Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe
Resource
win10v2004-20230703-en
General
-
Target
8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe
-
Size
730KB
-
MD5
4020c02ac90eb8282ed60a764e8a8c5b
-
SHA1
9cee178c583a9142d66fea7a6901193584a7720d
-
SHA256
8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b
-
SHA512
238520f3c3e263e89ce2768ba8c1ea925f3ff933c2635a819c318207b1e0abf8eecc646c53698e71e340ecb243295e0d78ad67c3496885a7f8f788f39ed1e3d8
-
SSDEEP
12288:JMrOy90Rdeuz8QNg8qvqa5/2zgnE4TPDGor8B6cl6EfwaVNJ7topw:HyBogb9uEnE4TPDGorwZlISNJ7mm
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
maga
77.91.124.54:19071
-
auth_value
9dd7a0be219be9b6228dc9b4e112b812
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x00070000000230cf-159.dat healer behavioral1/files/0x00070000000230cf-160.dat healer behavioral1/memory/3780-161-0x0000000000DC0000-0x0000000000DCA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l6225722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l6225722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l6225722.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection l6225722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l6225722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l6225722.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 1380 y1789497.exe 396 y4669625.exe 4244 y0094091.exe 3780 l6225722.exe 3960 m3524640.exe 2036 saves.exe 4584 n6298081.exe 3944 saves.exe 2400 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2820 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" l6225722.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y0094091.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1789497.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y4669625.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2324 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3780 l6225722.exe 3780 l6225722.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3780 l6225722.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4388 wrote to memory of 1380 4388 8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe 81 PID 4388 wrote to memory of 1380 4388 8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe 81 PID 4388 wrote to memory of 1380 4388 8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe 81 PID 1380 wrote to memory of 396 1380 y1789497.exe 82 PID 1380 wrote to memory of 396 1380 y1789497.exe 82 PID 1380 wrote to memory of 396 1380 y1789497.exe 82 PID 396 wrote to memory of 4244 396 y4669625.exe 83 PID 396 wrote to memory of 4244 396 y4669625.exe 83 PID 396 wrote to memory of 4244 396 y4669625.exe 83 PID 4244 wrote to memory of 3780 4244 y0094091.exe 84 PID 4244 wrote to memory of 3780 4244 y0094091.exe 84 PID 4244 wrote to memory of 3960 4244 y0094091.exe 91 PID 4244 wrote to memory of 3960 4244 y0094091.exe 91 PID 4244 wrote to memory of 3960 4244 y0094091.exe 91 PID 3960 wrote to memory of 2036 3960 m3524640.exe 94 PID 3960 wrote to memory of 2036 3960 m3524640.exe 94 PID 3960 wrote to memory of 2036 3960 m3524640.exe 94 PID 396 wrote to memory of 4584 396 y4669625.exe 95 PID 396 wrote to memory of 4584 396 y4669625.exe 95 PID 396 wrote to memory of 4584 396 y4669625.exe 95 PID 2036 wrote to memory of 2324 2036 saves.exe 96 PID 2036 wrote to memory of 2324 2036 saves.exe 96 PID 2036 wrote to memory of 2324 2036 saves.exe 96 PID 2036 wrote to memory of 4364 2036 saves.exe 98 PID 2036 wrote to memory of 4364 2036 saves.exe 98 PID 2036 wrote to memory of 4364 2036 saves.exe 98 PID 4364 wrote to memory of 4344 4364 cmd.exe 101 PID 4364 wrote to memory of 4344 4364 cmd.exe 101 PID 4364 wrote to memory of 4344 4364 cmd.exe 101 PID 4364 wrote to memory of 180 4364 cmd.exe 102 PID 4364 wrote to memory of 180 4364 cmd.exe 102 PID 4364 wrote to memory of 180 4364 cmd.exe 102 PID 4364 wrote to memory of 4576 4364 cmd.exe 103 PID 4364 wrote to memory of 4576 4364 cmd.exe 103 PID 4364 wrote to memory of 4576 4364 cmd.exe 103 PID 4364 wrote to memory of 1516 4364 cmd.exe 104 PID 4364 wrote to memory of 1516 4364 cmd.exe 104 PID 4364 wrote to memory of 1516 4364 cmd.exe 104 PID 4364 wrote to memory of 768 4364 cmd.exe 105 PID 4364 wrote to memory of 768 4364 cmd.exe 105 PID 4364 wrote to memory of 768 4364 cmd.exe 105 PID 4364 wrote to memory of 3368 4364 cmd.exe 106 PID 4364 wrote to memory of 3368 4364 cmd.exe 106 PID 4364 wrote to memory of 3368 4364 cmd.exe 106 PID 2036 wrote to memory of 2820 2036 saves.exe 109 PID 2036 wrote to memory of 2820 2036 saves.exe 109 PID 2036 wrote to memory of 2820 2036 saves.