Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 03:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b4267806c13daa2299e2f53d3758af0N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
4b4267806c13daa2299e2f53d3758af0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
4b4267806c13daa2299e2f53d3758af0N.exe
-
Size
9.6MB
-
MD5
4b4267806c13daa2299e2f53d3758af0
-
SHA1
a4ff8e1151507498c739b610630df1492863173c
-
SHA256
e1c0734cc667ac700ba1e95da2185caa19d002b775507638208ba1dc4a7f5f99
-
SHA512
f49e46d13ad0a753e5667b302dbcbda3e6d98e0d4e5c76e84016df5bf442d7f18f6346570f5b1a9a09049aa2686a3c52c2eefd7ad610d3ea4cca0116c1923ccd
-
SSDEEP
196608:I3qnhgJuP3LAhCiVXOWv06A1oMuWr45hrr2s:nS+LJ9eJWGhrr2s
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1640 systemwindows.exe 2044 msdascmsdaurl6.1.7600.163857.0907131255.exe 2348 visualvbe6ext.exe 1864 portalconnectcoreportalconnectcore.exe -
Loads dropped DLL 16 IoCs
pid Process 2104 4b4267806c13daa2299e2f53d3758af0N.exe 1640 systemwindows.exe 1640 systemwindows.exe 1640 systemwindows.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2044 msdascmsdaurl6.1.7600.163857.0907131255.exe 2044 msdascmsdaurl6.1.7600.163857.0907131255.exe 2044 msdascmsdaurl6.1.7600.163857.0907131255.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2348 visualvbe6ext.exe 2348 visualvbe6ext.exe 2348 visualvbe6ext.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 1864 portalconnectcoreportalconnectcore.exe 1864 portalconnectcoreportalconnectcore.exe 1864 portalconnectcoreportalconnectcore.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\OperatingSystem = "c:\\program files (x86)\\windows nt\\tabletextservice\\es-es\\systemwindows.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\PortalConnectCorePortalConnectCore = "c:\\program files (x86)\\common files\\microsoft shared\\portal\\portalconnectcoreportalconnectcore.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftVisual = "c:\\program files (x86)\\common files\\microsoft shared\\vba\\vba6\\visualvbe6ext.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WindowsWindows = "c:\\program files (x86)\\common files\\system\\ole db\\msdascmsdaurl6.1.7600.163857.0907131255.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4b4267806c13daa2299e2f53d3758af0N.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4b4267806c13daa2299e2f53d3758af0N.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\InternetExplorer = "c:\\program files (x86)\\internet explorer\\en-us\\iexploreinternet.exe" 4b4267806c13daa2299e2f53d3758af0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftDirectoryServices = "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\frameworksystem.exe" 4b4267806c13daa2299e2f53d3758af0N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll systemwindows.exe File created C:\Windows\SysWOW64\ntdll.dll.dll msdascmsdaurl6.1.7600.163857.0907131255.exe File created C:\Windows\SysWOW64\ntdll.dll.dll visualvbe6ext.exe File created C:\Windows\SysWOW64\ntdll.dll.dll portalconnectcoreportalconnectcore.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\iexploreInternet.exe 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Internet Explorer\en-US\iexploreInternet.exe 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\RCXE08F.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\es-ES\RCXE0FD.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\msdascmsdaurl6.1.7600.163857.0907131255.exe 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdascmsdaurl6.1.7600.163857.0907131255.exe 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCorePortalConnectCore.exe 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\EngineTTSEngineLoc.exe 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RCXE16C.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\RCXF73D.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\RCXF7CC.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\FrameworkSystem.exe 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VisualVbe6Ext.exe 4b4267806c13daa2299e2f53d3758af0N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\RCXF77D.tmp 4b4267806c13daa2299e2f53d3758af0N.exe File created C:\Program Files (x86)\Windows NT\TableTextService\es-ES\SystemWindows.exe 4b4267806c13daa2299e2f53d3758af0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language visualvbe6ext.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language portalconnectcoreportalconnectcore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4b4267806c13daa2299e2f53d3758af0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemwindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdascmsdaurl6.1.7600.163857.0907131255.