Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 21:52
Behavioral task
behavioral1
Sample
3645-onekey-ghost_setup.exe
Resource
win7-20240704-en
General
-
Target
3645-onekey-ghost_setup.exe
-
Size
3.8MB
-
MD5
a64e374945845aaec6ad063e8be450db
-
SHA1
765c30dcfe127cb9c7c246ffa5ebb35040e1ee82
-
SHA256
46d0413084564b4de78218ab73cac481743d6c5756b13fd4ffec7c897b8f75d8
-
SHA512
81afed327679b6e228e06dacba68b5a429ef8255d27158d950d6eae9b2127dee443a849a66fadbdf2f5b5ec6bd4d5a38884aba4812370236615ba1cae2e1ef19
-
SSDEEP
98304:HkpOWMJrMHGo5Bp+6IOYMCT2oOB9sQJ7OW24JRTlnm:EPMJ4Hj+IYMK2zB9tJ712yRM
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2436-0-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2436-14-0x0000000000400000-0x00000000004CC000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Bcdedit.dll 3645-onekey-ghost_setup.exe File opened for modification C:\Windows\Bcdedit.dll 3645-onekey-ghost_setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language 3645-onekey-ghost_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage 3645-onekey-ghost_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3645-onekey-ghost_setup.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000003c98100121d726599ebc08ffcce4fe2554386518998582c84a83de78e8ce785f000000000e8000000002000020000000f9566c3f7aa30439b985049ba638411bd5262c7fca82a120e582ff7b9c9e5f71200000000e17c878dc247c0e29bbf578c8e84ca1f00e1b7806f9cf14255d161c1a34c0b540000000e00affa622ec3ace2edb69aa0986ee7178ce6d14c95f5c0c96848f8de5ba381fc7d52f73bfe7375dd2a1bb931ccb2472c0cfcfa58377b4865fd4972f4b1aac4d IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431043802" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C958C0D1-6587-11EF-90E4-FA57F1690589} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30209fa094f9da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000027daf75c9253fdd676ccd3f617ef1997dc9c529ffabf9ae2859cfdf5e1a21d67000000000e800000000200002000000075c8f673edabd108518f0bb1b2ca69f502b2b59935b03a8874899a94be3da91f90000000670b666b14961f5a134b666c39233ffa8614888f2e08c416caf8f11d73a504b548f82055180dd21185a63f0492bd04e2c9eaffd3c34710c06db6a1757197e2568adceaa21f11ea4ca47e31231f57480146c255e6b219bacd8cbe856d1fe4a9b3db079f683d30e1f6e8f5bf87b184ad0177529f88a478f7d5832656962ea92d85dfb0ac425a48cdda98194bbb33e8f63a40000000617f7d68027a4f2dfbd0a6f14409f4d5c09e752992b55ecc686d0469dd14bee8871e76fa69c210d0f1478a05983b341500eaba087b6dafefc5c5c4b9900d8800 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2436 3645-onekey-ghost_setup.exe -
Suspicious use of FindShellTrayWindow 14 IoCs
pid Process 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2180 IEXPLORE.EXE -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe 2436 3645-onekey-ghost_setup.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2676 2436 3645-onekey-ghost_setup.exe 31 PID 2436 wrote to memory of 2676 2436 3645-onekey-ghost_setup.exe 31 PID 2436 wrote to memory of 2676 2436 3645-onekey-ghost_setup.exe 31 PID 2436 wrote to memory of 2676 2436 3645-onekey-ghost_setup.exe 31 PID 2676 wrote to memory of 2180 2676 IEXPLORE.EXE 32 PID 2676 wrote to memory of 2180 2676 IEXPLORE.EXE 32 PID 2676 wrote to memory of 2180 2676 IEXPLORE.EXE 32 PID 2676 wrote to memory of 2180 2676 IEXPLORE.EXE 32 PID 2180 wrote to memory of 2644 2180 IEXPLORE.EXE 33 PID 2180 wrote to memory of 2644 2180 IEXPLORE.EXE 33 PID 2180 wrote to memory of 2644 2180 IEXPLORE.EXE 33 PID 2180 wrote to memory of 2644 2180 IEXPLORE.EXE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\3645-onekey-ghost_setup.exe"C:\Users\Admin\AppData\Local\Temp\3645-onekey-ghost_setup.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://Www.OneKey.Cc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://Www.OneKey.Cc3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5491efb3f5fa94dbc5ed8749624169b
SHA144ba57fca6016ee3c0cf69fed8fd0964c90784dc
SHA25645e0b0044f22c359dfad8099b59b513270fa9e454c6b5464bfd806756eaa254a
SHA512bf6cb7069b374c87b7d0f5366dfc8c52f3f8852f73147a14a5d5c209be5319660f8573af50d34d27534596c69f7e59c4997d6de2842711b82a392c9a4ed42bd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e50b62b60ba18ff4e437b3ed8a0d0e2
