Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
357113e6cab...0N.exe
windows7-x64
757113e6cab...0N.exe
windows10-2004-x64
7$APPDATA/H...xy.dll
windows7-x64
3$APPDATA/H...xy.dll
windows10-2004-x64
3$APPDATA/H...ep.exe
windows7-x64
1$APPDATA/H...ep.exe
windows10-2004-x64
1$APPDATA/H...b1.dll
windows7-x64
1$APPDATA/H...b1.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
1$PLUGINSDI...os.dll
windows10-2004-x64
1$TEMP/HssI...er.exe
windows7-x64
1$TEMP/HssI...er.exe
windows10-2004-x64
1$TEMP/tapinstall.exe
windows7-x64
1$TEMP/tapinstall.exe
windows10-2004-x64
1HssWPR/Hss...er.exe
windows7-x64
1HssWPR/Hss...er.exe
windows10-2004-x64
1bin/HssInstaller.exe
windows7-x64
1bin/HssInstaller.exe
windows10-2004-x64
1bin/af_proxy.dll
windows7-x64
3bin/af_proxy.dll
windows10-2004-x64
3bin/af_proxy_cmd.exe
windows7-x64
1bin/af_proxy_cmd.exe
windows10-2004-x64
1Analysis
-
max time kernel
101s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
57113e6cabcb9b9683243e402ab09710N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
57113e6cabcb9b9683243e402ab09710N.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$APPDATA/Hotspot Shield/report/af_proxy.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$APPDATA/Hotspot Shield/report/af_proxy.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$APPDATA/Hotspot Shield/report/af_proxy_cmd_rep.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$APPDATA/Hotspot Shield/report/af_proxy_cmd_rep.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$APPDATA/Hotspot Shield/report/zlib1.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$APPDATA/Hotspot Shield/report/zlib1.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsisos.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsisos.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$TEMP/HssInstaller.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$TEMP/HssInstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$TEMP/tapinstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$TEMP/tapinstall.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
HssWPR/HssInstaller.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
HssWPR/HssInstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
bin/HssInstaller.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
bin/HssInstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
bin/af_proxy.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
bin/af_proxy.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
bin/af_proxy_cmd.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
bin/af_proxy_cmd.exe
Resource
win10v2004-20240709-en
General
-
Target
57113e6cabcb9b9683243e402ab09710N.exe
-
Size
8.4MB
-
MD5
57113e6cabcb9b9683243e402ab09710
-
SHA1
fce100b45b4700974c481a3e7487545851bc6661
-
SHA256
397ff48f9ae2034c72bb9428427fbf6eca8df5b215723ba31094cf323f32df5e
-
SHA512
da3042489a758f3b785bc28a303260a140ec7e730e10f14715acacd9804bff132c1f2be439fd2597a11e14aafb2e2cfaa25b5ef283c5770c216d55e9e7981c2f
-
SSDEEP
196608:KuqYM3svK25H5gABbvqlFl2J1GJySPHnlN5NRq9PeLra6ykCShF:KuPMKK25HvhvqlFJySHnlJIuaPQ
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2456 af_proxy_cmd_rep.exe 2704 af_proxy_cmd_rep.exe 2692 HssInstaller.exe 2652 HssInstaller64.exe -
Loads dropped DLL 23 IoCs
pid Process 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 2456 af_proxy_cmd_rep.exe 2456 af_proxy_cmd_rep.exe 2456 af_proxy_cmd_rep.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 2704 af_proxy_cmd_rep.exe 2704 af_proxy_cmd_rep.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 2012 Process not Found 2652 HssInstaller64.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main 57113e6cabcb9b9683243e402ab09710N.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 57113e6cabcb9b9683243e402ab09710N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 57113e6cabcb9b9683243e402ab09710N.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1244 57113e6cabcb9b9683243e402ab09710N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1244 57113e6cabcb9b9683243e402ab09710N.exe 1244 57113e6cabcb9b9683243e402ab09710N.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2456 1244 57113e6cabcb9b9683243e402ab09710N.exe 30 PID 1244 wrote to memory of 2456 1244 57113e6cabcb9b9683243e402ab09710N.exe 30 PID 1244 wrote to memory of 2456 1244 57113e6cabcb9b9683243e402ab09710N.exe 30 PID 1244 wrote to memory of 2456 1244 57113e6cabcb9b9683243e402ab09710N.exe 30 PID 2456 wrote to memory of 2704 2456 af_proxy_cmd_rep.exe 32 PID 2456 wrote to memory of 2704 2456 af_proxy_cmd_rep.exe 32 PID 2456 wrote to memory of 2704 2456 af_proxy_cmd_rep.exe 32 PID 2456 wrote to memory of 2704 2456 af_proxy_cmd_rep.exe 32 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2692 1244 57113e6cabcb9b9683243e402ab09710N.exe 34 PID 1244 wrote to memory of 2652 1244 57113e6cabcb9b9683243e402ab09710N.exe 36 PID 1244 wrote to memory of 2652 1244 57113e6cabcb9b9683243e402ab09710N.exe 36 PID 1244 wrote to memory of 2652 1244 57113e6cabcb9b9683243e402ab09710N.exe 36 PID 1244 wrote to memory of 2652 1244 57113e6cabcb9b9683243e402ab09710N.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\57113e6cabcb9b9683243e402ab09710N.exe"C:\Users\Admin\AppData\Local\Temp\57113e6cabcb9b9683243e402ab09710N.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Roaming\Hotspot Shield\report\af_proxy_cmd_rep.exe"C:\Users\Admin\AppData\Roaming\Hotspot Shield\report\af_proxy_cmd_rep.exe" -P -H hash -O -T it -o 7 -u "http://rptx.anchorfree.net/wr-install.php?dm_ver=0&ver=3.33&ch=510&state=initiated"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Roaming\Hotspot Shield\report\af_proxy_cmd_rep.exe"C:\Users\Admin\AppData\Roaming\Hotspot Shield\report\af_proxy_cmd_rep.exe" -H hash -O -T it -o 7 -u http://rptx.anchorfree.net/wr-install.php?dm_ver=0&ver=3.33&ch=510&state=initiated3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704
-
-
-
C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe"C:\Users\Admin\AppData\Local\Temp\HssInstaller.exe" -iswow642⤵
- Executes dropped EXE
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\HssInstaller64.exe"C:\Users\Admin\AppData\Local\Temp\HssInstaller64.exe" -installdriver -c ndis62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD562667b2892588f68e441ddbff883051a
SHA13c542d2b8e6f88d2b2b238ac1c0408a46de8a98e
SHA256a36d7361214dd47cce7be4b7a7816f8a84758241952a3999ae96a2b5761ee890
SHA512cd6393c6181655fd263f52fc3f41abeb60f2f6dc4cb847ac0bff77df7cab55318153a7e1b7b535775281635b4af461fda685939fb849e4ca6b9887e627909c64
-
Filesize
14KB
MD528eeb04c43fd1613611061d468947c23
SHA16763f84ef67731236d3aaf19275a71d16b42b212
SHA2563e5f2965ad61a2eaa80044a7365bcb0c248a318b95ebfb2c9448d3f157736a80
SHA512af730bbfe3dab6f1b0629b1fc8d92515ae6db7f5efd4cb35ac6f740aa8512fe59289721707844dc8443b88ce604913c061d4031f3dc59724d8dec01ef9464531
-
Filesize
8KB
MD5eb275f9a017b54f3e4a6d5fd790d0164
SHA18732c8e079eda85345b7d50b5c4ab8043f4a920a
SHA2569e7980681c4bc9c2296a437aba15858bc3eb5df5782be37e88a67275199f19a4
SHA512eb5570adca253caf01c6023c7b4587fbfbc0fb2da1cab47242c3a807c7ff754dec9e30c7ac7d58225afd28ca5b05887ceeb932ae5bfe7e69b7c26cd219d87640
-
Filesize
12KB
MD57b05c522a7176e197d8f966dfe8cdc4d
SHA19fcfa794070c35d0339fa166c1eae46adb0068fc
SHA2562e450a2d7f2249e7592e5b300f22a2e13544482e6abc56e18240d6a588f65437
SHA5120e1f8bdacc371ab49476cc38fcf00a20b4e31a6afb130516d9085327f9670078716047b610f85b922058d60757d8138eaec87e095522c30b280ebfcf2e81ff91
-
Filesize
5KB
MD564515a4b603ad58c7b31bfc6d63f6be3
SHA17bd6ad427a7b22b31134004172bfe084b78c6e39
SHA2568d83ceafaaef249d504a8a127a628690ea382cc5d7a54caf71bedd2350406ffb
SHA5123b22696c8daf425fe439af97040d54cd60a169a10617e97889cd23598904cb46c1cf3b7752182509db013475ffad086860bffab396881878ccaaba3973c2552b
-
Filesize
4KB
MD5afce92de677bd2acb7b137f85fc44d8d
SHA1961c88fdd5cd7d8262d74928cf1ebc4080661132
SHA256386fb876b065b82e935a66dca519c312ba5c96c664b069117f022a8c6653f616
SHA51239bb70d37b8308d07060630ae52672df9f7dce7f6b67ebfcbc450aabfe2e76ad07408388f9469a9a4a3cbe43f1947c6ca9ba0e55f16a35bb84d86a61cf1aa953
-
Filesize
7KB
MD5222977c3bdfa7222564d51f88d7a69e2
SHA1b242469dd2447600cc17f8d571ac6fc41f7fa214
SHA256c39f59a35686a1bfa6ee1ba104e9a2e2197270d324cb4a2259dfc0c0cd746c17
SHA512dd7068e82301de97ad884ff7c016ec77dc90813a4de05200f8b4334bf21a2c4cae29bfa8b0f925024a81f84c21de3837b156e7cd5b592adf260aefe823f93ba9
-
Filesize
2KB
MD5d5e28cf648c49ea1bd0e5af64f40260b
SHA180a6f7dbd8e0b8072c2a9c692b10c1ddfa754586
SHA256e2bce29513c8a09c127a3b05b2148b5fe6e788f9060e6c60dfb781676aa86ddb
SHA5126d5b6aadc825fbdb889dec058445734f428e322a61a55a049e26977c6eb46113fead834c0101b6c558e21cd41a0c9c8ee11e23eeb327c0c778aacdada0fdab10
-
Filesize
357KB
MD5548c9b52b6c3e070779a64938057bdce
SHA1d6023754d0f3296dfeced8443c3e1111b5d4907b
SHA256a6560bc5d0039539bb156c404ba6723732f77ac0bd67f5ff2ec4cf11226298ba
SHA512f8a157b177a813164e416640d4bcf14adb3cc961d2e928eeea70b76994c01cdecc7b3bf5bc4914afe16a10372561cbc6f9aa6cfa8bda87726dca02ce2c294cf4
-
Filesize
21KB
MD5856365cc5249af28388514765cf37377
SHA1a515a9b9fae3e55220fcbb1d6d4e07ed9c47fe0b
SHA25686991a8c30cab5a96b4554726f4cc22820413010773416f92f56c8eb7339f5cd
SHA512ba592fc5b367f50ee44b5ec8a7c35b9de77052cc4cef7f5eef0aad896ea8e0cb435932e45b64cd04f496ebebbe9375fe7514cbc013d1d8647f371fdf54c2a7fd
-
Filesize
9KB
MD51b6f8e5a5aaaefbb8780cb245c3771c4
