Malware Analysis Report

2025-08-05 19:34

Sample ID 221013-z5ewpaeebm
Target 430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae
SHA256 430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae

Threat Level: Known bad

The file 430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Neshta

Modifies system executable filetype association

Detect Neshta payload

Neshta family

Executes dropped EXE

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

NSIS installer

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-13 21:17

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-13 21:17

Reported

2022-10-14 01:25

Platform

win7-20220812-en

Max time kernel

129s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Neshta

persistence spyware neshta

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\install.rdf C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\tr.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ru.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\components\acplus-autocomplete.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\logo.PNG C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\sv.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\de.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\privecy_16_hot.gif C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\defaults\preferences\instlPref.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\babylon.xul C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ae.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\il.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\en.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ro.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\us.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\server.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\help_16.gif C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ch.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB} C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data\instlRef = "na" C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

"C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

Network

N/A

Files

memory/1748-54-0x0000000076091000-0x0000000076093000-memory.dmp

\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

MD5 9b1538fb702ecbf1d33ecea246cade4d
SHA1 6a36d90290f7959eb8da0b787ccfb5b29f140893
SHA256 cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40
SHA512 0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

memory/1436-56-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

MD5 9b1538fb702ecbf1d33ecea246cade4d
SHA1 6a36d90290f7959eb8da0b787ccfb5b29f140893
SHA256 cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40
SHA512 0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

MD5 9b1538fb702ecbf1d33ecea246cade4d
SHA1 6a36d90290f7959eb8da0b787ccfb5b29f140893
SHA256 cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40
SHA512 0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

\Users\Admin\AppData\Local\Temp\nstD73E.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

\Users\Admin\AppData\Local\Temp\nstD73E.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-13 21:17

Reported

2022-10-14 01:24

Platform

win10v2004-20220901-en

Max time kernel

114s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

Signatures

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\logo.PNG C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\defaults\preferences\instlPref.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\mtstart.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\cn.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\pl.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\Thumbs.db C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Firefox\user.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\home.gif C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ae.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\babylon.css C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\vssver.scc C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\us.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\install.rdf C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\arwDwn.gif C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ch.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\gr.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\he.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\es.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ru.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\tellafriend.gif C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\ja.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\nl.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MIA062~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\tmplt.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\fr.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\chrome.manifest C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\components\acplus-autocomplete.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\tr.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\bbyln.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\imgs\flgs\de.png C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File created C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected]\content\server.js C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB} C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\instl\data\instlRef = "na" C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

"C:\Users\Admin\AppData\Local\Temp\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe"

Network

Country Destination Domain Proto
NL 104.80.225.205:443 tcp
US 20.189.173.4:443 tcp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

MD5 9b1538fb702ecbf1d33ecea246cade4d
SHA1 6a36d90290f7959eb8da0b787ccfb5b29f140893
SHA256 cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40
SHA512 0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

memory/4360-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\430150dc99fd580c5f822169d55ab04bf276625eed8158136970873be2e52dae.exe

MD5 9b1538fb702ecbf1d33ecea246cade4d
SHA1 6a36d90290f7959eb8da0b787ccfb5b29f140893
SHA256 cf8bd49a15287852eb742cd1ccac924383c95c7efd5fc09a16498de8e991da40
SHA512 0e0e15a4a9d71e626a71e0aba163c8496961752edf07871bb12f24414a34812f2bbe5e9b67f09055291a56b829e9ddff59a3a91cb33071c5dba68b70f0702348

C:\Users\Admin\AppData\Local\Temp\nsfAEC4.tmp\nsisos.dll

MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

C:\Users\Admin\AppData\Local\Temp\nsfAEC4.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f