Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe
-
Size
268KB
-
MD5
4a81c468848ccb72bdff2659ae2f68cd
-
SHA1
b92ffa0f3c5563fc120eb41014f0dd97e3fa72ba
-
SHA256
802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7
-
SHA512
5d6c11f5f04caba89f9f5455f2b913d036daacca81f49a89c9cc1e95cb481f2fa199749804405740eefd4501d1699a03029a08c766d6248facb60aef326e7dfa
-
SSDEEP
6144:9tCqTBNo3vgPqPJvjUM/1n/kmSouU8rv9t1c8:9tCqTIpZjP1/juFn1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2692 AAEF.tmp -
Loads dropped DLL 2 IoCs
pid Process 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll AAEF.tmp File created C:\Windows\SysWOW64\msvcrt20.dll AAEF.tmp File created C:\Windows\SysWOW64\setupSNK.exe AAEF.tmp File created C:\Windows\SysWOW64\d3dim700.dll AAEF.tmp File created C:\Windows\SysWOW64\ir41_32.ax AAEF.tmp File created C:\Windows\SysWOW64\msrd3x40.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll AAEF.tmp File created C:\Windows\SysWOW64\mfc40.dll AAEF.tmp File created C:\Windows\SysWOW64\msjet40.dll AAEF.tmp File created C:\Windows\SysWOW64\msrepl40.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll AAEF.tmp File created C:\Windows\SysWOW64\d3d8.dll AAEF.tmp File created C:\Windows\SysWOW64\d3dxof.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll AAEF.tmp File created C:\Windows\SysWOW64\msrd2x40.dll AAEF.tmp File created C:\Windows\SysWOW64\odbcjt32.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll AAEF.tmp File created C:\Windows\SysWOW64\crtdll.dll AAEF.tmp File created C:\Windows\SysWOW64\msexcl40.dll AAEF.tmp File created C:\Windows\SysWOW64\mspbde40.dll AAEF.tmp File created C:\Windows\SysWOW64\dpwsockx.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll AAEF.tmp File created C:\Windows\SysWOW64\olecli32.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll AAEF.tmp File created C:\Windows\SysWOW64\d3dim.dll AAEF.tmp File created C:\Windows\SysWOW64\dplaysvr.exe AAEF.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll AAEF.tmp File created C:\Windows\SysWOW64\expsrv.dll AAEF.tmp File created C:\Windows\SysWOW64\ir32_32.dll AAEF.tmp File created C:\Windows\SysWOW64\msorcl32.dll AAEF.tmp File created C:\Windows\SysWOW64\msvbvm60.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll AAEF.tmp File created C:\Windows\SysWOW64\mfc40u.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX AAEF.tmp File opened for modification C:\Windows\SysWOW64\msvcr100.dll AAEF.tmp File created C:\Windows\SysWOW64\regedit.exe AAEF.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll AAEF.tmp File created C:\Windows\SysWOW64\ivfsrc.ax AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll AAEF.tmp File created C:\Windows\SysWOW64\rdvgumd32.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL AAEF.tmp File created C:\Windows\SysWOW64\ir50_32.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll AAEF.tmp File created C:\Windows\SysWOW64\iac25_32.ax AAEF.tmp File created C:\Windows\SysWOW64\msltus40.dll AAEF.tmp File created C:\Windows\SysWOW64\mswdat10.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll AAEF.tmp File created C:\Windows\SysWOW64\dmscript.dll AAEF.tmp File created C:\Windows\SysWOW64\mstext40.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll AAEF.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe AAEF.tmp File created C:\Windows\SysWOW64\explorer.exe AAEF.tmp File created C:\Windows\SysWOW64\mswstr10.dll AAEF.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll AAEF.tmp File created C:\Windows\SysWOW64\sqlunirl.dll AAEF.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll AAEF.tmp File created C:\Windows\SysWOW64\dplayx.dll AAEF.tmp File created C:\Windows\SysWOW64\msjtes40.dll AAEF.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OL.SAM AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMWIN.FAE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GFX.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TaxonomyControl.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLMIME.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RECALL.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOA.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XPAGE3C.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll AAEF.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll AAEF.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLACCT.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL AAEF.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\ANALYS32.XLL AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnPPT.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONBttnOL.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHEVI.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MIMEDIR.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrw.dll AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM AAEF.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE AAEF.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL AAEF.tmp -
Drops file in Windows directory 48 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcr80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_x86 AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SOS.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\alink.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe AAEF.tmp File created C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_atl100_x86 AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationHostDLL_X86.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CORPerfMonExt.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe AAEF.tmp File created C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounter.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll AAEF.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\webengine4.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupEngine.dll AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfdll.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUi.dll AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86 AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.Thunk.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe AAEF.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\wpfgfx_x86.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.VisualBasic.Activities.Compiler\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Activities.Compiler.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.OracleClient.dll AAEF.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\sqmapi.dll AAEF.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2692 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe 28 PID 2756 wrote to memory of 2692 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe 28 PID 2756 wrote to memory of 2692 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe 28 PID 2756 wrote to memory of 2692 2756 802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe"C:\Users\Admin\AppData\Local\Temp\802f4d77fe2bc7c38b0aac65aaa96d3f72cca5a5f9384a96de3d1c4ac65172e7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\AAEF.tmpC:\Users\Admin\AppData\Local\Temp\AAEF.tmp2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666