Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/08/2024, 11:43
Behavioral task
behavioral1
Sample
Kiwi X.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kiwi X.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Kiwi X.exe
-
Size
232KB
-
MD5
2596fa2e15a1b36f7a2991d13273069a
-
SHA1
d8f5f6cefa50b7f2ec9fd000b1dbb91be8c2c6cc
-
SHA256
380254c0766fe7807b96b0821fbfcb19ad44dd940470ce7394670f8f3ccd253d
-
SHA512
0ae8b60db19e3bb5d0b04213d93af51b48c6a8f9efb39f6e379c737ae31a3807020ba5bc6d99a743aee553e4c97f372e3e52e426256c35d5216122c1da037e28
-
SSDEEP
3072:joksLZTYF7E+Ek6F8RI6bRo5kadAazSa/JS+:joksu6F8W6bRo5ZdAazzh9
Score
10/10
Malware Config
Extracted
Family
mercurialgrabber
C2
https://discordapp.com/api/webhooks/1271117251801645089/MuojAO-bwKmYs1M70Ksk-LzjtJUiYpSVPHmfnf6D6ERqvMAHmv770yrb4BpBhgkI1dqc
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Kiwi X.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Kiwi X.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Kiwi X.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip4.seeip.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Kiwi X.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Kiwi X.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Kiwi X.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Kiwi X.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Kiwi X.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Kiwi X.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 Kiwi X.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2572 Kiwi X.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe Token: SeShutdownPrivilege 2080 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe 2080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2292 2080 chrome.exe 33 PID 2080 wrote to memory of 2292 2080 chrome.exe 33 PID 2080 wrote to memory of 2292 2080 chrome.exe 33 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2168 2080 chrome.exe 35 PID 2080 wrote to memory of 2656 2080 chrome.exe 36 PID 2080 wrote to memory of 2656 2080 chrome.exe 36 PID 2080 wrote to memory of 2656 2080 chrome.exe 36 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37 PID 2080 wrote to memory of 2836 2080 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kiwi X.exe"C:\Users\Admin\AppData\Local\Temp\Kiwi X.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74d9758,0x7fef74d9768,0x7fef74d97782⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:22⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2160 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:12⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2168 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:12⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1408 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:22⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3260 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:12⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3512 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:12⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1236,i,15847553590746502995,16815519560781456456,131072 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
5KB
MD581a082eb2897763a22859c8f1c7a3d5e
SHA18f9d8ba1b265a248649e6092e293171e42add321
SHA2561b8b4bc69eaa04604e1d5f071bc9969f4112755df9f7901fa13d8f5cb97d5180
SHA512eaf55be5977695869a0bb658cc5a773db414de8a19923cf99a13c79fb9998fb99c0cf2b5a1c458ccf2afad6c121ed8ea9a1651a32643f6e7e7fa5d8681dc86a5
-
Filesize
5KB
MD533502fbc29578f6125671c132c2e3c57
SHA14c4d677794ae9386ff748c87676eb217e019a612
SHA2565a5df2bde4fa534b56a61f4304bdbc5176b887ea7e584686e90e51e0903b697e
SHA5125ade25b76d28a3074abb3f3ff5aeed17a2640a1111e6f8039ba953a7136b1bdd3ed521941f46f30f60745b6e9c94d12a9790b049198a1aea7abf449d659acbad
-
Filesize
5KB
MD59db2137b1a689b529ba578ddaaf6cba5
SHA11a8f71e51f87f8b4c69d4d0806309a90674c7c1c
SHA2565ff4f6c050668eb110c3e93b1cb005cbfc045dcd4397d6a0ee1221110c1701e5
SHA5123b533e234a36f44cac35915676e06503ce0ab00cbd08d696bc1f97552cb10a7d83dda776c0227f7be7e967a72092ed135b273cc79d71529e64522001bda71dc8
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2