Malware Analysis Report

2024-09-09 16:18

Sample ID 240611-14zedatemh
Target 44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6.zip
SHA256 d709cab8285cfd269834784b73909ca4f2422d1b5d3fcdfd65be4ece43b85eb7
Tags
collection credential_access evasion execution persistence stealth trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d709cab8285cfd269834784b73909ca4f2422d1b5d3fcdfd65be4ece43b85eb7

Threat Level: Likely malicious

The file 44cb9a9fe1ec9eb0ad20b2bbd6c4081d5c72f4bcad038077cecb4a1d13de46a6.zip was found to be: Likely malicious.

Malicious Activity Summary

collection credential_access evasion execution persistence stealth trojan

Removes its main activity from the application launcher

Makes use of the framework's Accessibility service

Acquires the wake lock

Performs UI accessibility actions on behalf of the user

Requests disabling of battery optimizations (often used to enable hiding in the background).

Declares broadcast receivers with permission to handle system events

Declares services with permission to bind to the system

Requests dangerous framework permissions

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 22:12

Signatures

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards). android.permission.BIND_INPUT_METHOD N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to record audio. android.permission.RECORD_AUDIO N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 22:12

Reported

2024-06-11 22:16

Platform

android-x86-arm-20240611.1-en

Max time kernel

179s

Max time network

172s

Command Line

com.quitimias.du

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.quitimias.du

com.quitimias.du:remote

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 216.58.204.74:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
US 1.1.1.1:53 ho1hm2.ddns.net udp
N/A 100.126.38.216:44414 ho1hm2.ddns.net tcp
GB 216.58.201.110:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
N/A 100.93.144.160:443 android.apis.google.com tcp
N/A 100.93.144.160:443 android.apis.google.com tcp
US 1.1.1.1:53 ho2hm1.ddns.net udp
N/A 100.68.43.85:44414 ho2hm1.ddns.net tcp
N/A 100.93.144.160:443 android.apis.google.com tcp
US 1.1.1.1:53 www.google.com udp
N/A 100.91.148.160:443 www.google.com udp
N/A 100.91.148.160:443 www.google.com tcp
N/A 100.126.38.216:44414 ho1hm2.ddns.net tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.93.144.160:443 android.apis.google.com tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp
N/A 100.68.43.85:44414 ho2hm1.ddns.net tcp
N/A 100.75.229.244:443 semanticlocation-pa.googleapis.com tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 97726f39254c46d2399bd7a87c49d0d3
SHA1 8beead1f06362d9afc6af181fb182e613ccd3320
SHA256 7a2e48f362b9c3d378eb0217295f068678bff1c484616f0f839c6b0bb2c5ce96
SHA512 6577f1d13d54935edd9125adc34729bc0534bad7d4f237e8039c068776739822a57207dfb48d34ec7775ea7551dde52b7e341fc83496f06572b80e8ec358fe25

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1 731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA256 6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA512 5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 e3ea408d14b19a8815f5bac388c6bcf6
SHA1 a3b4f028e48b7113948b9b118eb4d249bd6d16cb
SHA256 d0526c544f259f717ffd99a1a82a5862a00b62dac19055d7513da0ef4e1250ed
SHA512 03658b1a58a60db3583ceac8f407358ec675a241381d5f8657eb1feaa831f66bdbd3d91ab27b4ebe90015e84f1dfc1208e3649e41089db1268c0679c47e0de81

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 365f074d64faad2f0f0c7784608e5b57
SHA1 2105b80d01621cbd370bec93f73709a7b67d565b
SHA256 0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4
SHA512 d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 0d32564eed92b5d2d5afe0e00a83ddb4
SHA1 9935759a55b4cc4546d1f7bf038e718d77c550d1
SHA256 0dcae3753b4c3b57c5ddbc479440cf109cff63a1aa0778df5107cbcaa5373014
SHA512 7e4245688e37712f5cc224364af4cbb1dd5519c8b13d9ca534b07d75f44ae513b9917f20fc9f657eaaa68d2078e6b6a2528ff8a7051c80dd1159fb9a052df026

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 22:12

Reported

2024-06-11 22:16

Platform

android-x64-20240611.1-en

Max time kernel

164s

Max time network

187s

Command Line

com.quitimias.du

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.quitimias.du

com.quitimias.du:remote

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.178.10:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
N/A 100.121.55.94:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 android.apis.google.com udp
N/A 100.98.65.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ho1hm2.ddns.net udp
N/A 100.123.239.241:44414 ho1hm2.ddns.net tcp
GB 142.250.178.10:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
GB 142.250.179.228:443 tcp
N/A 100.98.65.14:443 android.apis.google.com tcp
US 1.1.1.1:53 ho2hm1.ddns.net udp
N/A 100.109.70.138:44414 ho2hm1.ddns.net tcp
N/A 100.98.65.14:443 android.apis.google.com tcp
GB 142.250.178.14:443 tcp
GB 216.58.201.98:443 tcp
GB 142.250.178.10:443 tcp
N/A 100.123.239.241:44414 ho1hm2.ddns.net tcp
N/A 100.121.55.94:443 ssl.google-analytics.com tcp
N/A 100.109.70.138:44414 ho2hm1.ddns.net tcp
N/A 100.98.65.14:443 android.apis.google.com tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 97726f39254c46d2399bd7a87c49d0d3
SHA1 8beead1f06362d9afc6af181fb182e613ccd3320
SHA256 7a2e48f362b9c3d378eb0217295f068678bff1c484616f0f839c6b0bb2c5ce96
SHA512 6577f1d13d54935edd9125adc34729bc0534bad7d4f237e8039c068776739822a57207dfb48d34ec7775ea7551dde52b7e341fc83496f06572b80e8ec358fe25

