Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 18:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe
-
Size
874KB
-
MD5
01c875521f3c15d155e80017c296e884
-
SHA1
cbff30d3c3a83613ede4be222138ac1222120262
-
SHA256
16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427
-
SHA512
b41f0aac37cff7cdb173aa69bf0a0a023fca549266216a6fb5d2a97a30e449018a26d6b2ecffc720b95edc1de1ce2ad3df46fe152387d6e691167ae00f12c70d
-
SSDEEP
24576:ksFmJ1R7GQLSCjtIu6P339SSgT7cu6P339SSgT7:pmJ1RGtCjyvNSFTwvNSFT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2256 eqsC6D8.tmp -
Loads dropped DLL 1 IoCs
pid Process 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\RCX1E28.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX3E16.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCX46F6.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1FB2.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX2422.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Microsoft Office\Office14\RCX1F5D.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1863.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\RCX2597.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX17FB.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX189A.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX40B1.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1E07.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1F90.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\RCX2609.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1782.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1DC0.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX409F.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCX24A1.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX41CC.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1876.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1D9E.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCX264D.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Media Player\RCX221B.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCX27CF.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX4481.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\DVD Maker\RCX149E.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1D8E.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX1F6E.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCX1889.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCX2802.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX408E.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX42E7.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX44A1.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCX27BE.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCX4101.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\RCX1DC1.tmp 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eqsC6D8.tmp -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2256 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 29 PID 1056 wrote to memory of 2256 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 29 PID 1056 wrote to memory of 2256 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 29 PID 1056 wrote to memory of 2256 1056 16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe"C:\Users\Admin\AppData\Local\Temp\16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\eqsC6D8.tmp"C:\Users\Admin\AppData\Local\Temp\16c7368a03629d421a298d675f64cc94a338be75f8a7dc676b2e7562128c1427.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
643KB
MD5dea8102a839d89d673a269324f58e03d
SHA18f9736d8d032f890053ca6a48e5b3aa9c7527b19
SHA256e2211fe03771502a16c75e68939119955776ec70d750239a2bba4259f2697b63
SHA512e461390e1575aa5acd26ddba0da980c5bac48fdf77f95a7969a9027d43d28402f65e777fa183f7350ad038a99ace3681b515bfda2d5572006b6c5e43d4434e8c
-
Filesize
12KB
MD531ca51862b31bcf129556d16f467af09
SHA15a211b99259a8b98aba5b281f57d2dbd6cf3325f
SHA256c02959bf05c6802755bda953e649cbdb7cdb03ba0a4f458a84e575dcee0e907c
SHA512ceb6864b90a5f8eb8192f4de5914a3aca6788dbca27d724be07484f18cb4d8c6cf6c5adeac6956d21ad15f695b959d1d6712a2ca876b50e24f4591e6e8b6f47f
-
Filesize
377KB
MD5cf6153a55aee80753afea53021a6e266
SHA14df435f5781db6c125e2ec084f629a71a67efe05
SHA256992424b87abe32006b0d40ced3c4d9917affc29d62db28c69cc002e1df89e536
SHA5120d733961e15d21da74c050924d30b7209d415044fab35c5e68ffd6a8052d1016497f0c3180a4f12e641c136cb272d2f952124cdfd62cdff71f7b6dc6ce3cf8b6