Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2025, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe
Resource
win7-20240903-en
General
-
Target
f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe
-
Size
1.1MB
-
MD5
d658dadccb4a21c0b50d0dc0406f9c3f
-
SHA1
eb50304a3fcc3664f7f7f598830eb379f347b793
-
SHA256
f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56
-
SHA512
73b4fae7dc1a8363a6a2eea1610d2a6655367dbac393e7e00acf6277773d561f76d4bc47824de3e588d5ec91566b35f0233d3f143f80bcf7dd9b57c2a54c86bd
-
SSDEEP
24576:QMjh7ExHIySDQwfx7FbD/KhlcBQgbLY1Yl05bmktUNudtJjdPrF:jmHZSDQyJP/+jgbLuYlab7SNudXjdTF
Malware Config
Extracted
asyncrat
Esco Private rat
Default
93.123.109.39:4449
ozvhxbdcbanqw
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
resource yara_rule behavioral2/memory/2116-78-0x0000000002A00000-0x0000000002A18000-memory.dmp VenomRAT -
Venomrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/2116-78-0x0000000002A00000-0x0000000002A18000-memory.dmp family_asyncrat -
Executes dropped EXE 2 IoCs
pid Process 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp -
Loads dropped DLL 8 IoCs
pid Process 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 4504 regsvr32.exe 2116 regsvr32.exe 4140 regsvr32.EXE 4724 regsvr32.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to execute payload.
pid Process 4736 powershell.exe 3032 powershell.exe 4512 powershell.exe 2804 powershell.exe 3032 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4920 timeout.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 2116 regsvr32.exe 2116 regsvr32.exe 4736 powershell.exe 4736 powershell.exe 3032 powershell.exe 3032 powershell.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 4140 regsvr32.EXE 4140 regsvr32.EXE 4512 powershell.exe 4512 powershell.exe 4140 regsvr32.EXE 4140 regsvr32.EXE 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 4724 regsvr32.EXE 4724 regsvr32.EXE 2804 powershell.exe 2804 powershell.exe 4724 regsvr32.EXE 4724 regsvr32.EXE 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe 2116 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4736 powershell.exe Token: SeIncreaseQuotaPrivilege 4736 powershell.exe Token: SeSecurityPrivilege 4736 powershell.exe Token: SeTakeOwnershipPrivilege 4736 powershell.exe Token: SeLoadDriverPrivilege 4736 powershell.exe Token: SeSystemProfilePrivilege 4736 powershell.exe Token: SeSystemtimePrivilege 4736 powershell.exe Token: SeProfSingleProcessPrivilege 4736 powershell.exe Token: SeIncBasePriorityPrivilege 4736 powershell.exe Token: SeCreatePagefilePrivilege 4736 powershell.exe Token: SeBackupPrivilege 4736 powershell.exe Token: SeRestorePrivilege 4736 powershell.exe Token: SeShutdownPrivilege 4736 powershell.exe Token: SeDebugPrivilege 4736 powershell.exe Token: SeSystemEnvironmentPrivilege 4736 powershell.exe Token: SeRemoteShutdownPrivilege 4736 powershell.exe Token: SeUndockPrivilege 4736 powershell.exe Token: SeManageVolumePrivilege 4736 powershell.exe Token: 33 4736 powershell.exe Token: 34 4736 powershell.exe Token: 35 4736 powershell.exe Token: 36 4736 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeIncreaseQuotaPrivilege 3032 powershell.exe Token: SeSecurityPrivilege 3032 powershell.exe Token: SeTakeOwnershipPrivilege 3032 powershell.exe Token: SeLoadDriverPrivilege 3032 powershell.exe Token: SeSystemProfilePrivilege 3032 powershell.exe Token: SeSystemtimePrivilege 3032 powershell.exe Token: SeProfSingleProcessPrivilege 3032 powershell.exe Token: SeIncBasePriorityPrivilege 3032 powershell.exe Token: SeCreatePagefilePrivilege 3032 powershell.exe Token: SeBackupPrivilege 3032 powershell.exe Token: SeRestorePrivilege 3032 powershell.exe Token: SeShutdownPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeSystemEnvironmentPrivilege 3032 powershell.exe Token: SeRemoteShutdownPrivilege 3032 powershell.exe Token: SeUndockPrivilege 3032 powershell.exe Token: SeManageVolumePrivilege 3032 powershell.exe Token: 33 3032 powershell.exe Token: 34 3032 powershell.exe Token: 35 3032 powershell.exe Token: 36 3032 powershell.exe Token: SeIncreaseQuotaPrivilege 3032 powershell.exe Token: SeSecurityPrivilege 3032 powershell.exe Token: SeTakeOwnershipPrivilege 3032 powershell.exe Token: SeLoadDriverPrivilege 3032 powershell.exe Token: SeSystemProfilePrivilege 3032 powershell.exe Token: SeSystemtimePrivilege 3032 powershell.exe Token: SeProfSingleProcessPrivilege 3032 powershell.exe Token: SeIncBasePriorityPrivilege 3032 powershell.exe Token: SeCreatePagefilePrivilege 3032 powershell.exe Token: SeBackupPrivilege 3032 powershell.exe Token: SeRestorePrivilege 3032 powershell.exe Token: SeShutdownPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeSystemEnvironmentPrivilege 3032 powershell.exe Token: SeRemoteShutdownPrivilege 3032 powershell.exe Token: SeUndockPrivilege 3032 powershell.exe Token: SeManageVolumePrivilege 3032 powershell.exe Token: 33 3032 powershell.exe Token: 34 3032 powershell.exe Token: 35 3032 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2116 regsvr32.