SHA14b5a76fe5cb5a3fa8a65677a8e7d0bcc05d70eb2
SHA256707e8763e8fa6ef357f98ce19120749885a496a66dbd123eb73791b63cd9b69e
SHA51298164fb2ef89ddee14ecc87676458a8eb5ef3211ce174251695a243fe4e4c55686cfe64ad80640ee30564584db36e7243d21a5e062dcca44c3f4071a666a9cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5304c64d1d3e413a91ad79100d90132fc
SHA1feb3a0aaf592d17c2ec5c83e560c69eb80df453e
SHA25638a0d59c5f3d8407508ee498d243908ff67458e48d0c3813ed34b23f0b06d0d5
SHA512171c8ad75cc86f5eed937cd124f7dd972091d655d9e339a33e7d8f44eeff9026315d40953e65f6eff2fb8002f14ca2e46c1834255e4465b2f1c63109fc4c9cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a46d71c5dc7e4fee5c3412e3dac7a3d2
SHA131a684be8464d5a45a36c57fb696f7ada330d6c3
SHA2563ac5d9626b0ba1297179243ee9f969ee330525580d3e6e918cdb6d84fb2ae64e
SHA512004ddb671fa2fd521b8ae4378d4032cf755f80c0ab6152caf3617ef4441119aa65fdaea9305058d02092e657a561844b42b8c15867f1803c4030148482413252
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f614b9a165aebb44de92823e430e6379
SHA19d748a414a388407183641dbf4cc284e11d8f138
SHA25639ff6123d9b071ba61a0cc8f952e4a7283dc7e7ba25372496750b706f06f8093
SHA5128e3d8180f4c3679ba3e6865527bcc9cc98456c59bcea6713e9520e4f0cc18d29fc1966644a5257ac9b3a74a94c59749fd161de8e89a024cd8bad9947ee7daff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585baf1a4f5cc09d58b1857f7f2e10b39
SHA1b20c2f53661c05cc29afafd1a0fbf148531f84ed
SHA2565769068c504b324dc051cc6913ff851310fa10adab79049828b7a567dd0c88e1
SHA5127c4eadf8520693a4b1050b7f65970fbfc5935dd0c3574e9efa662881bdcd06ac541854376427cac6d7da8f0a6fb6ab370275bc8ca013f37aa4fbcfad57b8850d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54411e4131e39f940279c0c3459343561
SHA1c6c2e725982df3e13aad6eab2067597ceac4e92e
SHA25662776abc87a38915ff694584eb9955a03fc5038d1eb470449e68c98bc0bb592f
SHA51213006e952bbac1ae428cdc4ff211a2470219df286a110d7a4ddf7f247229726aea8c7ffe8c679337f3d46994a9851ad45d5db4007b4593681c9c3b8a311ea4ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580d5c29323e7024c3c92d4e50f2ba0e6
SHA1c532aac37c05d162d7f0482c98ff387d10fab50b
SHA256183a10797e24c01d47024ec8748b1b0c05d04da64b27fc034c79063a9b640e2d
SHA512b49c8d0c08336ad101cafbaab86a901eb97a5e7d12f348372d958e703d1636403827d3c49ef9b23270ab23f4b912f7c934480924f10a4f065d2411616581e58d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e11c7c6f081553b7ab9c7fad058d00c
SHA1ebcf185bbc3a21e1adb567dcc35041dd9b4ad94d
SHA2568e5d3fa6fee60d85a46e41d46c04dda73f51997beb5734e9b3249a73fda88945
SHA5124c59f39064df0868579209431019c90b70201e8364249869e8b3f6d9990e08f6998c4f93e9533790f6a594455b3486ebf55b6ae209617e95204fbb45eb7fa14c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f9143be323755ac7ef6ad42bc07d73
SHA1bd9f0ff8f8de24e348b08e40bf8e78b452140b8f
SHA25646f0e07a081017235fd2e393f9ea2bab4da272b97b05077898b945471ba7c243
SHA5121fe8a75fee5ef0932d335f489175ffa1895561cb1458a0ee6d79d7dedd9cb1cc769de2e7d52b112a0cb58ee220e783798beba064a954ba8d2417410a785e8604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e584438acc101c73e68979a203daab3d
SHA1d6a6a8c53c3f988a16cc26e584d816a283126070
SHA256052e1957b40904e4f7accd0d04276a14a2c345386c8fce7fe6630f39f9f5ff51
SHA512c487f0976ce03ae12870e48dafc584d4d4d842c75261e356e283e6b7d54853511d8a89ad78c28e3043da9c884d3d7b897207ca01cb727f04e6d615f189735dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d9a551cc221f5cc13082581167aec74
SHA17e3f7c2369c3605c129d7171704af1f60f5582f0
SHA256f2e63cf391140945ed23bb541ff5e7f12a1e1f72ebf477de69a6f190552faf6b
SHA512ce67d98a5b3c2dffb480fac0ea9f3579a67d2abaa8f767e104c29a67bd583ccc88c70bfbd67f3fbe91dbd211be6e2471ce8cb3d913d5bbe50ef097937230d0d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587aef5d75ff1c5ee640841a8c745d608
SHA12950af2010daff3067dae3fcfd0028730dce079e
SHA2569dd8eed03d70007adcaaf5da3462c3008a0e81618886cc948329f6ad44ccea77
SHA512f30e9c3aad68b64743cef4afc78ae77c823c6644fad6e7873681fae37a5e4a7ed8a98844a100322abb937963d7eece06d8799e846e3ec4e45fc0d04ece9268ac
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b