Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 18:55
Behavioral task
behavioral1
Sample
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
-
Size
409KB
-
MD5
f672d1603b04f6a1bb2c1168429768de
-
SHA1
7321c9d98b08b4e2a59240666a17787d583e74f0
-
SHA256
d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165
-
SHA512
21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575
-
SSDEEP
12288:L2LfajrFOnz+EtLLz7YVWy+OPWejt/pTwQqXPU:L2Lmw+EtYVR1Fjt/pTwQqs
Malware Config
Extracted
warzonerat
111.90.146.200:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 12 IoCs
resource yara_rule behavioral1/memory/2376-7-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2376-18-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2376-19-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2376-34-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2376-35-0x0000000002C50000-0x0000000002D25000-memory.dmp warzonerat behavioral1/memory/2152-63-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2720-70-0x00000000031B0000-0x0000000003285000-memory.dmp warzonerat behavioral1/memory/2152-71-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2600-79-0x0000000002AF0000-0x0000000002B30000-memory.dmp warzonerat behavioral1/memory/2472-78-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2472-84-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2152-107-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe -
Executes dropped EXE 3 IoCs
pid Process 2876 images.exe 2152 images.exe 2516 images.exe -
Loads dropped DLL 2 IoCs
pid Process 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2416-2-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2416-3-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2004-11-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2004-15-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2004-16-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/files/0x0028000000015e09-24.dat upx behavioral1/memory/2720-40-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2876-41-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2876-46-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2720-54-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2720-44-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2876-37-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2516-68-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/3004-72-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2516-74-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2600-80-0x0000000002AF0000-0x0000000002B30000-memory.dmp upx behavioral1/memory/3004-81-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2440-87-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2440-88-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/2440-90-0x0000000000400000-0x00000000004D5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images1 = "C:\\ProgramData\\images.exe" f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2416 set thread context of 2376 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 29 PID 2876 set thread context of 2152 2876 images.exe 37 PID 2720 set thread context of 2472 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 38 -
NTFS ADS 1 IoCs
description ioc Process File created C:\ProgramData:ApplicationData f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2876 images.exe 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 2600 powershell.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2428 powershell.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe 2516 images.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2876 images.exe 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 2428 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2296 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 28 PID 2416 wrote to memory of 2376 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 29 PID 2416 wrote to memory of 2376 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 29 PID 2416 wrote to memory of 2376 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 29 PID 2416 wrote to memory of 2376 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 29 PID 2416 wrote to memory of 2004 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2004 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2004 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2004 2416 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 30 PID 2376 wrote to memory of 2600 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2600 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2600 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2600 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 31 PID 2376 wrote to memory of 2876 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 33 PID 2376 wrote to memory of 2876 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 33 PID 2376 wrote to memory of 2876 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 33 PID 2376 wrote to memory of 2876 2376 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 33 PID 2004 wrote to memory of 2720 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 34 PID 2004 wrote to memory of 2720 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 34 PID 2004 wrote to memory of 2720 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 34 PID 2004 wrote to memory of 2720 2004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 34 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2876 wrote to memory of 2808 2876 images.exe 35 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2876 wrote to memory of 2152 2876 images.exe 37 PID 2876 wrote to memory of 2152 2876 images.exe 37 PID 2876 wrote to memory of 2152 2876 images.exe 37 PID 2876 wrote to memory of 2152 2876 images.exe 37 PID 2720 wrote to memory of 2620 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 36 PID 2720 wrote to memory of 2472 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 38 PID 2720 wrote to memory of 2472 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 38 PID 2720 wrote to memory of 2472 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 38 PID 2720 wrote to memory of 2472 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 38 PID 2876 wrote to memory of 2516 2876 images.exe 39 PID 2876 wrote to memory of 2516 2876 images.exe 39 PID 2876 wrote to memory of 2516 2876 images.exe 39 PID 2876 wrote to memory of 2516 2876 images.exe 39 PID 2720 wrote to memory of 3004 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 40 PID 2720 wrote to memory of 3004 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 40 PID 2720 wrote to memory of 3004 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 40 PID 2720 wrote to memory of 3004 2720 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 40 PID 3004 wrote to memory of 2440 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 41 PID 3004 wrote to memory of 2440 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 41 PID 3004 wrote to memory of 2440 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 41 PID 3004 wrote to memory of 2440 3004 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 41 PID 2440 wrote to memory of 1632 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 42 PID 2440 wrote to memory of 1632 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 42 PID 2440 wrote to memory of 1632 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 42 PID 2440 wrote to memory of 1632 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 42 PID 2440 wrote to memory of 1632 2440 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 42 PID 2152 wrote to memory of 2428 2152 images.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵PID:2808
-
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵PID:1248
-
-
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2152 2593992264⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2516
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2376 2593970742⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Drops startup file
PID:2620
-
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"4⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2472 2593994604⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"6⤵PID:1632
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD59f682defdaeed1a680601c7ee29e98be
SHA1d3fce83f2a61eedb5e7679f95d36d2a501fa7c4a
SHA256ecd123794bb41e2129d7d9af51129ae745556a231ed9116c7654b623d6d3066f
SHA512356b05e037b0c73fa1fcc9087190f54a2a2f33268f81e7648c0af3021a408a846515e089f48acc180d59e16825d6e08334bf2b1f212899f16ac39b8bb69a7032
-
Filesize
158B
MD53cccf9435b659bf318d80f780097ffbf
SHA1f0af7b20ad3498befcc19d90c0c1c7d4f021e77f
SHA256a5c69769ed69652017de0ac5b2b49978af9580a67f0ce473742fc3a04c00a86a
SHA512d28c78ce84c518b8446aaa2b10bced63c7877b969abdcc0d3b65251123c1472f66598935de7facab9f5608c2bdc01b03156b00413687ee40b272c1b307e29b40
-
Filesize
409KB
MD5f672d1603b04f6a1bb2c1168429768de
SHA17321c9d98b08b4e2a59240666a17787d583e74f0
SHA256d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165
SHA51221bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575