Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ada36fe7f857d4e6ac32873fcabc41dc.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ada36fe7f857d4e6ac32873fcabc41dc.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ada36fe7f857d4e6ac32873fcabc41dc.exe
-
Size
4.3MB
-
MD5
ada36fe7f857d4e6ac32873fcabc41dc
-
SHA1
9dfa6e22a188b9ac5924a1b7f48a965b68ef27c0
-
SHA256
e917c2ba3fa947a1827f121ad039d5cda4a60db595e5f757f08e94158173395a
-
SHA512
383d71acd553b4d9a52ab197b12e389ad2aa7ad14227eb3e59040e681a58e32bc06b484ebe713acf43d90c47ba256fe2a03dc870a29951310e201775b7c1eaae
-
SSDEEP
49152:BWlWI40M84pXwnNTBwLnHFLHkJE9LfUghKPgssSt2g:3fwqD9hv7St
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" ada36fe7f857d4e6ac32873fcabc41dc.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf ada36fe7f857d4e6ac32873fcabc41dc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\pwahelper.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateOnDemand.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\setup.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\7-Zip\7z.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge_proxy.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\notification_click_helper.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge_pwa_launcher.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe -
Drops file in Windows directory 44 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe ada36fe7f857d4e6ac32873fcabc41dc.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ ada36fe7f857d4e6ac32873fcabc41dc.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf ada36fe7f857d4e6ac32873fcabc41dc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 748 ada36fe7f857d4e6ac32873fcabc41dc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ada36fe7f857d4e6ac32873fcabc41dc.exe"C:\Users\Admin\AppData\Local\Temp\ada36fe7f857d4e6ac32873fcabc41dc.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4884 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:81⤵PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5ada36fe7f857d4e6ac32873fcabc41dc
SHA19dfa6e22a188b9ac5924a1b7f48a965b68ef27c0
SHA256e917c2ba3fa947a1827f121ad039d5cda4a60db595e5f757f08e94158173395a
SHA512383d71acd553b4d9a52ab197b12e389ad2aa7ad14227eb3e59040e681a58e32bc06b484ebe713acf43d90c47ba256fe2a03dc870a29951310e201775b7c1eaae