Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
General
-
Target
file.exe
-
Size
1.2MB
-
MD5
ba744c71ad3b2bc2aaa91dac43c3560a
-
SHA1
a8494e6b2449778d46e5ecaffe2f73927c173b57
-
SHA256
e1c75364c3f932b775cfb1d2d5a65589710be2b40adeef66d53772e0a6bcb6aa
-
SHA512
dbc058755d2152537cb13690feff35d36280d38db5cf786749d9b7889c62a1608d3dbbe679f3519b07aa445e5c3210e6583c6ce59daa41f640eddf226209cf0f
-
SSDEEP
24576:HyN4a27dXgoV/THMw7hoxuc8x9z3dve7IxYrgxnb/4Jno:SNv27JTt0o9zhecxYr6b/Q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1SV62hB3.exe -
Executes dropped EXE 5 IoCs
pid Process 2068 oZ6Ib58.exe 2228 YU5Kf42.exe 2416 Jd3Py61.exe 2640 1SV62hB3.exe 2664 2Yo5714.exe -
Loads dropped DLL 14 IoCs
pid Process 2884 file.exe 2068 oZ6Ib58.exe 2068 oZ6Ib58.exe 2228 YU5Kf42.exe 2228 YU5Kf42.exe 2416 Jd3Py61.exe 2416 Jd3Py61.exe 2640 1SV62hB3.exe 2416 Jd3Py61.exe 2664 2Yo5714.exe 2576 WerFault.exe 2576 WerFault.exe 2576 WerFault.exe 2576 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 1SV62hB3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1SV62hB3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" oZ6Ib58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" YU5Kf42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Jd3Py61.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2664 set thread context of 2500 2664 2Yo5714.exe 33 -
Program crash 2 IoCs
pid pid_target Process procid_target 2576 2664 WerFault.exe 32 3020 2500 WerFault.exe 33 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2640 1SV62hB3.exe 2640 1SV62hB3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2640 1SV62hB3.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2884 wrote to memory of 2068 2884 file.exe 28 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2068 wrote to memory of 2228 2068 oZ6Ib58.exe 29 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2228 wrote to memory of 2416 2228 YU5Kf42.exe 30 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2640 2416 Jd3Py61.exe 31 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2416 wrote to memory of 2664 2416 Jd3Py61.exe 32 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2500 2664 2Yo5714.exe 33 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2664 wrote to memory of 2576 2664 2Yo5714.exe 34 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35 PID 2500 wrote to memory of 3020 2500 AppLaunch.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oZ6Ib58.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\YU5Kf42.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd3Py61.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1SV62hB3.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Yo5714.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 2687⤵
- Program crash
PID:3020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 2846⤵
- Loads dropped DLL
- Program crash
PID:2576
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5a598f609eb10430d7e6d224c4873cf0c
SHA115d70418c22a933c816404a7d720d639a337992b
SHA25614940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002
SHA512b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1
-
Filesize
1.0MB
MD5a598f609eb10430d7e6d224c4873cf0c
SHA115d70418c22a933c816404a7d720d639a337992b
SHA25614940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002
SHA512b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1
-
Filesize
745KB
MD504a94daab9afec040427dd84ec844ae1
SHA1ca8f93ef567f3cc68b7098402651cd35e77e670d
SHA2563673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b
SHA51270a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806
-
Filesize
745KB
MD504a94daab9afec040427dd84ec844ae1
SHA1ca8f93ef567f3cc68b7098402651cd35e77e670d
SHA2563673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b
SHA51270a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806
-
Filesize
492KB
MD56c590a9604c706b704fdad534823611f
SHA1bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff
SHA256d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af
SHA5127eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b
-
Filesize
492KB
MD56c590a9604c706b704fdad534823611f
SHA1bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff
SHA256d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af
SHA5127eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
1.0MB
MD5a598f609eb10430d7e6d224c4873cf0c
SHA115d70418c22a933c816404a7d720d639a337992b
SHA25614940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002
SHA512b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1
-
Filesize
1.0MB
MD5a598f609eb10430d7e6d224c4873cf0c
SHA115d70418c22a933c816404a7d720d639a337992b
SHA25614940583cd99f9880ad4dc18c5c6921266f6dab89f0b8d85db8c409fd8545002
SHA512b502eac9ca261dbf956cad202e12542e7856f5642e967b7c3bca5a7feba4ca1e6a468aee6825917cb4cb4f5fb7698104bc41bf6ad46d2ac215518f3f70412fd1
-
Filesize
745KB
MD504a94daab9afec040427dd84ec844ae1
SHA1ca8f93ef567f3cc68b7098402651cd35e77e670d
SHA2563673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b
SHA51270a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806
-
Filesize
745KB
MD504a94daab9afec040427dd84ec844ae1
SHA1ca8f93ef567f3cc68b7098402651cd35e77e670d
SHA2563673c6446cb9b50e97e0e27d1091e6a56f119b6e343428eea392da0ab09cb51b
SHA51270a4497b898333ef63d9ab8491517c76e8b9901ca79425c93144df3b4c85569a5235f1a62b43f0c6e42839bb6bf786ac67c3ae813d74c308cf50cb71e1448806
-
Filesize
492KB
MD56c590a9604c706b704fdad534823611f
SHA1bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff
SHA256d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af
SHA5127eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b
-
Filesize
492KB
MD56c590a9604c706b704fdad534823611f
SHA1bb5a8f01129ae0cf852c7db5dc497aa0f326a7ff
SHA256d62609e6f7d0a989bad3519493582ee26ad5015cc47c6e31685be9879a4717af
SHA5127eb0c247bb879a3dfd38d5c6732b7d58f21182f6ac71fea9861f5f7a990b9efc4b80cce5d9fdf26f514446366ceba9ed95ca8e89f3b291330779bc8c74fbd64b
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
194KB
MD56241b03d68a610324ecda52f0f84e287
SHA1da80280b6e3925e455925efd6c6e59a6118269c4
SHA256ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c
-
Filesize
446KB
MD5a95dff4b299e84d682618aec232db47c
SHA169f166f5ee77fdf0a38d8685784decd3671ef27d
SHA256d14ae98cee009df197b7810e342c0ec8abf7524e46ffa5441a9e752c8780d99b
SHA5123f39b60cb748c7aa6ef6eff3e9babbe03ec8584d31de42897575b71123f9025edf4a09944e05488c23a694011f6665497991656b02d943b519cb0f19521c253c