Analysis
-
max time kernel
299s -
max time network
268s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 11:04
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mpgym.ajst.inf/GUhRmgL3x/MPgYm/dGVzdEB0ZXN0LmNvbQ==
Resource
win10v2004-20231127-en
Behavioral task
behavioral2
Sample
https://mpgym.ajst.inf/GUhRmgL3x/MPgYm/dGVzdEB0ZXN0LmNvbQ==
Resource
win11-20231128-en
General
-
Target
https://mpgym.ajst.inf/GUhRmgL3x/MPgYm/dGVzdEB0ZXN0LmNvbQ==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133457294641066333" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 4648 chrome.exe 4648 chrome.exe 2204 chrome.exe 2204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exepid process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe Token: SeShutdownPrivilege 4648 chrome.exe Token: SeCreatePagefilePrivilege 4648 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe 4648 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4648 wrote to memory of 4784 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4784 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4000 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 3920 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 3920 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe PID 4648 wrote to memory of 4012 4648 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mpgym.ajst.inf/GUhRmgL3x/MPgYm/dGVzdEB0ZXN0LmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa5aa9758,0x7fffa5aa9768,0x7fffa5aa97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3924 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3316 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4928 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3936 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=212 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4700 --field-trial-handle=1836,i,1836887653561818468,15431001957679095637,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5c3693ea7c6c64f87c19c9ce5466d75ce
SHA19f432eb830957d4e5258dbe5eaa6a974346578ee
SHA256d76ed9a260f5147e5ad147ed4086c41054eb0cafc46434ec348cb902a3254f21
SHA512a976c575a73d32b7b1764da0aec341fee4300e4143ed1ce6fc31b8276f4a94c9a9c0608dfa574959eb0b4542d866c465d3de67fadd2936806db3d7a5af875911
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD55c1805d225fc62260e6c85b81f9d4e0a
SHA1393b46e5cdbb5745f77bc03a76b9a8eacde0269e
SHA2563dbc60bded3d1ecc3a661643d203144dc3c81301c6bef633f9918a31bdf4dad1
SHA5125d90e5572d96c3c61a8c5abce18c59f359f217ad58c0db28797a0863250dc7550a2ba7065aff21784e9b5c105d4a42c17eb28d1a63a053d8cd18979d2520ff81
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD57ead5f5fdf4ee9d929b5fcdca8878809
SHA170acabea55118e66b8d38c419bef75c67b8abc9d
SHA25643bc7f15c92abdf9d944ec9e202b8707d40521f6025b33bff29ab5eab7e26d32
SHA51238b96f4a6c40ab55aaa999ed812616a1b9818ad84b836a30950d74db1df465e5a8c8b3cf9a358f663a73bf8d0a8d161ff2a8ebcd80bded33e5376c86a0f41375
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
115KB
MD5acb8db014019a8da4bc798720178c004
SHA1bfb59f743aff841c5039759156a3835299bec877
SHA25652f8e7699ce55073014b4bb95e205a0fe7a1f9ce7fdbb7adcb0d5c13e14c3a67
SHA51201e6d1a18c38735e054564df8fec10960e2506a920c3b04689227fb4aa54dd07909ccd577d8a10e866f45ac92f6c7644dbb4daffaa9447f0dc692f89391f0964
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
\??\pipe\crashpad_4648_FNLFYRDOSNVYDWEIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e