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3688 2172 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 82 PID 2172 wrote to memory of 3688 2172 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 82 PID 2172 wrote to memory of 3688 2172 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 82 PID 3688 wrote to memory of 3108 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 83 PID 3688 wrote to memory of 3108 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 83 PID 3688 wrote to memory of 3108 3688 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 83 PID 3108 wrote to memory of 4920 3108 cmd.exe 85 PID 3108 wrote to memory of 4920 3108 cmd.exe 85 PID 3108 wrote to memory of 4920 3108 cmd.exe 85 PID 3108 wrote to memory of 644 3108 cmd.exe 86 PID 3108 wrote to memory of 644 3108 cmd.exe 86 PID 3108 wrote to memory of 644 3108 cmd.exe 86 PID 644 wrote to memory of 1592 644 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 87 PID 644 wrote to memory of 1592 644 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 87 PID 644 wrote to memory of 1592 644 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe 87 PID 1592 wrote to memory of 4504 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 88 PID 1592 wrote to memory of 4504 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 88 PID 1592 wrote to memory of 4504 1592 f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp 88 PID 4504 wrote to memory of 2116 4504 regsvr32.exe 89 PID 4504 wrote to memory of 2116 4504 regsvr32.exe 89 PID 2116 wrote to memory of 4736 2116 regsvr32.exe 90 PID 2116 wrote to memory of 4736 2116 regsvr32.exe 90 PID 2116 wrote to memory of 3032 2116 regsvr32.exe 93 PID 2116 wrote to memory of 3032 2116 regsvr32.exe 93 PID 4140 wrote to memory of 4512 4140 regsvr32.EXE 104 PID 4140 wrote to memory of 4512 4140 regsvr32.EXE 104 PID 4724 wrote to memory of 2804 4724 regsvr32.EXE 107 PID 4724 wrote to memory of 2804 4724 regsvr32.EXE 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe"C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\is-VST3D.tmp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp"C:\Users\Admin\AppData\Local\Temp\is-VST3D.tmp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp" /SL5="$8004E,770488,161792,C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe" /VERYSILENT /SUPPRESSMSGBOXES3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\timeout.exetimeout /T 34⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe"C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe" /VERYSILENT /SUPPRESSMSGBOXES4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\is-V3MSU.tmp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp"C:\Users\Admin\AppData\Local\Temp\is-V3MSU.tmp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp" /SL5="$60114,770488,161792,C:\Users\Admin\AppData\Local\Temp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.exe" /VERYSILENT /SUPPRESSMSGBOXES5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\2crypt32.drv"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\regsvr32.exe/s /i:SYNC "C:\Users\Admin\AppData\Roaming\\2crypt32.drv"7⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv' }) { exit 0 } else { exit 1 }"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{E0404083-61E7-4517-DCE5-79D8A009AA8D}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
-
-
-
-
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Windows\system32\regsvr32.EXEC:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\2crypt32.drv' }) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53ffce848af907464c20a20e1b430f78a
SHA1fbcd91a5c226d474235be920cf49e3344893fc1f
SHA25625213a6685a6fd21a2aa43c417891703333579ad784f3896976b44bcfcdb009e
SHA5121adaf6d68441a32b459b6071dcfdae404ab1e37bb0c6511e08d49717f9043679bdd7ca3324be184ece522e6516eedc04203ffccb5f9ea790bd35a84db9b944bf
-
Filesize
1KB
MD5c8c29f1f588816cb69fcebf642891720
SHA1968d91f771b5e235c91952025509479c4456b44e
SHA2562e1d2b0a86abe46d40843dbc522f6c9891671b21c1ac61e21d32f7245a93eb8b
SHA5126b19696757654762ec551388c04142d4404892314c3e8a811b3260834dd6110b57be9aa4a0497ff579a4936c91cbdfbf7a938f676ee24e7476ecdd1b668cac3a
-
Filesize
1KB
MD5c1f1620b98d96dc5b6be9238d00b2e4c
SHA1943f2628dc682c5b5cbb6685d4d1fe703a817d42
SHA25664a1425d7554efe23ad3224c95bc438a21a79b5cfd34d96ed834557d3f95ef98
SHA512a0b49e4370837f287ebef839ebb64eef88bd20d85c905a85dba8adad2a6d7c0e2b0c34a1dd3501630093f0844cb97701dd0c96ac85e0b9e3c649b4f0e3137169
-
Filesize
1KB
MD562ba4ea474aa0661cb364833cd6f342e
SHA1bedea24ce0ef32bd8396e3b8f1fc6c2f27d49420
SHA2562c470425abe0953386b291a5539ce6530beb77d03743356c6606de1332dedad5
SHA512b97f14afab17976e43fbb953bea4a1b1fb98f15efd9267fca7e67cf23ed53bdeb5b9b6d2e3b7fca7df858b9f1d154da62200d4819d2eeab39aa998352211f621
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
C:\Users\Admin\AppData\Local\Temp\is-VST3D.tmp\f725bf614120e26b774341f54d73210aea60205c2723e155cb6fd09fa4411b56.tmp
Filesize1.1MB
MD5bcc236a3921e1388596a42b05686ff5e
SHA143bffbbac6a1bf5f1fa21e971e06e6f1d0af9263
SHA25643a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9
SHA512e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04
-
Filesize
1.4MB
MD5221be8861ed61d34671e8960677f4bcd
SHA1cc56c6ed1452545ded9330996e7458b0aedfb2b5
SHA256a4766645820a4f2bb25ef320eafabed7da544be1403eb9290227e751123cb14f
SHA51245c7a7fe74e868b6689b6b1f1a750f2ddabdd1bff37637fcc6aac848a35d01820e820c4271e6f98fcb0a7096f27cadb020cb2ad72c1842add626986d6cc08fda