Overview
overview
10Static
static
7YoWhatsApp...26.apk
android-9-x86
10YoWhatsApp...26.apk
android-11-x64
10clockDarkTheme.xml
windows7-x64
1clockDarkTheme.xml
windows10-2004-x64
3clockLightTheme.xml
windows7-x64
1clockLightTheme.xml
windows10-2004-x64
3ic_content...on.xml
windows7-x64
1ic_content...on.xml
windows10-2004-x64
3ic_content...ck.xml
windows7-x64
1ic_content...ck.xml
windows10-2004-x64
3ic_content...ck.xml
windows7-x64
1ic_content...ck.xml
windows10-2004-x64
3ic_content...ld.xml
windows7-x64
1ic_content...ld.xml
windows10-2004-x64
3l3ce7c8df_a32.so
debian-9-armhf
1l3ce7c8df_a64.so
ubuntu-18.04-amd64
l3ce7c8df_a64.so
debian-9-armhf
l3ce7c8df_a64.so
debian-9-mips
l3ce7c8df_a64.so
debian-9-mipsel
l3ce7c8df_x64.so
ubuntu-18.04-amd64
1l3ce7c8df_x86.so
ubuntu-18.04-amd64
1stella_e2e.xml
windows7-x64
1stella_e2e.xml
windows10-2004-x64
3stella_wa.xml
windows7-x64
1stella_wa.xml
windows10-2004-x64
3strings_ca.spk.ps1
windows7-x64
1strings_ca.spk.ps1
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30-08-2023 04:44
Static task
static1
Behavioral task
behavioral1
Sample
YoWhatsApp-08212028-626.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
YoWhatsApp-08212028-626.apk
Resource
android-x64-arm64-20230824-en
Behavioral task
behavioral3
Sample
clockDarkTheme.xml
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
clockDarkTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
clockLightTheme.xml
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
clockLightTheme.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
ic_content_sticker_location.xml
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
ic_content_sticker_location.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
ic_content_sticker_location_60_percent_black.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
ic_content_sticker_location_black.xml
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
ic_content_sticker_location_black.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
ic_content_sticker_location_emerald.xml
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
ic_content_sticker_location_emerald.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
l3ce7c8df_a32.so
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral16
Sample
l3ce7c8df_a64.so
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral17
Sample
l3ce7c8df_a64.so
Resource
debian9-armhf-20221125-en
Behavioral task
behavioral18
Sample
l3ce7c8df_a64.so
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral19
Sample
l3ce7c8df_a64.so
Resource
debian9-mipsel-20221111-en
Behavioral task
behavioral20
Sample
l3ce7c8df_x64.so
Resource
ubuntu1804-amd64-20230621-en
Behavioral task
behavioral21
Sample
l3ce7c8df_x86.so
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral22
Sample
stella_e2e.xml
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
stella_e2e.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
stella_wa.xml
Resource
win7-20230824-en
Behavioral task
behavioral25
Sample
stella_wa.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
strings_ca.spk.ps1
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
strings_ca.spk.ps1
Resource
win10v2004-20230703-en
General
-
Target
clockLightTheme.xml
-
Size
3KB
-
MD5
2235609a58ada82f2110d941341a720d
-
SHA1
d3b06251eb8f131034ba1ea3b0db982cb31bd813
-
SHA256
d89ab1d4bc636a73d64ef1d8976d517f13449a11af28d70e88ca3d0c40e114a7
-
SHA512
ff7543b27941add4a92579f1a55f3b40a16cd8ec8cc43b678b229be38a3878267fcdbb80b040e91132fd938082c47e6e237f62ac3903422ad9499cf7164228d5
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000004348d9a0d54f116ccba327d03a8f049d7a0ad0a6d9ab21fc072671a704781c2a000000000e80000000020000200000001273a4892b368b83b2f9190b2a6afd53aea16313ba780b35cddc0f7d9056a76a20000000c53a43d8d4915d8bf3d77dcf33c90a344c7fa2a72016107dc338dbdfbbc79f1740000000d428609920f1dc0748b05a808d98d0423a096c5cdbdf1a1b256be3ce1be9e9979bb1cb841290e70f2222877e28f869e9c1006fb00ae7b5c8e668411a638a3ffa IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a2593641f7167ebe0ff906438713784422a9f94580ae4309785626ce376a0a68000000000e8000000002000020000000d06f30b50dd86f2b8444398653b9803f41ebbb28d13347083178ff3502707e3190000000abb836da1e22b7bce83e63b8dd7e1c43864e29429d8d296a5f9936b2268713c050eca1c334d079e8dbaad460ee7a991f287b5901b6016793fb39e98f4ac1673964142cf63bf6f844f2c2cd61873cb977eebf0067536d6c6e089b17fc5f182427e4bc72a7f1526aaf37fc406aefe931db90654567d790ff75ca05b179360117c0327b2e7dfde1345225b077d61675d9cd40000000f7ff0fca8f171a1f74e2cef13f87d1f85249986872fab99b237a6e77569dd1d9bca70f772e4c041e9e3b1df18be47a0d6c6cd11215c713e0297c8ce299249eaa IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399532587" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fba0d9fcdad901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04F2CB21-46F0-11EE-99CD-FA28F6AD3DBC} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid Process 1976 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid Process 1976 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid Process 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid Process procid_target PID 1716 wrote to memory of 1856 1716 MSOXMLED.EXE 28 PID 1716 wrote to memory of 1856 1716 MSOXMLED.EXE 28 PID 1716 wrote to memory of 1856 1716 MSOXMLED.EXE 28 PID 1716 wrote to memory of 1856 1716 MSOXMLED.EXE 28 PID 1856 wrote to memory of 1976 1856 iexplore.exe 29 PID 1856 wrote to memory of 1976 1856 iexplore.exe 29 PID 1856 wrote to memory of 1976 1856 iexplore.exe 29 PID 1856 wrote to memory of 1976 1856 iexplore.exe 29 PID 1976 wrote to memory of 1500 1976 IEXPLORE.EXE 30 PID 1976 wrote to memory of 1500 1976 IEXPLORE.EXE 30 PID 1976 wrote to memory of 1500 1976 IEXPLORE.EXE 30 PID 1976 wrote to memory of 1500 1976 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\clockLightTheme.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f173c80d200a7ff4d4d792d3abe7962
SHA1ddfa5e2511892dd51f750dbb25e64494536f113e
SHA25697bba31adba1362e7ed05c1bd52001a54ea16747bb0c6ec207a80a8a77c13c45
SHA51225b24dc35c04d5915424c7ed245a07353e544328a34f2e38a85d95c50768720a4e6c264cdfad8936e1c31bd90e3f45b42d94921a439b7da85f4527a657ef880b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52110d775fffe43fed5bbc6db7ea57036
SHA1b46c0109ae191ac7a69bfd0278942a2cb46e41f1
SHA2564e02d092dad77834311fce28899a0000e81ac4f1c234c781266e535743720c06
SHA51234901b843706bc2e7712100f82e6f562922ee3a65be437b1062806327506744d61348f78a54a63185f4af611d9600f2126baaa89c718fb7a8612b5cc63563bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c693a33a1127a9cdc7ecbe3be401b23
SHA12f6246b195499c4544a2e6869477bf51a9043a2d
SHA256b4786001473ce24b65e43e88ce56dd681ff3050951a804b04fb56dbc83fdd326
SHA512bea37b612fbf751f02165aa2b2aa45cd0f5efe12c646767c1b9cb7f34fd6cdd5346b111c3266374788ee6135810ee9677ad41a2e46dfb3a9dd395e4601044c4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5507f775b3f39f213d12a036b37612b17
SHA1db6c69265f21c2826a83e158eddba91be3118ee5
SHA256e8a9ab3eab3d78c75641bb385d9661f20c2a1a891d68ca2b5e75e20b84b5220f
SHA5129d966b1caa7813af94e205380b3302f2a4b78d54433a6fe88772e6f97273930dfad9d23d2014b44a87ded0aae57eb6c45429e83dcf848bb35d98b91a799c7d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6cd1837c2e7bf79bdb7765a54cfea17
SHA14626b52bdf4d3088a57a53e394906f27ee108c02
SHA25620e3162839d8ea4ed6fd9a1c5a83ddd6bf09521efa6d4642012df8546932620c
SHA512b99e9c3b98fce77249cbd246b3cdafcb49bda51e89fd735a010f97ee971eaa8924377bbc4277dbcdbf6df7cc9c050da0ad7919959748b0193955caa67ef0f1ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d39f59f17764b4dc53fc5b900b8020d2
SHA1f2e20a716a302440132adb38400d0cffba0ab61f
SHA256f2b14035f27ccad259d94bcedb8926cd22768375b012d40993b6691a591d9e7d
SHA512b86b885e3c5d494476990b318cee018cdcc6607304fe0a86aae5df4ef01e99d5ab0a9af8b6b6374664d8942bef783ca74999eb561d9a5b21a2fba6ef64499b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6f8c839764e3135738a333358757993
SHA1feac617e58066c1d12024e7d76622ebb45d52cc1
SHA256c5493a35bf77ce64a248f8865e2a0f15f49b31eef25fdd832a443cbaa39f740b
SHA5129387f88fb5426e13ba8e6024d3532880ed3140aa322159fe13f7550887480ac5b47f8848deba111a12c2b2ebd3ea776f3e53e1a432d60b178898ca8eb3eeba6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c62f47a32c06378d50c4a73daf9aa17
SHA19ae7d9aba83cbcd8718f751cf7770c69b828daa2
SHA25645e343f5a8085ad1cf4ea2f886f34d95c39709db7b22f7896c5e55ec98c2671e
SHA5128baf7b20436c144fc85402d884ec637ec34ae6ebb14fb99c53d71888e22935b4907f7f1c640223c18b20cfcb7e07d20cc907a28816c5feb5b2b304640284e599
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d13378ac7e9d684c4e6be9f4fb5208
SHA1ed595bb257d916abfeb87e88b6fa61df6bdaabe5
SHA256004efad978061d3a41389c934d77b9e0afbc44acfd05381532c34760d604b0b6
SHA512182bca9fd5add611347d67478a03f75ad89843526f44da2c754e0c9460c5507b6e9bd0c2eb89a8b57e7112235cb2949226391069d523e125d11af36579911568
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52caf13bf6b10c2d6864955b33907268e
SHA1b70b759d7382a19a444eeba2bb5e5897fb848d77
SHA256fa1925f210c2ff27b335fcffaf1dc83ad5024ff5e37338a7a2b3abb69ea57743
SHA512311f258d22dc4a3160d628ddb84a07f64f66d8ea1237970a44c0a23d96b253e82eaac2bfb43e86707c3116a2be926a7742903aee7e28b91ccef8c1528057520b
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf