Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 08:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bit.ly/3Ljov8n
Resource
win10v2004-20240709-en
General
-
Target
https://bit.ly/3Ljov8n
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133655054356570011" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3068 chrome.exe 3068 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3068 chrome.exe 3068 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe Token: SeShutdownPrivilege 3068 chrome.exe Token: SeCreatePagefilePrivilege 3068 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe 3068 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 5016 3068 chrome.exe 83 PID 3068 wrote to memory of 5016 3068 chrome.exe 83 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 2280 3068 chrome.exe 84 PID 3068 wrote to memory of 3960 3068 chrome.exe 85 PID 3068 wrote to memory of 3960 3068 chrome.exe 85 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86 PID 3068 wrote to memory of 848 3068 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/3Ljov8n1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa560ecc40,0x7ffa560ecc4c,0x7ffa560ecc582⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1844 /prefetch:22⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2196 /prefetch:32⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=376 /prefetch:82⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4872,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4884 /prefetch:82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD569b532a5c8b3a57111ad9f53d937aaf6
SHA1bd7f2cb70ad86eaa10d084295bc0db255579ed13
SHA256737c808a2e873ee4e4a8346b3d0c00a919f46c438a5f3a60adff22c4a00b5a7b
SHA512dc3e0eccc9e0b57d07d656af2ddf87b3767ac6896791f489ae4deb86c26e213404cf86f47d98cd5b18309abeee351e939e7d21cd269427dace96416a5dd706b9
-
Filesize
1KB
MD5cdb3f1e590dd00687c79a85db46c3880
SHA1219050259d014a633e93027290e7d9ad3f5b1c7b
SHA25643607152c80aee14b7bd42a2879d02b27c99b26c0adfc5830dfbd22a2a25561f
SHA5129353c0b6be574655c5d8b8bfe0140e6038bc145fabd64bbc19560da91b0e99f57809093756eb27472bb19a3d6cb28380842d10a52b6b7d859989fe8792d5e0ce
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD54935af3dac1871bbf18e68226418ae51
SHA1160cad3f5f46b978cf3ecdaab17414bdf721cafa
SHA256cc10fb329dc940aab8790339389abf03ce523c71e25a9d3c24b3a015b872703c
SHA5120c23fc876bb334dfc00bffebd9957ce0e270fee986529eb802005f2fa11a998d3af841dece60ad5b5cc934706c257d7d9d41cc46e51d3284069c2f3ffe0bbc85
-
Filesize
8KB
MD59e1887cf4f5e992a9a80007c5e37a26b
SHA11027b461733cbba86e75bee3177c435129b80a68
SHA256d28b2bff93c12bcd0a282a4e37666e6e5980c955870be322fc3c1ef125d0be29
SHA512402a1b096e1f15c2f29e083de5d9d98d72465e5f31851100b5a3b1c8c4b20d7e5cb291c6cf7c64f0da0daed9145c226d0bf797c6b8a8a14419ac749b19ffec07
-
Filesize
9KB
MD50a73eb3197ecbe47e88517222c7f0d7a
SHA17c59df5e4839421d57e49f9fa7afebdf4034ac35
SHA256cf1bffa16cc6433a9fb01cae0b278f073cc9a8d6fb900e4e6ad2ca3667da37b5
SHA512f53c31aa78385bcab7df76a8397b4b1e0b2053dc5d92ec0bf5c1a41a2257f10b2c50086dfb78dd4d4be06732f0aaef0edf4f76b3392aa3f13dfddbb8a3ec3e90
-
Filesize
9KB
MD5fbba223be50ddb194a0825e1ba81167d
SHA16cffe9fd022104b720f2a0eec8ad04e7533fe15d
SHA25675a5f9f59b48ebfe0f65df182628eea392728e40bf10c34875fbe6ba010897c7
SHA512579dbde6cf9913c69a35a42aa90f3aeb6b3587e2f0de4a061de1bd33dfb292763fd90af93d2f9cb46be9469de04c1d9b023c467d03b187f7c08681cc6950fe58
-
Filesize
8KB
MD53101a2fe42faabd8ad974876d6c7f2f9
SHA168cd10af495760f2f4cbb7db2ec2e51db4061625
SHA256a4fdfc1c185fa5573aca21bbeb2d06f0138b79a7dab4756e319448b49c655d8a
SHA512468cadf3ef64cb72b670340ac0b9fe387f4f93e24fd3267e3ba1e5638b39480c520fe5de1ec8fb25ae98902e161312c445cc6a223a26fd6a25bd4216125474be
-
Filesize
9KB
MD5c27113d1ce870dcf79c74515e46ab555
SHA15d71f8dfb1620ac2baa559bdd1261ffdab0e47bc
SHA256288338db8b14a54ac2427bd25968c9b0ac2bd709040eef1c97ce45887865513f
SHA5122e2d1512d60d73c6873a4dd77d6e905dd9f2acd43d3558c19ed4d1d303a3037cfa8f5fb5998e7ac42e26e1be6cc7780e606e7f539484373e4972f59e129e5e96
-
Filesize
8KB
MD567a0a8e9b397e34b1fb9bfa49fe2a7b2
SHA11ecf13bcd5002899f9e93dbbe995c39547ef53df
SHA256ad6bc23d58ace21f5002dd390748cf6d181426c9dbdbbbae58f67b5747f095e6
SHA512e2828c27419da5aac367ff08f8c9f6994cd3c44fd882972d72c328e785ed0a487a48cbd4371d548c76c2659b48f7eb9c5cf74586efcd3919059fb2666f715bb8
-
Filesize
9KB
MD572d00451de5a349b7ddec63300a4eb83
SHA1cff7e591af1b8c249396a06a33cb9f3b087cf2ed
SHA2569cc07de51d111d4550d2ded78f99706a31a4ae5044256bb52934504a11fe5f1c
SHA512da54d9859103573a06906fc3ab8073176225aac648d814e71993f2299471a552362a25faee0dbfd437207f34473a285e566d957d149f66d500d3c10ea42274c3
-
Filesize
9KB
MD58692228ac995d3d5f556567437c3bee9
SHA161ed6d32de1bc23a12fd889bd345258809cd3d1f
SHA25665c4c5e72fa5f76df381534b7d07eba1acd9cad02d2b816c189937f96c7982ad
SHA512d62d2af5d9907c1e41d1a064d60c80071b40a91448f2585980ddc819869bbf7ce67e3d0557070cdee848dd4abbe1a254854017b6a6fcbc60fcbb49459f49834d
-
Filesize
92KB
MD512ccf9aadfa5130c96dc26d3b9f5bfc8
SHA17072775b004ff195109329fc6cc7e1107b15e659
SHA2567e8c127d0ed0da9fb7b230ee38182352ac2dc9d1bc681c77e9e3d6fd4933d8fa
SHA512421d2489041e59cf65f289b7a60f392e22cf55a5d66f05bfc2d0827b6ba90e352590fe6b47a42680d93fe7ca542136f1006edb49c3f7f5982a98e4ac79faf386
-
Filesize
92KB
MD5facdf0f1bf7602bcc4b514ef9a6b7718
SHA116496c4912e76a2478eb26f79da4bff1400f8a11
SHA2563ff121d948ddcff7874bb0cddbf88b1cf27cad4e3ba321dd15be371ff7a451ce
SHA5125527d8f0871fa102c3181722776ad113c70bc7c09b7b56fb7c432d390d9e8a2d4dcf421040c94e2508e99a16a3695d8385045ae9fb9fd7e4922ceafc0126a8eb