Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 04:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://casa.tiscali.it/promo/?u=https://daniellara.art/neww/auth/zegynu%2F%2F%[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://casa.tiscali.it/promo/?u=https://daniellara.art/neww/auth/zegynu%2F%2F%[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133241970317395223" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1104 chrome.exe 1104 chrome.exe 3644 chrome.exe 3644 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe Token: SeShutdownPrivilege 1104 chrome.exe Token: SeCreatePagefilePrivilege 1104 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe 1104 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1104 wrote to memory of 740 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 740 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 3532 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 1220 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 1220 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe PID 1104 wrote to memory of 996 1104 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://casa.tiscali.it/promo/?u=https://daniellara.art/neww/auth/zegynu%2F%2F%[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff864a99758,0x7ff864a99768,0x7ff864a997782⤵PID:740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:22⤵PID:3532
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:82⤵PID:1220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1352 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:82⤵PID:996
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:12⤵PID:4212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:12⤵PID:4000
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4568 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:12⤵PID:4520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4864 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:12⤵PID:3948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:82⤵PID:3792
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:82⤵PID:4136
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:82⤵PID:2788
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2828 --field-trial-handle=1812,i,6876741305104087649,13257714960397362140,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3644
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3a92500c-27fa-44c1-8d4a-19fc1fa67a8c.tmpFilesize
15KB
MD5bed909ea0843c52336a6a40d254268d9
SHA15252e60175a1a9070c7fcd396dff34703e532ef8
SHA2566e42451e16c24da9a74fa6178fa6025487809b7fb82d7b469a3e109954d068a5
SHA512506015bb9d3fb408509ed3913cc031bce5318955054b35ae6d9871292e7c9fd12b58f008764c7495024f42b320ef2a36ab26cadc2766f1e9c735a5e3f8a684b5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD52c3e261ae16ed22dc8f927139c34a458
SHA18471313db701228e9cb58fe971eeee6c630ec544
SHA256e81165dc9c73cc66523ceb41fefd5cc6ebc609f1787c936c0e1f021356742478
SHA512728dc107f6ee57d02f7ff37ed7c27290039e68a4d16ba445e1ad60720deece6907b935dd81a508c0289be41fe499102f6fd9510ae94094db9dfc95125678c9ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD52fbb6e1af47652dfa0dd93ad8bfecf34
SHA1fbdf19f5189776e02d3f8543a2d953758272f88b
SHA25625d7bf144294e5cbfcb06599555c79e05d19158fa65821ab46014c57f1deab08
SHA512d154daf53a5d696932d59fbcacb394c81fd58179b79d35ff5bdaad4254037f32da4044f3f720c1e6539e75ce899eafd64cb61115592d3fd55b8b7194ee4c65ba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
874B
MD579ce195955124709ef2ad7150cc0ca7a
SHA1e62ccc182fb265b165875fdac78b0ad083549bc1
SHA25639ee917c109a7618cbc21bff48a10d877610801a8d22e9d84dfdeba6143183f1
SHA512ba1679abd92c9a5e18fd8f355e7dfdaea4c13cf22de0bccf3f2bf3a726f597f3c98c44c2e57b8eb3a503cd481fcbf882da36927c6d4d41451e3934e24f8e9305
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55ec3ca1b0dccd40befbaa2c5f1e952e2
SHA17557e46d4859677999f76c8e3766c72a78c38451
SHA25680debe13214cde0a4265ca62b97b1538d46934803686e443c2be26377da7c3d3
SHA512e95100e331fb81987f096d23e13ce68d96db6ad47b57c38c37a2f6994ff83a7b03666048309e61b019051f1018f2c106bc91f4f94f3249e420ae7e87ab5a37f5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD50d1726e7c1e5bb78251fe55659f1d14e
SHA1276e1a12466bbb833386d62b2cf88e1b3abf110b
SHA256c5cedfdc014cb8a1a990085db7884647ef99a329efb117de104e0ddc0b82b643
SHA512e052007092f141c7f281d13560e35855dfb3d6552aa3f0a9751767cf0cfae9a9cc36dc1509b91a98361c2f0e59db6a65b72660ce051e506e8f2ba49a6086d1c1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_1104_SHTRFBLXRXFNAVQJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e