Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
29/09/2023, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
Resource
win10v2004-20230915-en
General
-
Target
ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe
-
Size
26KB
-
MD5
cab628bceb8b3c9bb2b79a71a0d68319
-
SHA1
a20587dd81165b8e1e22b056c40677d94bece6cb
-
SHA256
ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e
-
SHA512
d71b4eea641bec4c2d86d55702f6d96eca1af92ca4ab87b24fc3eeab2b705134629ef80b9f5d1cb29c5212b0866d39963708851bd39e1f6774198a6e7df2af78
-
SSDEEP
768:1Z1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:tfgLdQAQfcfymNG+Kx
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\L: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\G: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\Z: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\U: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\P: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\N: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\O: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\Y: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\X: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\T: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\Q: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\H: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\W: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\V: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\S: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\I: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\R: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\K: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\J: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened (read-only) \??\E: ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Mail\de-DE\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eu\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Java\jre7\lib\zi\America\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Windows NT\Accessories\ja-JP\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\en-US\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\_desktop.ini ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rundl132.exe ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1660 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 28 PID 2092 wrote to memory of 1660 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 28 PID 2092 wrote to memory of 1660 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 28 PID 2092 wrote to memory of 1660 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 28 PID 1660 wrote to memory of 2820 1660 net.exe 30 PID 1660 wrote to memory of 2820 1660 net.exe 30 PID 1660 wrote to memory of 2820 1660 net.exe 30 PID 1660 wrote to memory of 2820 1660 net.exe 30 PID 2092 wrote to memory of 1272 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 23 PID 2092 wrote to memory of 1272 2092 ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe 23
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe"C:\Users\Admin\AppData\Local\Temp\ef3fbd14f96ca42f09af1107b97465aec898db5c16b1d568bd4f60d713642f7e.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:2820
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD514433b5cd9967ad2af0248435b745083
SHA19325d22da7bb0c54f34f3bd0a491c4ed8b940d16
SHA2567d7045224e82e103031144a7fd09be97d57255e4bbf3c385b41f1393b0ac6cd6
SHA512e6351392cddfcf4f07be1b0e6abfb015281632c12c01a406d1d8dcb104921c1cc34e53dfbe103e94ad4c1a2f9c1e3e1f3044f7a33cfb2caef05bebb907c56236
-
Filesize
873KB
MD5946cb16d20f30faca80bbe2c44b92a1b
SHA1b30560f3964d7b49041298022a00bf307e433bdb
SHA2568e0485ee42aef6d5452ddc392665c0b6baf3f460beb652b8ad07474321876818
SHA51236ec7d52b113fb59dcbca3a753c717d3f7684da7b7836533c269e633f9b0538d4459132915b0b096e88959c13d087ca19ca0eeee0f54b7972c923d14b910038e
-
Filesize
471KB
MD5c6c8fde27f649c91ddaab8cb9ca344a6
SHA15e4865aec432a18107182f47edda176e8c566152
SHA25632c3fed53bfc1d890e9bd1d771fdc7e2c81480e03f1425bce07b4045a192d100
SHA512a8df7d1e852d871d7f16bae10c4ff049359583da88cc85a039f0298525839040d5363ce5ef4cbdb92a12a25785f73df83cf0df07752b78e6e6444f32160a2155
-
Filesize
9B
MD50d8cc6d8ad77008e4eea5193ba074b8b
SHA1ed3ef3737662f0b0d7dabb8a681fdab8882322a1
SHA25602cb6e1ee5bc2475b62b35df1ff95d9d38080ea818c3fea2c65ceb449c761999
SHA5128cf0f361865203a0b8ea23fb3a33827b86958c4035294db074562956d6fe213d9069f3e5687ea66284e14f4406d74d348d98eec1af10b2538acd7a302752813f