b9561e9d27d87a1186e09420c4a9268fe9cde
SHA51282a156856083f983cea73170a05f6d628553345fbeecf3cb3bd0d7d3bdf2e7a36cde738a8b7fbb69562c43f2b30a284718d6c14c824725cbc31dbe86f8899348
-
Filesize
244KB
MD58c3da4fde67dab8fea04b4af2c764a5a
SHA1181e260267b830693a5d248437132266598791c5
SHA256bc0f0235f08fe97304b69898987b9561e9d27d87a1186e09420c4a9268fe9cde
SHA51282a156856083f983cea73170a05f6d628553345fbeecf3cb3bd0d7d3bdf2e7a36cde738a8b7fbb69562c43f2b30a284718d6c14c824725cbc31dbe86f8899348