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4b4267806c13daa2299e2f53d3758af0N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msdascmsdaurl6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4b4267806c13daa2299e2f53d3758af0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 4b4267806c13daa2299e2f53d3758af0N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 systemwindows.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 visualvbe6ext.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier visualvbe6ext.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier systemwindows.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier msdascmsdaurl6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString systemwindows.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msdascmsdaurl6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString visualvbe6ext.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 portalconnectcoreportalconnectcore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString portalconnectcoreportalconnectcore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier portalconnectcoreportalconnectcore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 1640 systemwindows.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2044 msdascmsdaurl6.1.7600.163857.0907131255.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2348 visualvbe6ext.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 1864 portalconnectcoreportalconnectcore.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe 2104 4b4267806c13daa2299e2f53d3758af0N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 1640 2104 4b4267806c13daa2299e2f53d3758af0N.exe 32 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2044 2104 4b4267806c13daa2299e2f53d3758af0N.exe 33 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 2348 2104 4b4267806c13daa2299e2f53d3758af0N.exe 34 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35 PID 2104 wrote to memory of 1864 2104 4b4267806c13daa2299e2f53d3758af0N.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4267806c13daa2299e2f53d3758af0N.exe"C:\Users\Admin\AppData\Local\Temp\4b4267806c13daa2299e2f53d3758af0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\program files (x86)\windows nt\tabletextservice\es-es\systemwindows.exe"c:\program files (x86)\windows nt\tabletextservice\es-es\systemwindows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
\??\c:\program files (x86)\common files\system\ole db\msdascmsdaurl6.1.7600.163857.0907131255.exe"c:\program files (x86)\common files\system\ole db\msdascmsdaurl6.1.7600.163857.0907131255.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
-
\??\c:\program files (x86)\common files\microsoft shared\vba\vba6\visualvbe6ext.exe"c:\program files (x86)\common files\microsoft shared\vba\vba6\visualvbe6ext.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2348
-
-
\??\c:\program files (x86)\common files\microsoft shared\portal\portalconnectcoreportalconnectcore.exe"c:\program files (x86)\common files\microsoft shared\portal\portalconnectcoreportalconnectcore.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
MD5148a760221fae23b0af24ad1e839533e
SHA18af2cdad0758b6f122dfaba5edfe7b6f1adf757e
SHA256a52ddf5949e42d53681f89e5232b40e5fb8c29aa9f88037d30e9d4a5d66cdaa9
SHA5123d8b48332242bca6b958e88f271411522bb5dba561eccce155e249dc88e21f0fc6590955c57cdce9a39bf972039729f1509e3ce629001f4a72f649a2bd83aebb
-
Filesize
9.6MB
MD5d837579e323aa523577a6ea5427e92af
SHA13390e00f14de80f1e70391e2323f2f18347b6221
SHA256c3660c51d7a08d2a46e0de62f4800354582c3a6f89b880746ad1a2440633b924
SHA5121d589f5608e20a3743ca2211dd3f546c2c60be46975c4e9ecd94a0d101811bc047505d365f69ecf8e89319a6764bb03b16426876f31febfe9f499ac5c6459346
-
Filesize
9.6MB
MD54b4267806c13daa2299e2f53d3758af0
SHA1a4ff8e1151507498c739b610630df1492863173c
SHA256e1c0734cc667ac700ba1e95da2185caa19d002b775507638208ba1dc4a7f5f99
SHA512f49e46d13ad0a753e5667b302dbcbda3e6d98e0d4e5c76e84016df5bf442d7f18f6346570f5b1a9a09049aa2686a3c52c2eefd7ad610d3ea4cca0116c1923ccd
-
Filesize
9.6MB
MD5d2c31e754caadd494360ac327a3d2259
SHA12cd5528f63b2971aba344848c9de73f4871a9d7c
SHA2560c1a34436ff610f480ffd9e08218f49e6e495fd557ca4990c75ac97b0af2dce0
SHA51242bcd82e0210bdbc2c5e736a83781286b4f488ec98857ffa5834b256e9a86e43cc30bf38a7021e7961a7e09ee18b169d9d5f91c84a3e296fc261db04633488ef
-
Filesize
9.6MB
MD5b60f82d36073fea4ea87becd2cde3fae
SHA1b472101b8303fd4ca853ee584e3236d5014ae9c9
SHA2560ead721407123d0551e0ed81fcca02c62ba4c7a8242b1c6b0517081adfd2a1a4
SHA512bce093deaaa025c73cac2ad661b978d0470f57d12d9baaedca26e33f30d32516a336407f4fe72cb6c6d54cb52f1b706da9e2b3e53b29a2c9803bb8a7179c0364