Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 09:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
General
-
Target
77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe
-
Size
273KB
-
MD5
dac16cc836b331530ddd3fcee923bbcc
-
SHA1
25dd9fdd506ffd633e908ae0e82c3d02c45ccb8c
-
SHA256
77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841
-
SHA512
bca50b17ead01e43cd955eb5a21168abaaa6af0003ee881b2f669fc830da4fa9d4868577fdd13fbb410db03dec60f2e0fa0abcb397415abbefc36ec8c5d01942
-
SSDEEP
3072:jWhZ406dHnD61kLRkgUA1nQZwFGVO4Mqg+WDY:aZ40PkLRp1nQ4QLd
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 4700 Logo1_.exe 3892 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\de-de\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nl-nl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ja-jp\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\edge_feedback\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe File created C:\Windows\Logo1_.exe 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe 4700 Logo1_.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4028 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 92 PID 3176 wrote to memory of 4028 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 92 PID 3176 wrote to memory of 4028 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 92 PID 3176 wrote to memory of 4700 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 94 PID 3176 wrote to memory of 4700 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 94 PID 3176 wrote to memory of 4700 3176 77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe 94 PID 4700 wrote to memory of 3432 4700 Logo1_.exe 95 PID 4700 wrote to memory of 3432 4700 Logo1_.exe 95 PID 4700 wrote to memory of 3432 4700 Logo1_.exe 95 PID 3432 wrote to memory of 2260 3432 net.exe 97 PID 3432 wrote to memory of 2260 3432 net.exe 97 PID 3432 wrote to memory of 2260 3432 net.exe 97 PID 4028 wrote to memory of 3892 4028 cmd.exe 98 PID 4028 wrote to memory of 3892 4028 cmd.exe 98 PID 4028 wrote to memory of 3892 4028 cmd.exe 98 PID 4700 wrote to memory of 3296 4700 Logo1_.exe 56 PID 4700 wrote to memory of 3296 4700 Logo1_.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe"C:\Users\Admin\AppData\Local\Temp\77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2239.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe"C:\Users\Admin\AppData\Local\Temp\77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe"4⤵
- Executes dropped EXE
PID:3892
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2260
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5712443c39bc161af4323d94fbb81f6bd
SHA1de61a36dcceb38fd830694fd56e67a7970ffeff2
SHA2564cfd04b66b8680ee97bb319f33cb88eb4c8db990163adec43558d9722c83099c
SHA51235b53f2d75edaad4ad92642c8fa3a86b0a99b983b1c0a42c7b37dcc4b4f7f0a1a8e5ee490e13308fea8fd50be233f3c6b30573f766caa24b147c81bb6a642061
-
Filesize
722B
MD5962f24c2aeea462ed5cf59e5618f01af
SHA1ec54749a659b2bbbb546d7c8fc221589c8e70854
SHA2568ca7cd2380040f66682e9fe715a8c7516c252ac4afd241ff1fcbccf2f4d08c8f
SHA512b84ac01fb3d977785e54e317419a463ad37155216a5ce08acd930dacdfaff101a361569b4e2a4f1011d0761ac65882b723c9e9d35b94c83308b94cf75c64eb37
-
C:\Users\Admin\AppData\Local\Temp\77ca61b0a1272eef1748090afab2905285a8a6ba8ba71ff302087eedb5810841.exe.exe
Filesize231KB
MD56f581a41167d2d484fcba20e6fc3c39a
SHA1d48de48d24101b9baaa24f674066577e38e6b75c
SHA2563eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7
SHA512e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6
-
Filesize
42KB
MD5b6222d6bd605e9f4ad4809c2b952b903
SHA13126fa33e0251155b035eba0396fc1cd22be2765
SHA2561bef96ba1b19fbf84bbd502edd24b123282855c6659248635d82e50578499aab
SHA5128927f28cf9e27939a6abf5214969f40621906f9071b5288b7cd3a1664043e38ed0a6e46dd8eade770aa2a0d830c362bc30e150f53ef60ee558b512872f820961
-
Filesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b