Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10f2259737b9...1a.exe
windows7-x64
10f2259737b9...1a.exe
windows10-2004-x64
10f26d7a7648...57.exe
windows7-x64
10f26d7a7648...57.exe
windows10-2004-x64
10f2728425ca...99.exe
windows7-x64
10f2728425ca...99.exe
windows10-2004-x64
10f27c496378...29.exe
windows7-x64
10f27c496378...29.exe
windows10-2004-x64
10f2e7cee938...9a.exe
windows7-x64
10f2e7cee938...9a.exe
windows10-2004-x64
10f2fe22a9b8...f7.exe
windows7-x64
1f2fe22a9b8...f7.exe
windows10-2004-x64
1f329b3a2d6...ab.exe
windows7-x64
10f329b3a2d6...ab.exe
windows10-2004-x64
10f34854f659...a1.exe
windows7-x64
10f34854f659...a1.exe
windows10-2004-x64
10f35d502490...e2.exe
windows7-x64
10f35d502490...e2.exe
windows10-2004-x64
10f36fde0983...fb.exe
windows7-x64
1f36fde0983...fb.exe
windows10-2004-x64
1f373a271fe...72.exe
windows7-x64
10f373a271fe...72.exe
windows10-2004-x64
10f386c97ec3...ed.exe
windows7-x64
10f386c97ec3...ed.exe
windows10-2004-x64
10f3873b73a0...14.exe
windows7-x64
10f3873b73a0...14.exe
windows10-2004-x64
10f3a76e9615...78.exe
windows7-x64
10f3a76e9615...78.exe
windows10-2004-x64
10f3eedde12e...df.exe
windows7-x64
10f3eedde12e...df.exe
windows10-2004-x64
10f3ef636642...36.exe
windows7-x64
10f3ef636642...36.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:18
Behavioral task
behavioral1
Sample
f2259737b967bbe88fc74916f319c61a.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
f2259737b967bbe88fc74916f319c61a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
f26d7a764816fad6183d06a6fc996857.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
f26d7a764816fad6183d06a6fc996857.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
f2728425ca601bdf06725c7584a8d848f1fb0d90fc28e219157556534d1b3999.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
f2728425ca601bdf06725c7584a8d848f1fb0d90fc28e219157556534d1b3999.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
f27c4963784ed1d311afd03bdfbe000f499b67edd16c4af85d34e547b892ca29.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
f27c4963784ed1d311afd03bdfbe000f499b67edd16c4af85d34e547b892ca29.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
f2e7cee938a991ef6e4a0fcb64efc69a.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
f2e7cee938a991ef6e4a0fcb64efc69a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
f2fe22a9b88a7181ef0a17fcbafba04ca86ac230251f2c02b3a2122056f7b8f7.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
f2fe22a9b88a7181ef0a17fcbafba04ca86ac230251f2c02b3a2122056f7b8f7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
f329b3a2d6b8a4688e82ffe1c491b2ab.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
f329b3a2d6b8a4688e82ffe1c491b2ab.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
f34854f659c2a34199c5bd888e03750f7aacfdae48724f2f2c5a28aa4188d2a1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
f35d502490f7522150c06d1bd7ca12e2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
f35d502490f7522150c06d1bd7ca12e2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
f36fde098314a27faa2d29aeb76c2bfb.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
f36fde098314a27faa2d29aeb76c2bfb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
f373a271fe4709f9373cd3f5d1519b4055cf99521118a2b8dc790e358b3e1472.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral22
Sample
f373a271fe4709f9373cd3f5d1519b4055cf99521118a2b8dc790e358b3e1472.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
f386c97ec32e28437b074ba6fb3311ed.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
f386c97ec32e28437b074ba6fb3311ed.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
f3873b73a0b2ef5c54ba8ed8a571bc14.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral26
Sample
f3873b73a0b2ef5c54ba8ed8a571bc14.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
f3a76e96152f78dfc595c893cc231178.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