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1 731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA256 6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA512 5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 e3ea408d14b19a8815f5bac388c6bcf6
SHA1 a3b4f028e48b7113948b9b118eb4d249bd6d16cb
SHA256 d0526c544f259f717ffd99a1a82a5862a00b62dac19055d7513da0ef4e1250ed
SHA512 03658b1a58a60db3583ceac8f407358ec675a241381d5f8657eb1feaa831f66bdbd3d91ab27b4ebe90015e84f1dfc1208e3649e41089db1268c0679c47e0de81

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 365f074d64faad2f0f0c7784608e5b57
SHA1 2105b80d01621cbd370bec93f73709a7b67d565b
SHA256 0c4662ed55fc03738e7903864ed0249c921b8f2d858531577eebd53501237cc4
SHA512 d29b5c16d10a78b386ba1f4882f7e80bc6d41887671abe6a36c746b015ea280d4a26f3d2af323b4ad755c256e5851a5b95d0bda8882c6c0a2c125bc748fab47a

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 595d9971b2b4562e217aff2286afc6db
SHA1 f7c3bdaeda327cf96297317c4522288c57f20219
SHA256 3bea8b5273dbf6cdbf54d023a58f4b26316fb6443a6cd8553616cfe6d7a1df4e
SHA512 cee95148ddb8f728b61afb3709fac08da6d960321fe601eab8ea983f12db432c124065eb7c61929a7903f6e788548a5325f97d7e2161cb859f92b4b9b1afa350

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-11 22:12

Reported

2024-06-11 22:16

Platform

android-x64-arm64-20240611.1-en

Max time kernel

164s

Max time network

172s

Command Line

com.quitimias.du

Signatures

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.quitimias.du

com.quitimias.du:remote

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
N/A 100.70.91.76:443 ssl.google-analytics.com tcp
GB 142.250.187.206:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
N/A 100.65.199.34:443 android.apis.google.com tcp
US 1.1.1.1:53 ho1hm2.ddns.net udp
N/A 100.93.64.148:44414 ho1hm2.ddns.net tcp
N/A 100.65.199.34:443 android.apis.google.com tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
GB 216.58.201.100:443 tcp
US 1.1.1.1:53 ho2hm1.ddns.net udp
N/A 100.89.247.112:44414 ho2hm1.ddns.net tcp
GB 172.217.169.3:443 tcp
US 1.1.1.1:53 www.google.com udp
N/A 100.67.246.91:443 www.google.com tcp
N/A 100.65.199.34:443 android.apis.google.com tcp
N/A 100.93.64.148:44414 ho1hm2.ddns.net tcp
N/A 100.70.91.76:443 ssl.google-analytics.com tcp
N/A 100.89.247.112:44414 ho2hm1.ddns.net tcp

Files

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 97726f39254c46d2399bd7a87c49d0d3
SHA1 8beead1f06362d9afc6af181fb182e613ccd3320
SHA256 7a2e48f362b9c3d378eb0217295f068678bff1c484616f0f839c6b0bb2c5ce96
SHA512 6577f1d13d54935edd9125adc34729bc0534bad7d4f237e8039c068776739822a57207dfb48d34ec7775ea7551dde52b7e341fc83496f06572b80e8ec358fe25

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 a9ec0c42a43c72d73c499e5c17ccbb8b
SHA1 731652fbfe61eac3fdb4b9d3e2eaa010848a0906
SHA256 6c5309ce3f31c9af3288b0de3305b7f5ddee97be60ca4ac1184f3c334480c05b
SHA512 5f8ed24a51f68cfa0627aceb9190d3a7febaee61bd5a89898ab113ddaa7ce2a41f129a28c4e200d5e5e4ddff7a483abc0393dc38e870782caf1c46d2ec0df2e3

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 e3ea408d14b19a8815f5bac388c6bcf6
SHA1 a3b4f028e48b7113948b9b118eb4d249bd6d16cb
SHA256 d0526c544f259f717ffd99a1a82a5862a00b62dac19055d7513da0ef4e1250ed
SHA512 03658b1a58a60db3583ceac8f407358ec675a241381d5f8657eb1feaa831f66bdbd3d91ab27b4ebe90015e84f1dfc1208e3649e41089db1268c0679c47e0de81

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 66c7fc64ffa6f9740ec3443030599908
SHA1 bab5a156ffd98826508a7cbee80b9e2327ac3cc3
SHA256 ef69cda5a95b35424195ac9d1a8dd2aec4b23daf1744b35152151735abcfa25c
SHA512 2b2d615317e0d88c201787f02aa45fd5d9848b76d3a309aecbb4a699ca739bb315f8ebdce41049cdc5456c2b2830a170bf35b5cef0f9de10bc94634590f4fcd4

/storage/emulated/0/Config/sys/apps/log/log-2024-06-11.txt

MD5 4647dec35e0a2705c51c74f627cf263e
SHA1 8796d30e2fe08fbfcc6a1dbd39e0cf940976931b
SHA256 cdb169f2180bed42efe6e7620adba448aac71774dcd6e20d955025eb87a576bf
SHA512 010f8e4b36b59aa501765db08b66030583a8cca2670caff99afa5dcd61d37451e5a84588d4d1926d21ebd9774eb9fcb4a22b284f8faadff497b26df3a33f2c71