Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/i5.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/i5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe
-
Size
276KB
-
MD5
2721d2dc342221266f426ebd6a4f90d0
-
SHA1
a35f0e094b0874b8102e88759fdbf615a4acc615
-
SHA256
5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76
-
SHA512
6e877432dd6b4060e7537689b15ccceb1909444a1cd44b6953d00bec94e244f477019d60764bd73d8015992e5985afbeaf1f66b58eb54e9dada5e4c2bc531c81
-
SSDEEP
6144:esaocyLCJdsc9jO0HqzcRc7vBgEhC3U+zV5Di+L9ymRNF:etobGdtZG6czek8Vo+xyS
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2032 i5.exe 2396 50b892e5-d96c-476b-834e-555c5bc06f2f.exe -
Loads dropped DLL 3 IoCs
pid Process 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 2032 i5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50b892e5-d96c-476b-834e-555c5bc06f2f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 i5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 i5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 i5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 i5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2396 50b892e5-d96c-476b-834e-555c5bc06f2f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2396 50b892e5-d96c-476b-834e-555c5bc06f2f.exe 2396 50b892e5-d96c-476b-834e-555c5bc06f2f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2960 wrote to memory of 2032 2960 5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe 30 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32 PID 2032 wrote to memory of 2396 2032 i5.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe"C:\Users\Admin\AppData\Local\Temp\5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\i5.exeC:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\i5.exe 50b892e5-d96c-476b-834e-555c5bc06f2f.exe /t /dT131970150S /e5758413 /u50b892e5-d96c-476b-834e-555c5bc06f2f2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\50b892e5-d96c-476b-834e-555c5bc06f2f.exe"C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\50b892e5-d96c-476b-834e-555c5bc06f2f.exe" /t /dT131970150S /e5758413 /u50b892e5-d96c-476b-834e-555c5bc06f2f3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD56e686cff09f02fca79da6d9fbee366f1
SHA1d7d0694603d6ef99050c3ce5e95d27f25b4efe2e
SHA256f12fbe11b90fdf53a446db5b62e90efaff1aa68e0c3e81e41e8b628211f6fc02
SHA51241717d36a54df996c838ea8b7aae4faf48096a92fee58e0a41a1e0dba8065a11e38a267a7c59b8a42c89c1cca43d08c320633b41c4fe6e03e40609713f982199
-
Filesize
604B
MD53a0e39c53630ecfc2720aee27fe32557
SHA1ce9b2fbd4efce495b07ac98b4cb54b12dd3cf3c0
SHA25618da8779683e3e688ac75a896d738eb4e958763e153e56cb06432bafd3d6ef38
SHA5123598a8fa245b68d4ea236355c00c80710105704efb08e889edea0afd79e079224083c0d034e6b2454189bb8057ea9037ae48e0791bc5b6c54a4af90541fda166
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12236C41CDDF9E40BA5606CDF086B821
Filesize202B
MD5bc16d54d5eac63b24641999170f89662
SHA1e4e2d14587a06b63edb8df805cec40f11e9cc18f
SHA25682b3041c27a10badb8ff739c0e1c574f5ec86ee8adb6271cffc0f400dba68199
SHA512708b4cc0f51d4bc9db95af669be7125c97c3e952869119ca29226c8fdf644824e17f16970e75c22fd09c126a030c91189466291b91b89c1191be7c2abfb6dc4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B
Filesize188B
MD58f747ae8ae6c78ee839c1ccde1f6de1c
SHA18867a2b77a326ab88ad6516b831c9a35b7cd6ece
SHA2562f896d576ac24a9e5b1e735683e7d985765113e343c789b4472040096c8b3d43
SHA512e3dfc29ad6d70e005027caf83df661d3e0041c6d0205dd7ea14b1d973a12d8e5db1ee7a624571a2d0240c94304e4eb1ca9bc66b6e17f371d0feeb4adc7db6eb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d30940d6c16529a6e9ca33e6dcf0c169
SHA13547296a78b0e59bbbb56d807ab4b1ef5cca23a9
SHA25613fad99b4deee509abe73784c48fc1d7f196c303bfbcc86b927de28fa13f53e4
SHA512076b9d4578ef72a3661a5ab8d01e90e800eba255a9360bec9be7feaa7b008886f5a3bdfc02b46cad64efcccf2cbec22ae6fd189449e121acc76048de7a5d4171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9
Filesize404B
MD550f9a597ea99e6cf51ddde22cd2ae185
SHA176ad10f47383acd21ff925e92e19db034c7f91bd
SHA2566d8b0cc2092f92e524d2b88eab590482babbe7f537a70c0e9f74c67c07264843
SHA51283d3f6f3b66a7c86d0744114683eab30ddf4256edcef4ce60a94762fb54c387e5cdb557278445ed8fe47d5e2b893d35a143f86b23277de65b224b120d6c80cb9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
256KB
MD56e68cf541f031c7de9da6ec8d86862aa
SHA1115f143b5f585a27006159dc1b2d4d23a7af5295
SHA256d1763b911eebce060a4c479190e83ff5747f5e75f938fb1cb23d5fcaba249e35
SHA512022af872f2343293a0d71c6cc3ca3f13001ce7ad8e04cf740b75574272cad1dcb40a97a0e860082e7080a69a0367438728f1983317349d5a33ca969c3d877de1
-
Filesize
214KB
MD50b168b79397a1c3d5a181787e27ea323
SHA11867e953755169de011fd12009c2f42f300a9d47
SHA256c681e32d308452ee7c24eeebb335ee86cfe42783db2289ef2caa0d0671b53d5a
SHA5123b3e2ff7ad58a677cfbd22dec0c294e0b27ec0b81e8e6e20f45ac228c90472318ec0bec15d6689180b73061b94ea750049688ee5ed95a4e1d205eb94e7d0a250
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7