Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2023, 04:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral3
Sample
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Resource
android-x64-20231023.1-en
Behavioral task
behavioral4
Sample
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral5
Sample
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Resource
macos-20220504-en
General
-
Target
https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133437200619452244" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 716 chrome.exe 716 chrome.exe 316 chrome.exe 316 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 3504 716 chrome.exe 51 PID 716 wrote to memory of 3504 716 chrome.exe 51 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 3968 716 chrome.exe 88 PID 716 wrote to memory of 2284 716 chrome.exe 89 PID 716 wrote to memory of 2284 716 chrome.exe 89 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90 PID 716 wrote to memory of 3408 716 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shoutout.wix.com/so/09Ojop2Qc/c?w=gXGMfq1D8GTjSAZlTjyLRXFepX9V3XoV0Tgeoks9pjI.eyJ1IjoiaHR0cHM6Ly9kemEucnliLm15Ymx1ZWhvc3QubWUvTXlHb3YiLCJyIjoiMDQ0MjcxYjUtN2I3MS00ZGVkLTgwOGUtMzc1ODRhMDRkMzYyIiwibSI6Im1haWwiLCJjIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIn01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd120e9758,0x7ffd120e9768,0x7ffd120e97782⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:22⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:82⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:12⤵PID:4080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:12⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3600 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:12⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:82⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:82⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 --field-trial-handle=1748,i,14208847440131258660,3004942451167316714,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\52ab5cb4-e108-426d-92ec-35825c4c223b.tmp
Filesize1KB
MD56ecb824357c2577cf4edfa93634399bd
SHA16848b9f214d47904bb28e1aa5bed5cbc127a7ee5
SHA256d086d2679b19cc784b5094743ff34fccc7f8b45ceb4db3ef74de2e335a7a6b53
SHA5124101d55967334d38521706db10a5f7d04b0a8b29390543859fcfd83e733c97ef707a7b8a5851a7eae77ba140c8b8b01d09031b2410892c105527278e4a6c62bb
-
Filesize
536B
MD55ad4ae1acf6c50e95b4adc6405df9e51
SHA1161fc243c0fdc700a6cb2b66def94f2f6ad26933
SHA256252e2459ba005a12d151dcefe0046e29ff89955dbcd537dc386fd3506db2cce5
SHA512dfd307fc156997d7fce8a525f9a19ed0e0736828fa5d2effc9761ceba2c6f3ed5cae3b3aae47167c40955d97f62d2d8794f91533dc756de8232b57249be56b4b
-
Filesize
6KB
MD5b38c260d2e2b7b95522a8e96909a3182
SHA1d98492d29c19ef831ade31a751718b278f054045
SHA256063bc06dbdadefe1ba1eb0941ad106f9fbbc32a496dd8f173894ab2a4110ed52
SHA512ddb38f63f645139ce70b6b6d3c7a6173ee894fbd316c10baf74a80e03174631513fb23043b9bf7f2819026557ba70d14645388fead57c408b4e2fb7d4d45b99d
-
Filesize
109KB
MD5f771a8cd6dd6b791919654e40997c988
SHA1b2427e51950e2ac1a6e8c1f6efd61cb30db50402
SHA256d836b1e1cbdc527e4e1b937a96d0cc038758dc526deb28d7a2c8a0fc9856c929
SHA5120510b261dddebd008242dbb50a41bc3016e8889619033c06e6f4620591363a90dbbb05d34b6e15a22c8235f119b0141a7776e198010191d2f914071b2d3b0b9e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd