Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 19:53
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=wmftg807.piandao.org/[email protected]
Resource
win10v2004-20240412-en
General
-
Target
http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=wmftg807.piandao.org/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580300132840291" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1812 chrome.exe 1812 chrome.exe 4228 chrome.exe 4228 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe Token: SeShutdownPrivilege 1812 chrome.exe Token: SeCreatePagefilePrivilege 1812 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe 1812 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2268 1812 chrome.exe 87 PID 1812 wrote to memory of 2268 1812 chrome.exe 87 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4900 1812 chrome.exe 89 PID 1812 wrote to memory of 4204 1812 chrome.exe 90 PID 1812 wrote to memory of 4204 1812 chrome.exe 90 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91 PID 1812 wrote to memory of 3708 1812 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.cm.morganstanley.com/r/?id=h1b92d14,134cc33c,1356be32&p1=wmftg807.piandao.org/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9e9bab58,0x7ffe9e9bab68,0x7ffe9e9bab782⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:22⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:82⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4276 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:2844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4380 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4408 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:82⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4224 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:82⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4292 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4400 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:12⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1892,i,17804383124167200895,2520226067051789311,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4228
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD5fb4da994ded2621f8193bdfd9ba19ffa
SHA1caa7e67667da5623eb5f7695ded3b67f4e5d06f9
SHA2565e691b6134c1896e6bf075182f7c1bae3cb0d24553c761ad8800848081e449c6
SHA512e8eef98d0584d2c3267ea81bd3c205ab684619d1d5caebf316ac3c700dde92da9656af62ee9f7f7cbb904298948392854cbb24ad16bda0d405554472b4b9e7ee
-
Filesize
192B
MD5f76912c398c182bcf34be6ed93bd27db
SHA192b589b9f0f511c9be4dd320d4fd6a6c7ea0708e
SHA256e801fa170657cc326938a8d3c629796bb2f7a5c4d50eea5b8bfea041362af0a4
SHA512b18c4a08dc271dd652d1c7c31ec768a54ed1e012d99bc0ad8751fe6677bb40d6cd9c49e1471a9f10cc779079236ff884fdb07d29bf626a7e437ee8c2461e6701
-
Filesize
2KB
MD59e7ca52ada5c3a0484fe8ecda896e411
SHA102f7e9d34010d95340b89970bcbf290157609a94
SHA25638715cbc575438eff22542bd4cedbd66bc0d7e06fa1045cb77cad48a6907dc60
SHA512e88fbfd7bf651caaa7241c32e7e662830c3b772654c701e07294366a9c8d7e67fd889b01a609d7d6cc697e167c3bcf1e117759e7f38ee8630234eee79e375520
-
Filesize
2KB
MD5ed35ceb2a8bb064e94b4f81d8940ca22
SHA195113ab036e2ba4a8fbce7278cbdef417e857eb7
SHA25699f33a90d29e20779771847ffc0eb1986e9ee9394142b81e5b2ffcbfd339e4fd
SHA51222e03e8e79b6ec1a724cc0cf7e599bb00303bfe47a822b9e526bcc63f8de370f2e6cd38ee49a865a651b436889088fd1386357863430beb8e4650de3d8204927
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD59c05f623e59818939a14a19d53941b43
SHA13e1617e2edf00abd6e62c47997d6e93236eceaac
SHA2565f40d9849468ef35c998c6958f1fb1806b84aa98c1db7bb8aba4aaf7202e0100
SHA51283dd6078d48428350f166b1bb22d26c12731ca651d9f45462a24d924a091e055d837a5b824ed3e9267b16736bce5a654be74c7ba75c1aa9e177411573edaff70
-
Filesize
7KB
MD5c0b236fd289d7289243762eaea833c9e
SHA1701af482b1d84a75d95c76835dc267ab1f12afdb
SHA256f8d8af7cf18def7f84ca7b8a9eef83cc4a6b606f5bc80f0011afa8e020342efb
SHA5120447240654dfd6b02d02ce8389b494359edbf3cd8ee91646c59e08a2fd6f213ff1e40a8743ee43c529702516eda3651cecc69ed8ff3a8d4e3b10d5a8d7299d2f
-
Filesize
7KB
MD53f76612b09990a154e744250f56f9819
SHA169ee4a80b95891a6c84e9c3df5cc9c456bf0693b
SHA2560275119e6d055e4780a52dde303b83172ac5fa9a98d74a2e7aea5745f5d77d28
SHA512b20723000c04198170b8031d40c0d1feaa19d7861ec8981488913247cb758048abef4172e4ea7096ab8544e1ea8a6107e1ec94880e29db137cddbbcee315bcd9
-
Filesize
126KB
MD56979a276bde145c25fa8286b6bd1b1b0
SHA126f994d7fae6de5f7a56d0f96db536ad202acfa8
SHA2564e8bc1758ed6ae96529dfebcc54a22de705aed18b2eb1c02b5235d587496ec93
SHA512485753e623bb9c198d43c35eb82183884a3669254ff91080a525052931e5159c782d158a5c0718d5772e16f81b16cffdeeeb07217271e9ac2172ffbcd05104b6