Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de9dd0c28688277931a9dfe95f09c5c0.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
de9dd0c28688277931a9dfe95f09c5c0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
de9dd0c28688277931a9dfe95f09c5c0.exe
-
Size
302KB
-
MD5
de9dd0c28688277931a9dfe95f09c5c0
-
SHA1
a2e2cfac5bc021a692f71857aa31250869c2e6c6
-
SHA256
6380c6a0cfeaa8c91b5c4de75539255c14fe313934ec973179d3b4d6aac79c11
-
SHA512
3dd1e198cf4b59aff2e66537faf29d8c7c02d636d8bc58e01984c548655c352502a9d9a456e62536eede1d047e286d7f2ff73a18db4f5c0132d47d1fcf43fa85
-
SSDEEP
6144:wfgpnTfV/4RJXkcNT43KS3KD5pJi7NVEMbOM0lcHUfh5C6KgN5E57:ZlJkh43Y5i0nlcHUJMx
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe de9dd0c28688277931a9dfe95f09c5c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE" de9dd0c28688277931a9dfe95f09c5c0.exe -
Executes dropped EXE 2 IoCs
pid Process 2524 pucuu41server.exe 2528 svohst.exe -
Loads dropped DLL 2 IoCs
pid Process 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\svohst.exe pucuu41server.exe File opened for modification C:\Windows\SysWOW64\svohst.exe pucuu41server.exe File created C:\Windows\SysWOW64\svohst.exe svohst.exe File created C:\Windows\SysWOW64\Deleteme.bat pucuu41server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 3012 de9dd0c28688277931a9dfe95f09c5c0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3012 de9dd0c28688277931a9dfe95f09c5c0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3012 de9dd0c28688277931a9dfe95f09c5c0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2524 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 28 PID 3012 wrote to memory of 2524 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 28 PID 3012 wrote to memory of 2524 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 28 PID 3012 wrote to memory of 2524 3012 de9dd0c28688277931a9dfe95f09c5c0.exe 28 PID 2524 wrote to memory of 2936 2524 pucuu41server.exe 30 PID 2524 wrote to memory of 2936 2524 pucuu41server.exe 30 PID 2524 wrote to memory of 2936 2524 pucuu41server.exe 30 PID 2524 wrote to memory of 2936 2524 pucuu41server.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9dd0c28688277931a9dfe95f09c5c0.exe"C:\Users\Admin\AppData\Local\Temp\de9dd0c28688277931a9dfe95f09c5c0.exe"1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Temp\pucuu41server.exe"C:\Temp\pucuu41server.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Deleteme.bat3⤵PID:2936
-
-
-
C:\Windows\SysWOW64\svohst.exeC:\Windows\SysWOW64\svohst.exe -NetSata1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94B
MD54ad2687ee8c6719c9f879a8af9883836
SHA1708dd7731fa39874ebcbc13c75c125f85a8f6317
SHA2565bb9e760f213d90496ae619fbeb7b0e15a157a62dfeb42dc3cddb8f9f144b62a
SHA512f1049d3a92b497de41df068b1b268968c5d77551736275ec83cc88808a5b636ccdb0927b995029744ced44905190174ae95b54318acd5f6e5d818bcfe43112b1
-
Filesize
476KB
MD59683c5af9164dd674242979191e5f710
SHA1e6e2fbcee33a4cd0e9264e4ff259e38478a1ec2d
SHA256850174353615b43b7392dec40ab9f27f4afe07d82abacfec690df17a6ef6322f
SHA51216a97b6bdfa769232e7e17c1585d41a6258f2a4e3b594b0ca7f88ef512fd5237166c64c6b1758c39064e622224ff5df187a7ff27b51b4782605ef65292ecd3fc