Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2023, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe
Resource
win10v2004-20230220-en
General
-
Target
bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe
-
Size
1.1MB
-
MD5
b23203154afacedf05e93cf1e3abae42
-
SHA1
c521a29f79cec20f1178c71ac846d071aa7313b8
-
SHA256
bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827
-
SHA512
8718a75ba665e2a01726cc89342bb464ffaf936dabf86e180f5b933a0e6dbfbecb1c6cc98298abb1e08c423017c8a320a29117b78eb17ccb7f282521e37ceee3
-
SSDEEP
12288:3Mrhy90uDoRW0yuOWS03R99QQMBvjdn6B7E6Q2SCDJ0JFSjSYOjkoXFTyY+g2KLk:GymNvZ+RjdnISbJ5tR1Tylg2Kldvpa
Malware Config
Extracted
redline
demis
185.161.248.25:4132
-
auth_value
8a9a54cb72dc3d7ab6792d3a28b3d1e1
Extracted
redline
naher
185.161.248.25:4132
-
auth_value
91f06fcf80f600c56b2797e1c73d214d
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k9886929.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k9886929.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k9886929.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k9886929.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k9886929.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k9886929.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation m7445108.exe -
Executes dropped EXE 10 IoCs
pid Process 4556 y7200994.exe 4488 y5359964.exe 4060 k9886929.exe 344 l7307316.exe 1948 m7445108.exe 3284 m7445108.exe 716 n3287562.exe 3156 oneetx.exe 2308 n3287562.exe 3380 oneetx.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k9886929.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k9886929.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y7200994.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y5359964.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y5359964.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y7200994.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1948 set thread context of 3284 1948 m7445108.exe 87 PID 716 set thread context of 2308 716 n3287562.exe 89 PID 3156 set thread context of 3380 3156 oneetx.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2008 3380 WerFault.exe 91 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4060 k9886929.exe 4060 k9886929.exe 344 l7307316.exe 344 l7307316.exe 2308 n3287562.exe 2308 n3287562.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4060 k9886929.exe Token: SeDebugPrivilege 344 l7307316.exe Token: SeDebugPrivilege 1948 m7445108.exe Token: SeDebugPrivilege 716 n3287562.exe Token: SeDebugPrivilege 3156 oneetx.exe Token: SeDebugPrivilege 2308 n3287562.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3284 m7445108.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3380 oneetx.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4556 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 82 PID 3688 wrote to memory of 4556 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 82 PID 3688 wrote to memory of 4556 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 82 PID 4556 wrote to memory of 4488 4556 y7200994.exe 83 PID 4556 wrote to memory of 4488 4556 y7200994.exe 83 PID 4556 wrote to memory of 4488 4556 y7200994.exe 83 PID 4488 wrote to memory of 4060 4488 y5359964.exe 84 PID 4488 wrote to memory of 4060 4488 y5359964.exe 84 PID 4488 wrote to memory of 4060 4488 y5359964.exe 84 PID 4488 wrote to memory of 344 4488 y5359964.exe 85 PID 4488 wrote to memory of 344 4488 y5359964.exe 85 PID 4488 wrote to memory of 344 4488 y5359964.exe 85 PID 4556 wrote to memory of 1948 4556 y7200994.exe 86 PID 4556 wrote to memory of 1948 4556 y7200994.exe 86 PID 4556 wrote to memory of 1948 4556 y7200994.exe 86 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 1948 wrote to memory of 3284 1948 m7445108.exe 87 PID 3688 wrote to memory of 716 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 88 PID 3688 wrote to memory of 716 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 88 PID 3688 wrote to memory of 716 3688 bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe 88 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 3284 wrote to memory of 3156 3284 m7445108.exe 90 PID 3284 wrote to memory of 3156 3284 m7445108.exe 90 PID 3284 wrote to memory of 3156 3284 m7445108.exe 90 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 716 wrote to memory of 2308 716 n3287562.exe 89 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91 PID 3156 wrote to memory of 3380 3156 oneetx.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe"C:\Users\Admin\AppData\Local\Temp\bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:344
