Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/08/2023, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe
Resource
win10-20230703-en
General
-
Target
c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe
-
Size
730KB
-
MD5
4cea29ae487fcdef1f2e1ae5581eb427
-
SHA1
3e46a0dc38dd713c78c01acfe48c35d8725920f1
-
SHA256
c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239
-
SHA512
84fb5ec394feb2813e7d86b2dceb851b4ef3906e0fca651ac48be73bace1b811b1bd77d8ad12b0e5eab040221e6c8c1ebee71be20bc74de5601730b76ccf810f
-
SSDEEP
12288:FMrSy90T4J4XA9t9uMMgoK+me7XyzKR29Xrp7Cs69FdUP+KGjjtFv3VSC:Hy44Gw9t9uMBoV97X8K49lmdU2KGvtFX
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
dugin
77.91.124.73:19071
-
auth_value
7c3e46e091100fd26a6076996d374c28
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000600000001afd1-155.dat healer behavioral1/files/0x000600000001afd1-156.dat healer behavioral1/memory/3860-157-0x0000000000540000-0x000000000054A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h6095250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h6095250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h6095250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h6095250.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h6095250.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 4968 x9635558.exe 4112 x6647524.exe 4280 x1563191.exe 4060 g3640375.exe 5012 saves.exe 3860 h6095250.exe 4796 i3768874.exe 1532 saves.exe 824 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4088 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h6095250.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9635558.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x6647524.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x1563191.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3608 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3860 h6095250.exe 3860 h6095250.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3860 h6095250.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4220 wrote to memory of 4968 4220 c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe 69 PID 4220 wrote to memory of 4968 4220 c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe 69 PID 4220 wrote to memory of 4968 4220 c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe 69 PID 4968 wrote to memory of 4112 4968 x9635558.exe 70 PID 4968 wrote to memory of 4112 4968 x9635558.exe 70 PID 4968 wrote to memory of 4112 4968 x9635558.exe 70 PID 4112 wrote to memory of 4280 4112 x6647524.exe 71 PID 4112 wrote to memory of 4280 4112 x6647524.exe 71 PID 4112 wrote to memory of 4280 4112 x6647524.exe 71 PID 4280 wrote to memory of 4060 4280 x1563191.exe 72 PID 4280 wrote to memory of 4060 4280 x1563191.exe 72 PID 4280 wrote to memory of 4060 4280 x1563191.exe 72 PID 4060 wrote to memory of 5012 4060 g3640375.exe 73 PID 4060 wrote to memory of 5012 4060 g3640375.exe 73 PID 4060 wrote to memory of 5012 4060 g3640375.exe 73 PID 4280 wrote to memory of 3860 4280 x1563191.exe 74 PID 4280 wrote to memory of 3860 4280 x1563191.exe 74 PID 5012 wrote to memory of 3608 5012 saves.exe 75 PID 5012 wrote to memory of 3608 5012 saves.exe 75 PID 5012 wrote to memory of 3608 5012 saves.exe 75 PID 5012 wrote to memory of 2400 5012 saves.exe 77 PID 5012 wrote to memory of 2400 5012 saves.exe 77 PID 5012 wrote to memory of 2400 5012 saves.exe 77 PID 2400 wrote to memory of 2372 2400 cmd.exe 79 PID 2400 wrote to memory of 2372 2400 cmd.exe 79 PID 2400 wrote to memory of 2372 2400 cmd.exe 79 PID 2400 wrote to memory of 2080 2400 cmd.exe 80 PID 2400 wrote to memory of 2080 2400 cmd.exe 80 PID 2400 wrote to memory of 2080 2400 cmd.exe 80 PID 2400 wrote to memory of 348 2400 cmd.exe 81 PID 2400 wrote to memory of 348 2400 cmd.exe 81 PID 2400 wrote to memory of 348 2400 cmd.exe 81 PID 2400 wrote to memory of 1128 2400 cmd.exe 82 PID 2400 wrote to memory of 1128 2400 cmd.exe 82 PID 2400 wrote to memory of 1128 2400 cmd.exe 82 PID 2400 wrote to memory of 3492 2400 cmd.exe 83 PID 2400 wrote to memory of 3492 2400 cmd.exe 83 PID 2400 wrote to memory of 3492 2400 cmd.exe 83 PID 2400 wrote to memory of 1200 2400 cmd.exe 84 PID 2400 wrote to memory of 1200 2400 cmd.exe 84 PID 2400 wrote to memory of 1200 2400 cmd.exe 84 PID 4112 wrote to memory of 4796 4112 x6647524.exe 85 PID 4112 wrote to memory of 4796 4112 x6647524.exe 85 PID 4112 wrote to memory of 4796 4112 x6647524.exe 85 PID 5012 wrote to memory of 4088 5012 saves.exe 87 PID 5012 wrote to memory of 4088 5012 saves.exe 87 PID 5012 wrote to memory of 4088 5012 saves.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe"C:\Users\Admin\AppData\Local\Temp\c6ddf7bcb1b90e5ad44d910f1cd71bdb2dea9dc6ecd8bd262d1284e0e5d0e239.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9635558.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9635558.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6647524.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6647524.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1563191.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1563191.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3640375.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3640375.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:3608
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2372
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2080
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1128
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3492
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:1200
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4088
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6095250.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6095250.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i3768874.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i3768874.exe4⤵
- Executes dropped EXE
PID:4796
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1532
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:824
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598KB
MD5fe6e42cd0ac326c010a859de24d1a286
SHA1e9fc5d7e07883c757f9994684f15dd80e5491c99
SHA256e836c31e5c8d05ecdade01252b9f3ed7357cf5a939b9f6993831260ab90f37bc
SHA5125140bfae19e19735b568e162ef1438f546d59acd0e4e97140d41b606d099a508b237f84fcfc4f822ec10d34fb84947134c127e6416c0c2a20e63202302ecde9f
-
Filesize
598KB
MD5fe6e42cd0ac326c010a859de24d1a286
SHA1e9fc5d7e07883c757f9994684f15dd80e5491c99
SHA256e836c31e5c8d05ecdade01252b9f3ed7357cf5a939b9f6993831260ab90f37bc
SHA5125140bfae19e19735b568e162ef1438f546d59acd0e4e97140d41b606d099a508b237f84fcfc4f822ec10d34fb84947134c127e6416c0c2a20e63202302ecde9f
-
Filesize
432KB
MD54b27599d0ddc0c23faca6a73690e73f5
SHA1bde558e6ea01054bd41ab0cbbe04bdc28aaf7a6f
SHA256d10787feb4afb83104e2adcdc7857fcacf4404d140224c4ec39506a528a13c9d
SHA51287cb54ef1d2a86a405096a516bfc5247ff8a70e48535392211c9abf380536a46dd8d665bd7878a53bf816d34935240fc606e3c11c3240c0234a885c16b0a6571
-
Filesize
432KB
MD54b27599d0ddc0c23faca6a73690e73f5
SHA1bde558e6ea01054bd41ab0cbbe04bdc28aaf7a6f
SHA256d10787feb4afb83104e2adcdc7857fcacf4404d140224c4ec39506a528a13c9d
SHA51287cb54ef1d2a86a405096a516bfc5247ff8a70e48535392211c9abf380536a46dd8d665bd7878a53bf816d34935240fc606e3c11c3240c0234a885c16b0a6571
-
Filesize
173KB
MD5b9bc23c7646356428ef5e3c16a8d3059
SHA16ceec8bef8b00726f546c9fa963eb62418620457
SHA25679726cb4728376877bf33897b0e5b2f20eab6c9b4f2ce9bbfb90095f6d2429bf
SHA512e8dd984cf94d1fb439a0b6af10effd473ef983b150cb0d41eaa236e623c1984bbc23d32f13907cfdcd38f7ba0b43feb3ac11263d0d6a0fb9444f59184e822900
-
Filesize
173KB
MD5b9bc23c7646356428ef5e3c16a8d3059
SHA16ceec8bef8b00726f546c9fa963eb62418620457
SHA25679726cb4728376877bf33897b0e5b2f20eab6c9b4f2ce9bbfb90095f6d2429bf
SHA512e8dd984cf94d1fb439a0b6af10effd473ef983b150cb0d41eaa236e623c1984bbc23d32f13907cfdcd38f7ba0b43feb3ac11263d0d6a0fb9444f59184e822900
-
Filesize
276KB
MD55976830da60a09fa88c5f5629658524c
SHA1b8acd91f884280ab1e7b6c1950803efb92148214
SHA2566a1c8235cdf665f444db7de77dbf55297e0d1e117cc6ee98e643081b5e33e2f1
SHA5124baeeaf28a3d16da6d5f3f3a190a01dcc609d9f47352389c87eafdfff835303053af8871583ae86472294df1619d6a3027a37015d0f6b0385cffa06f4f799594
-
Filesize
276KB
MD55976830da60a09fa88c5f5629658524c
SHA1b8acd91f884280ab1e7b6c1950803efb92148214
SHA2566a1c8235cdf665f444db7de77dbf55297e0d1e117cc6ee98e643081b5e33e2f1
SHA5124baeeaf28a3d16da6d5f3f3a190a01dcc609d9f47352389c87eafdfff835303053af8871583ae86472294df1619d6a3027a37015d0f6b0385cffa06f4f799594
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b