Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/11/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe
-
Size
580KB
-
MD5
b25f6c3a4462cb9064ccb93cbe86bf65
-
SHA1
b1e4b3e01a6ceb4c64c86b9efeb886956338a285
-
SHA256
8b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc
-
SHA512
5eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f
-
SSDEEP
12288:N0S3WwroioAwIGCnlDVBCRoAwIGCnlDVBCgoAwIGCnlDVBCcoAwIGCnlDVBC/j9b:Owrowj9NrQgE76OzStl
Malware Config
Extracted
trickbot
1000303
lib356
85.143.220.111:443
24.247.181.155:449
174.105.235.178:449
92.223.105.204:443
181.113.17.230:449
174.105.233.82:449
71.14.129.8:449
216.183.62.43:449
42.115.91.177:443
185.251.39.94:443
71.94.101.25:443
206.130.141.255:449
185.251.39.47:443
74.140.160.33:449
65.31.241.133:449
140.190.54.187:449
24.247.181.226:449
24.119.69.70:449
46.173.218.246:443
103.110.91.118:449
68.4.173.10:443
72.189.124.41:449
74.134.5.113:449
105.27.171.234:449
182.253.20.66:449
172.222.97.179:449
46.149.182.112:449
213.32.122.246:443
199.227.126.250:449
24.113.161.184:449
197.232.50.85:443
94.232.20.113:443
190.145.74.84:449
47.49.168.50:443
64.233.159.129:449
24.227.222.4:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Signatures
-
Trickbot family
-
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/2076-18-0x0000000002670000-0x00000000026B0000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 2884 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe -
Loads dropped DLL 2 IoCs
pid Process 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe -
pid Process 2872 powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ident.me 3 ident.me -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2848 sc.exe 2836 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 2872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2872 powershell.exe Token: SeTcbPrivilege 2884 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 2884 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 2884 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2560 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 30 PID 2076 wrote to memory of 2560 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 30 PID 2076 wrote to memory of 2560 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 30 PID 2076 wrote to memory of 2560 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 30 PID 2076 wrote to memory of 2556 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2556 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2556 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2556 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 31 PID 2076 wrote to memory of 2400 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 32 PID 2076 wrote to memory of 2400 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 32 PID 2076 wrote to memory of 2400 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 32 PID 2076 wrote to memory of 2400 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 32 PID 2076 wrote to memory of 1628 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 36 PID 2076 wrote to memory of 1628 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 36 PID 2076 wrote to memory of 1628 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 36 PID 2076 wrote to memory of 1628 2076 b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe 36 PID 2556 wrote to memory of 2848 2556 cmd.exe 38 PID 2556 wrote to memory of 2848 2556 cmd.exe 38 PID 2556 wrote to memory of 2848 2556 cmd.exe 38 PID 2556 wrote to memory of 2848 2556 cmd.exe 38 PID 2560 wrote to memory of 2836 2560 cmd.exe 37 PID 2560 wrote to memory of 2836 2560 cmd.exe 37 PID 2560 wrote to memory of 2836 2560 cmd.exe 37 PID 2560 wrote to memory of 2836 2560 cmd.exe 37 PID 2400 wrote to memory of 2872 2400 cmd.exe 39 PID 2400 wrote to memory of 2872 2400 cmd.exe 39 PID 2400 wrote to memory of 2872 2400 cmd.exe 39 PID 2400 wrote to memory of 2872 2400 cmd.exe 39 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 PID 1628 wrote to memory of 2700 1628 b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b25f6c3a4462cb9064ccb93cbe86bf65_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2836
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2700
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {42044207-B344-4461-8BD0-A7ED03C6C79B} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:792
-
C:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exeC:\Users\Admin\AppData\Roaming\vsvsid\b26f7c3a4472cb9074ccb93cbe97bf76_KaffaDaket119.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2884 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Modifies data under HKEY_USERS
PID:2272
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
580KB
MD5b25f6c3a4462cb9064ccb93cbe86bf65
SHA1b1e4b3e01a6ceb4c64c86b9efeb886956338a285
SHA2568b0434d0a5f7e099621e2fc4fb26120cca8851853dd6c4dc06b054d14ccc91bc
SHA5125eb594d73ba7aac21499072e0072dfb25f0107eff92b484392dfdc8d3b3edafcbab72ade2d56156940097b1e86c923248e7262654abb86459289ab0098d4a28f