SHA1134d11153e9f998ba2dcd52de7a432d6aaf14352
SHA2563a934717fbadbc907d0650cd4095474380603fcfb403a02ca7d3dd5ade277d57
SHA512949e7110f844dc2f6a921b6db7e0d98eca21b629468dd44afa040dc2ce09345673b00f7541ba295731da3518e71dc0cd24e9948b2642cb71fd8ea2c312170311
-
Filesize
934KB
MD53388d55bc7d9eb92982d342299910494
SHA11aa8fb72c4fc2f2d7e9e3824a11092701662efb9
SHA256ac0c99a3ae9be803993d7ec8e346d62477425f591eb7c4854d4a0a3c0a1c2a45
SHA51251742f95f3b710229e13e429fd737a114e8f10ca7c73ad6307059dd6ade58da7a7e470274467f91ba63654c738fd87eb255573f9bc851a8df4b034297df04f7f
-
Filesize
73KB
MD5c7d4d685a0af2a09cbc21cb474358595
SHA1b784599c82bb90d5267fd70aaa42acc0c614b5d2
SHA256e96b397b499d9eaa3f52eaf496ca8941e80c0ad1544879ccadf02bf2c6a1ecfc
SHA512fed2c126a499fae6215e0ef7d76aeec45b60417ed11c7732379d1e92c87e27355fe8753efed86af4f58d52ea695494ef674538192fac1e8a2a114467061a108b
-
Filesize
216KB
MD5b4feda373d0253d801fce3867325178b
SHA16d081fbcaf2c09b81ec5ded445aa6f2c05295447
SHA2565985b9c01541f9477a8828adc5e2cc5e23f5053b60a28335c3e32a7f0f5d17c3
SHA5127900ba58a96aff5100b632685897d1e3553cab7c25727ced6a45bb8208e8893c92a954168854a93d2e8e65d805a71d2846c9c7d9be3c6c490ad2973b0219e6de
-
Filesize
191KB
MD58b347f1954b13dd3be84421f95ae7038
SHA1f7dd4f7c3829121d435591d5600b2631a2c20d55
SHA256069ddd10aa52449d98da96f612ec02af2dfed3b999cf04e419415d905f2b238f
SHA512104e0010d75e7bb6377c0a7483b8d9ab0941d72ac61800b4580b1ad9cadeefd0f823807b14ea9ce96fc85d5537c8b7efa3bc1c4f954a6a077c53069ef67d0bb1
-
Filesize
11KB
MD5b9f430f71c7144d8ff4ab94be2785aa6
SHA1c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
SHA256b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
SHA512c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099
-
Filesize
4KB
MD5351b802508ee5462cbf7f35454a9dca6
SHA17b9a1bc758e10af02124143680f636853b421da1
SHA25639275ee1767aac3ae0929a3e67a84a921610b45d5cfff3db1641893504d5c78d
SHA5126b0a4a500597fefaceb5eab79737d4f8dd253bb6bf8c263699314deda417763857b4407457d877b28f7a9c1f40a241d378ccae80c68541ff3f102eac8a6ff8d2
-
Filesize
9KB
MD57823fc560926dcd8741de6f0b900083f
SHA193dc0a704bc0b8f90668548e36daf459be0ae10a
SHA256ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
SHA512c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9
-
Filesize
6KB
MD5783f9ced5ffcb3dc0972f9eb2d4cfba8
SHA1999523b7f11e4ba08a6f23cb9a40e5323c4a6a25
SHA256a99c45c1c9522f99955618cbe4212091b2018e5b1bd4231687970589a2ea015e
SHA5121cb88a698aad36af30a2ae3e07167eddcafda7f31bb1e90fd8dd8f419efa72b356a6e9a2d53d850c211a2a5a974b8503ceb1c794eea3218e008f6d2e3213b40f
-
Filesize
5KB
MD5b1e1f665d57874de41df72dda21bc6a9
SHA14898d7b41b48ef6350b0b6730805f201e52e4cb4
SHA2560619ec35b9632b28d84e39343b6dbc5ef9732c85f1ca97c05aee744d22b7e930
SHA5129f3a5fcab235d15d2f477ec335d08a490c889842c227aed49179dab4fc909221c66d9d6110b465da8a4a4b07cac07192e22b1fd62d96e2494baf510858ea004a
-
Filesize
339KB
MD54b4cf64895d2fca31952a2b8b89080dd
SHA1ca69c2779ef12d405e0de134b071a2db63c01a89
SHA2562f5ca87b9a847dcebb52fe61249fe98cb400d4ab33250cecb4d414a35e40da1d
SHA5124b705df027f1f46fb043156fca7d66d882fddc5805029f6c55459ccd65a38fadb7777c2becbfe3d2f6d9014109936aaa0996160773342e277df704cf5cdf420f