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe"C:\Users\Admin\AppData\Local\Temp\8819f91ae41adbef52f9ee1942847e2a35c7afa218b9fade74b7ff4fbf04e49b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1789497.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1789497.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4669625.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y4669625.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0094091.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y0094091.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l6225722.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l6225722.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m3524640.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m3524640.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:2324
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4344
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:180
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1516
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:768
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:3368
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:2820
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6298081.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6298081.exe4⤵
- Executes dropped EXE
PID:4584
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3944
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2400
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD54d68b49d000023eb6dcbd1917ebbb1de
SHA10cf247a71dd4e3d928568ac7bfb7a61299fb9e2e
SHA25642fa1de9d7b5ce83e76a181fd659068ddb817b1e0de7a9fca7dc928ea66f87b1
SHA51232d84747d8a8acdb252d007de0a832f13e0e25d4d1af26ffe6dbf22c1f7e618694be02fbf0cab25f0d1b25bc1a4bed0a70f01b7ce199fae0cf83c3ea38ea550a
-
Filesize
599KB
MD54d68b49d000023eb6dcbd1917ebbb1de
SHA10cf247a71dd4e3d928568ac7bfb7a61299fb9e2e
SHA25642fa1de9d7b5ce83e76a181fd659068ddb817b1e0de7a9fca7dc928ea66f87b1
SHA51232d84747d8a8acdb252d007de0a832f13e0e25d4d1af26ffe6dbf22c1f7e618694be02fbf0cab25f0d1b25bc1a4bed0a70f01b7ce199fae0cf83c3ea38ea550a
-
Filesize
433KB
MD5d3b3f20ce625f3ba3b128aa19591b369
SHA16153951ff1aa3805b867d79956aa8e51c6fbe426
SHA25680953d9db0801975291c7fd9e897208229116281b15f279340aba67805d52819
SHA512f7bd992f849c0e3a6f50bf3dc21d7a62b36efc318fafdf9a7a5268801b1b8409140dbb1ff88ade09193bd14f83c74ab0041500bd63805a06b904da2c6319e06b
-
Filesize
433KB
MD5d3b3f20ce625f3ba3b128aa19591b369
SHA16153951ff1aa3805b867d79956aa8e51c6fbe426
SHA25680953d9db0801975291c7fd9e897208229116281b15f279340aba67805d52819
SHA512f7bd992f849c0e3a6f50bf3dc21d7a62b36efc318fafdf9a7a5268801b1b8409140dbb1ff88ade09193bd14f83c74ab0041500bd63805a06b904da2c6319e06b
-
Filesize
174KB
MD5821113b912d56e0cd304877ff6744895
SHA18f2bd839a2e70d87fb5e96e2bced8bdf23102808
SHA256f0ccc2c988c398db5f13b5b227a7b45f95f2c6748b36badf1d24f615bb59e2c4
SHA512eec32c710df746ae8f8b26d6fa4adf24ba913f19a3e551484b8d3cbde6de74f9ef6cd2089d57a79af632d4bf10054a5318ddc30fd4778efb86cf56870cb89689
-
Filesize
174KB
MD5821113b912d56e0cd304877ff6744895
SHA18f2bd839a2e70d87fb5e96e2bced8bdf23102808
SHA256f0ccc2c988c398db5f13b5b227a7b45f95f2c6748b36badf1d24f615bb59e2c4
SHA512eec32c710df746ae8f8b26d6fa4adf24ba913f19a3e551484b8d3cbde6de74f9ef6cd2089d57a79af632d4bf10054a5318ddc30fd4778efb86cf56870cb89689
-
Filesize
277KB
MD51f7414ea59e3af06a938b7ab91a6eece
SHA16547bda38fa5c8360e369f7a45e25c3a11c6b3cc
SHA2568cf9dbe6917b864883b2273e001df9146155018e6b199582bcaea8024cf7acdf
SHA5121703d87774a376109829bf606fefbec6005334d84ff224a155a0d32762e6baadbd2defa9dbf3bf385bf8a143a56ab598133756196290e3b50964452723fa57ff
-
Filesize
277KB
MD51f7414ea59e3af06a938b7ab91a6eece
SHA16547bda38fa5c8360e369f7a45e25c3a11c6b3cc
SHA2568cf9dbe6917b864883b2273e001df9146155018e6b199582bcaea8024cf7acdf
SHA5121703d87774a376109829bf606fefbec6005334d84ff224a155a0d32762e6baadbd2defa9dbf3bf385bf8a143a56ab598133756196290e3b50964452723fa57ff
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7