Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
266s -
max time network
264s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-es -
resource tags
arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
18/04/2024, 06:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/uc?export=download&id=1Pfa__kpg_oLasDz_3xXEkfJBhr5qPe1H
Resource
win10v2004-20240412-es
General
-
Target
https://docs.google.com/uc?export=download&id=1Pfa__kpg_oLasDz_3xXEkfJBhr5qPe1H
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133578949407332096" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2356 chrome.exe 2356 chrome.exe 1320 chrome.exe 1320 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2356 chrome.exe 2356 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeRestorePrivilege 1692 7zFM.exe Token: 35 1692 7zFM.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe Token: SeShutdownPrivilege 2356 chrome.exe Token: SeCreatePagefilePrivilege 2356 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 1692 7zFM.exe 1692 7zFM.exe 1692 7zFM.exe 1692 7zFM.exe 1992 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe 2356 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4976 2356 chrome.exe 82 PID 2356 wrote to memory of 4976 2356 chrome.exe 82 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 2076 2356 chrome.exe 85 PID 2356 wrote to memory of 1264 2356 chrome.exe 86 PID 2356 wrote to memory of 1264 2356 chrome.exe 86 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87 PID 2356 wrote to memory of 924 2356 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/uc?export=download&id=1Pfa__kpg_oLasDz_3xXEkfJBhr5qPe1H1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4601ab58,0x7ffb4601ab68,0x7ffb4601ab782⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:22⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:1264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:12⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:1120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:82⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2084
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DEL FALLO; RAD.7653890012-2024.tar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1692
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap9319:148:7zEvent169481⤵
- Suspicious use of FindShellTrayWindow
PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD580ffa31945bd7f3313ca6e7c24539771
SHA1ea523636cbe5fd82d5347710b53826a9e2754ae8
SHA25676a7f6b81d86a3794928128594f837f7f554b16f913b54a192b9450063ff52b2
SHA51224d7c849f0fd19a6ddac7b4e73ded43320b937fba6634a5e6b85e1224d50582432dcb450d500758149c43da2ce6a24db8d31bd458552d6bab244a03583594156
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD5662b6237eb514ac9624ff5f780e0b9a3
SHA18bbb88ab989f6c0830dc744bff5f8cefb3d72709
SHA256eb7af2e6ff3f36fb6c6177c171adaecf0a7409c51a5a9454c2b3fcd2f292fd7a
SHA512258dfc916cdca648446c2b0efba1f3e31410aafc11212cbf82c285d62a37073067d592aadc79a6990b1c717bfd221a3cc9b84e3efac90651ed3464f2ba0b1eec
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c49ec810-8a01-49a9-90ae-d20ef89f95e3.tmp
Filesize1KB
MD56d621f3fcc9a5f5725e58efa0f58efc1
SHA1a9e5860a457d97faeac6e23ff468dd2ae0d471d7
SHA2567f9ecbed42ac31d54dcc25cbe6608ce74641e3556438de99b01f0cb7cefc40c2
SHA512bef3b974396c27e4786c2c4dc31096ae9bc6c65ad7522c77c2d8b4481d12389b8a236b288908d67ca7fbb3b283378285a9a22341cf3ddda48bcbea6f949ff506
-
Filesize
6KB
MD53f63465cceb6f1a54dca463468ee34c3
SHA1e4069f23c7941d47eedaf34455acb7168b6ff1e7
SHA256936b55e172a4a90a2f4929ca53345a65f576a91c41a46fdcb568a268d3b6ff97
SHA5121e17eefd000a0a44898416866ed0805f31201605839717701f69742960107cd1e7a055e65a728b4e1f7775040afe92f4426dff39b8687282452dfcdd006d5c0f
-
Filesize
250KB
MD5966d9085a8d53588c498ca9f2f6f08ef
SHA1d37f4126b82f13b78abf1049eaf219fc270ef74c
SHA2567f6af830c469bc9f331263e4c9d17d0daf839bf2938c2d8533aa87a07f65a4ba
SHA51255935b9247d55db3314bb2bfc64384760d2710606b2070ae9bc9c990ddb9b0be9b735a0bf5023699ddd03211629370b8010a965d61c9738200b0a82f2c7364a2
-
Filesize
99KB
MD534e27fad1197c1f4cb3f25db94b68d16
SHA1939fb261446d2520b9c5a6e0bfc5862234ec8e3c
SHA2565ca1a33cbc9e2477d7a51eef3834521733844dc19f59ba97f56e61aba667a451
SHA5120e33b8751a80aa89005585b9f00901f1bc1a61a4c54d93877b673d0f4b26ddf91e59c93054499f0492aec9297bca2349a259b76f69fe264dfd1a139682148758
-
Filesize
95KB
MD597aaf0fbeebc0dbac82652c63d1e8a19
SHA180ea27701ea60dbf3ec9422f51537a8f2c1e40d9
SHA256dfe91251b975993f9cb1c7c31188dfe8f0960487a3f94a857a720fb0739be031
SHA512fb4628d083ece18ce2ba224512ca843663746b8c4c7fc9d0c8531058428f370e43b7f1d5de0d0060ec30a19d29e56a2393c7a09f08b94c5c0ea2f7b0445539f1
-
Filesize
2.0MB
MD514e97c831d3eb18a5fe6a708e7b70d0f
SHA1634cfebdabf6fe48ceb2701728055fcf8f3794fe
SHA25643599f53d07c79582db46154043054eeb2b447602b71a6501d8db203783febe7
SHA5127819e277acb5bd4e98af1ddd0ae4e82bd6259df1b797853fb8ba7f260d9d3051d58bede5d5df49ed8e1035f353ca364861ee4ad8be5aa040928cfb45a8716787