f3a76e96152f78dfc595c893cc231178.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
f3eedde12ec9a2f363c13d643bd2acdf.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
f3eedde12ec9a2f363c13d643bd2acdf.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
f3ef636642aed1dd87c2fc6ee6307e36.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral32
Sample
f3ef636642aed1dd87c2fc6ee6307e36.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
f35d502490f7522150c06d1bd7ca12e2.exe
-
Size
8.6MB
-
MD5
f35d502490f7522150c06d1bd7ca12e2
-
SHA1
5ff707c5084b287ae08886bc857d4a2b4ffd8793
-
SHA256
af9968865c5173cb2b5af909bb34088bf51496c10ef91e26c054bde235bb519f
-
SHA512
8fe5536968d1ad453a58644052a27731e3d1dc4c57553c68c4ad310d459276dd8d1c4e5a15b7d262d864ed0675cab0ba6ef6b2081fa3653cb4c6062df1b6bc4f
-
SSDEEP
196608:t3/F4FE9vSMWU3wmIAYJVY5yJo20px+w71m:t3/F4F1mIfVY422Mx+V
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mwps.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cpm.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pdm.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wpas mngr.exe -
Executes dropped EXE 6 IoCs
pid Process 2228 mwps.exe 2276 f35d502490f7522150c06d1bd7ca12e2.exe 2420 f35d502490f7522150c06d1bd7ca12e2.exe 2160 pdm.exe 1804 cpm.exe 2752 wpas mngr.exe -
Loads dropped DLL 7 IoCs
pid Process 2916 f35d502490f7522150c06d1bd7ca12e2.exe 2916 f35d502490f7522150c06d1bd7ca12e2.exe 2276 f35d502490f7522150c06d1bd7ca12e2.exe 2420 f35d502490f7522150c06d1bd7ca12e2.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MPSSPDR16 = "C:\\Users\\Admin\\Documents\\mwps\\mwps.exe" wpas mngr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wpasmngr = "C:\\Users\\Admin\\Documents\\wpas mngr.exe" cpm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MPSSPDR16 = "C:\\Users\\Admin\\Documents\\mwps\\mwps.exe" f35d502490f7522150c06d1bd7ca12e2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MPSSPDR16 = "C:\\Users\\Admin\\Documents\\mwps\\mwps.exe" mwps.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wpasmngr = "C:\\Users\\Admin\\Documents\\wpas mngr.exe" wpas mngr.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wpasmngr = "C:\\Users\\Admin\\Documents\\wpas mngr.exe" pdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MPSSPDR16 = "C:\\Users\\Admin\\Documents\\mwps\\mwps.exe" pdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MPSSPDR16 = "C:\\Users\\Admin\\Documents\\mwps\\mwps.exe" cpm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f35d502490f7522150c06d1bd7ca12e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f35d502490f7522150c06d1bd7ca12e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f35d502490f7522150c06d1bd7ca12e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mwps.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2916 f35d502490f7522150c06d1bd7ca12e2.exe 2916 f35d502490f7522150c06d1bd7ca12e2.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe 2228 mwps.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2228 mwps.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2916 f35d502490f7522150c06d1bd7ca12e2.exe Token: SeDebugPrivilege 2228 mwps.exe Token: SeDebugPrivilege 2752 wpas mngr.exe Token: SeDebugPrivilege 1804 cpm.exe Token: SeDebugPrivilege 2160 pdm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2228 mwps.exe 2228 mwps.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2228 2916 f35d502490f7522150c06d1bd7ca12e2.exe 28 PID 2916 wrote to memory of 2228 2916 f35d502490f7522150c06d1bd7ca12e2.exe 28 PID 2916 wrote to memory of 2228 2916 f35d502490f7522150c06d1bd7ca12e2.exe 28 PID 2916 wrote to memory of 2228 2916 f35d502490f7522150c06d1bd7ca12e2.exe 28 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2916 wrote to memory of 2276 2916 f35d502490f7522150c06d1bd7ca12e2.exe 29 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2276 wrote to memory of 2420 2276 f35d502490f7522150c06d1bd7ca12e2.exe 30 PID 2228 wrote to memory of 2160 2228 mwps.exe 31 PID 2228 wrote to memory of 2160 2228 mwps.exe 31 PID 2228 wrote to memory of 2160 2228 mwps.exe 31 PID 2228 wrote to memory of 2160 2228 mwps.exe 31 PID 2228 wrote to memory of 1804 2228 mwps.exe 32 PID 2228 wrote to memory of 1804 2228 mwps.exe 32 PID 2228 wrote to memory of 1804 2228 mwps.exe 32 PID 2228 wrote to memory of 1804 2228 mwps.exe 32 PID 2228 wrote to memory of 2752 2228 mwps.exe 33 PID 2228 wrote to memory of 2752 2228 mwps.exe 33 PID 2228 wrote to memory of 2752 2228 mwps.exe 33 PID 2228 wrote to memory of 2752 2228 mwps.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\f35d502490f7522150c06d1bd7ca12e2.exe"C:\Users\Admin\AppData\Local\Temp\f35d502490f7522150c06d1bd7ca12e2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\Documents\mwps\mwps.exe"C:\Users\Admin\Documents\mwps\mwps.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\Documents\proDM\pdm.exe"C:\Users\Admin\Documents\proDM\pdm.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Users\Admin\Documents\comPM\cpm.exe"C:\Users\Admin\Documents\comPM\cpm.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Users\Admin\Documents\wpas mngr.exe"C:\Users\Admin\Documents\wpas mngr.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
-
C:\Users\Admin\Documents\Windows_Run_Ceneter_SIER\f35d502490f7522150c06d1bd7ca12e2.exe"C:\Users\Admin\Documents\Windows_Run_Ceneter_SIER\f35d502490f7522150c06d1bd7ca12e2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\eset\bts.session\d256a299-1646-4585-b509-cf108bcde166\f35d502490f7522150c06d1bd7ca12e2.exe"C:\Users\Admin\AppData\Local\Temp\eset\bts.session\d256a299-1646-4585-b509-cf108bcde166\f35d502490f7522150c06d1bd7ca12e2.exe" --bts-container 2276 "C:\Users\Admin\Documents\Windows_Run_Ceneter_SIER\f35d502490f7522150c06d1bd7ca12e2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2420
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\eset\bts.session\d256a299-1646-4585-b509-cf108bcde166\f35d502490f7522150c06d1bd7ca12e2.exe
Filesize2.1MB
MD56e6fddaa8ecd3f759230a703dfce6d27
SHA12ef696bc30d0ba48aa2af5c94787d056557fe21b
SHA2563bc0f49207c2589667d540a9ee638daed3f350a4e943de22f135590484fd41e6
SHA512cfb112e71e0f1841607f4a73b1bbf4c38170736ecdbde3138927d71f6f584d07f95dfe4b0f066e936af968abcbb9f88eef2db48a0a4b800a6cbb63188c643fca
-
Filesize
8.6MB
MD5e6873bdbb73ff60a4468f6e204cdbaee
SHA1cb42c4061adfb90257beff9eff4929503e0c1fc5
SHA256c74123c90df3ded1f9d091b278cf68ce798bb3c7d99b34a46ac0bdff29374045
SHA5125cefe838d1da8c97b5664efc0c49e9e1652700bd16eb3fc1467bc54c05b2f124393d692df11034373fe496df060125baafdafc237f26be4f13e447f2c7e6cd45
-
Filesize
13KB
MD5015b69d2468b0454a04cc80027a65224
SHA100eea83b7c91f8ea797e238827ccbc403c985f8b
SHA256ea65623a9e39191c0157c2cf541c397fecad15477c962594ee91033df463bd26
SHA5129f562242a04a5fe9f5b4fe8e1edd2bf1b171b75c834317a74c05621cad0605ca19ad2b3028ae60b72841b982b73fd972609f3c37879a50ba3cf69bf1838ea2b0
-
Filesize
80KB
MD5307956cbcc6322cef0760b8bd174e081
SHA14524c29dc44d0a6af35c3091ff63593558d8e0c1
SHA25632695f53c395ddaea37e5200349c9ad57d65c62fbc652265940ca9168604f5a7
SHA512d3b61b9c08321eb9330ef55717bae55188401c89aa9284bea09357639c741e272dc217375dfe4e4be0e37958052a0c697c9aa3e387ec803a1d8b325a56eb737f
-
Filesize
14KB
MD5e21b44a5ba5f2cf25a31600ed5678aa3
SHA1d651ad21f565aae56c31fd5efeec2c99424eaf3f
SHA256a9831f4c9dc19ebd13158fd50c8df20e91b7a2568a142e9598f5e87da87aacd4
SHA512bec72a0183fa6987cdcc1f528cd719d25bcb68233b77d3f6a0e4be3eeff084dc78c2e2b727c96e3a32326db358c7dc5359fdc657aa02115bfd7220413c206383
-
Filesize
14KB
MD5e03b00824eb87cdf8a4af0158b9f03b9
SHA139d5d69b3f4e265e44b414ff98323e7332d4984c
SHA256482a1c183b8db36574a67afcaad6057386c594480ac6e9b6fd31af6d19356524
SHA512cddecdeabee507dcfdb4846ffb14ab6a95930b97be6bf4630feff1378d2b1386ef6feaeda84bc2b8386e5fea7724c19d95ad3e4c47561dd5e64365e52346cfd1