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe6⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 127⤵
- Program crash
PID:2008
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3380 -ip 33801⤵PID:4832
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
Filesize
904KB
MD569cc8c9877787beb1664390c375f7456
SHA18d81dab4b096e8f00810441d823290142bea6ecd
SHA256aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e
SHA512ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6
-
Filesize
904KB
MD569cc8c9877787beb1664390c375f7456
SHA18d81dab4b096e8f00810441d823290142bea6ecd
SHA256aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e
SHA512ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6
-
Filesize
904KB
MD569cc8c9877787beb1664390c375f7456
SHA18d81dab4b096e8f00810441d823290142bea6ecd
SHA256aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e
SHA512ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6
-
Filesize
750KB
MD5f30c42b499ce3dbe49a27f7c9bff07f3
SHA121e8959d7c41a25e2afb2c1e40989d3dd878f9a5
SHA2564dfd4a0d556cdf045371a66e8749e3d10803dbadcbb9f4e28bc9ca6a86986161
SHA51228c2a8ee4fdeb548ee225a33a9c025ef74db4e764bec9af38f8a4180de1b17834845b9482754ee40cff79735104f3feb7e1b7017131106678d63d7e23586f2d4
-
Filesize
750KB
MD5f30c42b499ce3dbe49a27f7c9bff07f3
SHA121e8959d7c41a25e2afb2c1e40989d3dd878f9a5
SHA2564dfd4a0d556cdf045371a66e8749e3d10803dbadcbb9f4e28bc9ca6a86986161
SHA51228c2a8ee4fdeb548ee225a33a9c025ef74db4e764bec9af38f8a4180de1b17834845b9482754ee40cff79735104f3feb7e1b7017131106678d63d7e23586f2d4
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
306KB
MD59a062271871c043089ef349c7b7c9120
SHA1cb5f06549051f5cfa689bb0d4dbc03307872be28
SHA256bfc086ad976de72ac457bf89b9e65dea6e19e0d64c33807d912537347bc2abc2
SHA5129456705d84ce84a67a332f8f0e74c1adba82036c46a0dcbbe536c0793cdabf6e3f351657a78a28b3ffe430772f8cd3f8412c55d50fe72eb754fe25508934ee85
-
Filesize
306KB
MD59a062271871c043089ef349c7b7c9120
SHA1cb5f06549051f5cfa689bb0d4dbc03307872be28
SHA256bfc086ad976de72ac457bf89b9e65dea6e19e0d64c33807d912537347bc2abc2
SHA5129456705d84ce84a67a332f8f0e74c1adba82036c46a0dcbbe536c0793cdabf6e3f351657a78a28b3ffe430772f8cd3f8412c55d50fe72eb754fe25508934ee85
-
Filesize
185KB
MD59389155bd175d89124038b97ebb26ab0
SHA1069ef9bf389efd2b023a73f7bebbf0a86c32eacd
SHA256bcc5468b8a2f29d3fe707f17c0bf93a6d60d94f72ade83df85c18de9cafe3498
SHA51227dbbdcc3e4a85f99e375bd19336f20227a78a985e0b09c0152fce42b30aab4d16c90bedc476738145756bfb0ce91674e75bd31851fbd911cdceb8698488c60f
-
Filesize
185KB
MD59389155bd175d89124038b97ebb26ab0
SHA1069ef9bf389efd2b023a73f7bebbf0a86c32eacd
SHA256bcc5468b8a2f29d3fe707f17c0bf93a6d60d94f72ade83df85c18de9cafe3498
SHA51227dbbdcc3e4a85f99e375bd19336f20227a78a985e0b09c0152fce42b30aab4d16c90bedc476738145756bfb0ce91674e75bd31851fbd911cdceb8698488c60f
-
Filesize
145KB
MD5470d3ad1256745024e705ea3c9f3c59b
SHA1dd6bc2d3c5412e493cd160226f5a375110ba6e56
SHA256be5d97e37edfced7c80754336516c3cebb85f76e0a908fe6853989a463d79501
SHA512eb8e86cbb129d77d94716084acc7836a72e3475d2eaeceeb17a2ddd2008e73e872253360613ed7a7d93c9aa94dc978553fcd0a1faa9b8451452be06309572199
-
Filesize
145KB
MD5470d3ad1256745024e705ea3c9f3c59b
SHA1dd6bc2d3c5412e493cd160226f5a375110ba6e56
SHA256be5d97e37edfced7c80754336516c3cebb85f76e0a908fe6853989a463d79501
SHA512eb8e86cbb129d77d94716084acc7836a72e3475d2eaeceeb17a2ddd2008e73e872253360613ed7a7d93c9aa94dc978553fcd0a1faa9b8451452be06309572199
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb
-
Filesize
963KB
MD57ea038cff79134b390d19c9c9c8f19f9
SHA1aab0eee8edde660f08f304bbccd4020e9c463c17
SHA256cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954
SHA51258f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb