Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe
Resource
win10v2004-20230703-en
General
-
Target
33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe
-
Size
729KB
-
MD5
d0f7229972c06b92a1723022d1171cb5
-
SHA1
38f4d6ee245244db7675b89210cb3aaba19f6074
-
SHA256
33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0ef7b80f7c2412a2a381d
-
SHA512
b7e826fa6161e688e78d7f1e56c5203e655cfdefe04cd83e52518fe1fd460360d54da001aaca9f8b9c2843faba83d215e8c73287dee0c5f1f58da9111f185595
-
SSDEEP
12288:7MrGy90DXc+Ilk6eiQMKwqtTb7TOLMuaIEDgeDKZBe7tQ6KRTiXPp7fJQxfr4FDW:9y2XSC6r111FeDO47t5KVixQ4cWbxS
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
dugin
77.91.124.73:19071
-
auth_value
7c3e46e091100fd26a6076996d374c28
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral2/files/0x000600000002309f-175.dat healer behavioral2/files/0x000600000002309f-174.dat healer behavioral2/memory/5016-176-0x0000000000FC0000-0x0000000000FCA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h5955761.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h5955761.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h5955761.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h5955761.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h5955761.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h5955761.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 3476 x0459634.exe 4416 x8812060.exe 1824 x7007687.exe 1408 g3333876.exe 1828 saves.exe 5016 h5955761.exe 1816 i2397597.exe 4812 saves.exe 2864 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 3640 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h5955761.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x0459634.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x8812060.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x7007687.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1820 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5016 h5955761.exe 5016 h5955761.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5016 h5955761.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3496 wrote to memory of 3476 3496 33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe 81 PID 3496 wrote to memory of 3476 3496 33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe 81 PID 3496 wrote to memory of 3476 3496 33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe 81 PID 3476 wrote to memory of 4416 3476 x0459634.exe 82 PID 3476 wrote to memory of 4416 3476 x0459634.exe 82 PID 3476 wrote to memory of 4416 3476 x0459634.exe 82 PID 4416 wrote to memory of 1824 4416 x8812060.exe 83 PID 4416 wrote to memory of 1824 4416 x8812060.exe 83 PID 4416 wrote to memory of 1824 4416 x8812060.exe 83 PID 1824 wrote to memory of 1408 1824 x7007687.exe 84 PID 1824 wrote to memory of 1408 1824 x7007687.exe 84 PID 1824 wrote to memory of 1408 1824 x7007687.exe 84 PID 1408 wrote to memory of 1828 1408 g3333876.exe 85 PID 1408 wrote to memory of 1828 1408 g3333876.exe 85 PID 1408 wrote to memory of 1828 1408 g3333876.exe 85 PID 1824 wrote to memory of 5016 1824 x7007687.exe 86 PID 1824 wrote to memory of 5016 1824 x7007687.exe 86 PID 1828 wrote to memory of 1820 1828 saves.exe 87 PID 1828 wrote to memory of 1820 1828 saves.exe 87 PID 1828 wrote to memory of 1820 1828 saves.exe 87 PID 1828 wrote to memory of 1656 1828 saves.exe 89 PID 1828 wrote to memory of 1656 1828 saves.exe 89 PID 1828 wrote to memory of 1656 1828 saves.exe 89 PID 1656 wrote to memory of 2724 1656 cmd.exe 91 PID 1656 wrote to memory of 2724 1656 cmd.exe 91 PID 1656 wrote to memory of 2724 1656 cmd.exe 91 PID 1656 wrote to memory of 3840 1656 cmd.exe 92 PID 1656 wrote to memory of 3840 1656 cmd.exe 92 PID 1656 wrote to memory of 3840 1656 cmd.exe 92 PID 1656 wrote to memory of 2284 1656 cmd.exe 93 PID 1656 wrote to memory of 2284 1656 cmd.exe 93 PID 1656 wrote to memory of 2284 1656 cmd.exe 93 PID 1656 wrote to memory of 3952 1656 cmd.exe 95 PID 1656 wrote to memory of 3952 1656 cmd.exe 95 PID 1656 wrote to memory of 3952 1656 cmd.exe 95 PID 1656 wrote to memory of 4064 1656 cmd.exe 96 PID 1656 wrote to memory of 4064 1656 cmd.exe 96 PID 1656 wrote to memory of 4064 1656 cmd.exe 96 PID 1656 wrote to memory of 3764 1656 cmd.exe 97 PID 1656 wrote to memory of 3764 1656 cmd.exe 97 PID 1656 wrote to memory of 3764 1656 cmd.exe 97 PID 4416 wrote to memory of 1816 4416 x8812060.exe 105 PID 4416 wrote to memory of 1816 4416 x8812060.exe 105 PID 4416 wrote to memory of 1816 4416 x8812060.exe 105 PID 1828 wrote to memory of 3640 1828 saves.exe 109 PID 1828 wrote to memory of 3640 1828 saves.exe 109 PID 1828 wrote to memory of 3640 1828 saves.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe"C:\Users\Admin\AppData\Local\Temp\33ea9c83fa78c7902708f73a99c21bae8fa29f8fcdc0e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0459634.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0459634.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8812060.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8812060.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7007687.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x7007687.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3333876.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3333876.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:1820
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2724
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:3840
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:2284
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3952
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:4064
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:3764
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:3640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5955761.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5955761.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2397597.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2397597.exe4⤵
- Executes dropped EXE
PID:1816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:4812
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2864
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598KB
MD591a5d5ebf264157bc90f5d1befe45732
SHA17adddb86da837209a508d0fa294774d9d890efb4
SHA2569de28e1a0dfffa5c7594b9ef551c0dc2344660f97b2cef17a1b5af11b294a2e3
SHA5129b73ba8771378619def30112231a9dd75f3f178e1d7a392f4f3515163530ca8d86c506af2459308aa70c0875bde6d428a323f12d27d340b17df7fe47f3176f0b
-
Filesize
598KB
MD591a5d5ebf264157bc90f5d1befe45732
SHA17adddb86da837209a508d0fa294774d9d890efb4
SHA2569de28e1a0dfffa5c7594b9ef551c0dc2344660f97b2cef17a1b5af11b294a2e3
SHA5129b73ba8771378619def30112231a9dd75f3f178e1d7a392f4f3515163530ca8d86c506af2459308aa70c0875bde6d428a323f12d27d340b17df7fe47f3176f0b
-
Filesize
432KB
MD53d5b5ed0e4773a06d58806f492e6c0e8
SHA1f4059c1b3907bf4edb3bce73aa95394e0b5e87ae
SHA25686b8bb782178fda44c767efaebf13dbfdb1c2f8b58f4931e39b3638d383f3533
SHA5121b1d1df4d8765fbb60bcc98a9982e34dc8d87fe5b79d2093ac3a7c895c9c2d4811d85c4dbf6d417d3d524cd73eb6d92d922d013332e7c86cac8f1b74257b1b03
-
Filesize
432KB
MD53d5b5ed0e4773a06d58806f492e6c0e8
SHA1f4059c1b3907bf4edb3bce73aa95394e0b5e87ae
SHA25686b8bb782178fda44c767efaebf13dbfdb1c2f8b58f4931e39b3638d383f3533
SHA5121b1d1df4d8765fbb60bcc98a9982e34dc8d87fe5b79d2093ac3a7c895c9c2d4811d85c4dbf6d417d3d524cd73eb6d92d922d013332e7c86cac8f1b74257b1b03
-
Filesize
173KB
MD50094ddebb90ddc444dfd8ae666527e97
SHA100dd795cd2f0d3e11aa3c89e0fb7892fd6939455
SHA256fcbb406bcf7da64698a6df4b9666932039d552a976c2da6f4ef97b70b059de7b
SHA512462057ce1813acdec80d635cf30a76756b8e3c74472d12f1139688f49fdb5c16b82092cc44a8b49c81989327f1b89f469c68c1bbf36775d8ffebd689e18dfcb6
-
Filesize
173KB
MD50094ddebb90ddc444dfd8ae666527e97
SHA100dd795cd2f0d3e11aa3c89e0fb7892fd6939455
SHA256fcbb406bcf7da64698a6df4b9666932039d552a976c2da6f4ef97b70b059de7b
SHA512462057ce1813acdec80d635cf30a76756b8e3c74472d12f1139688f49fdb5c16b82092cc44a8b49c81989327f1b89f469c68c1bbf36775d8ffebd689e18dfcb6
-
Filesize
276KB
MD5733dbb174cf2d32a3608487b68a8b911
SHA10489c5f8127bda73725516c905efa73083616fd5
SHA25622782052082f27cb6ea6262d414819e472092a3122d3ee096ec706841eaae646
SHA51291959d3ad235ee0192267b71af9ec9266fa54d117f602cdf9dd8a6939b1ddfd9ab4b7c166f6cf644dd6ff87cabefd444f42dc4f68a82f7a67af025853327a8e6
-
Filesize
276KB
MD5733dbb174cf2d32a3608487b68a8b911
SHA10489c5f8127bda73725516c905efa73083616fd5
SHA25622782052082f27cb6ea6262d414819e472092a3122d3ee096ec706841eaae646
SHA51291959d3ad235ee0192267b71af9ec9266fa54d117f602cdf9dd8a6939b1ddfd9ab4b7c166f6cf644dd6ff87cabefd444f42dc4f68a82f7a67af025853327a8e6
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7