Analysis
-
max time kernel
569s -
max time network
542s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/01/2024, 11:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vskyn.com/#JTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJyZWZyZXNoJTIyJTIwY29udGVudCUzRCUyMjAlM0IlMjB1cmwlM0RodHRwcyUzQS8vdDUyOC5jb20vL3NlbmRncmlkYXBwLyUyMiUyMC8lM0UlMEE
Resource
win11-20231215-en
General
-
Target
https://vskyn.com/#JTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJyZWZyZXNoJTIyJTIwY29udGVudCUzRCUyMjAlM0IlMjB1cmwlM0RodHRwcyUzQS8vdDUyOC5jb20vL3NlbmRncmlkYXBwLyUyMiUyMC8lM0UlMEE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1888 msedge.exe 1888 msedge.exe 1684 msedge.exe 1684 msedge.exe 3660 msedge.exe 3660 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1072 1684 msedge.exe 14 PID 1684 wrote to memory of 1072 1684 msedge.exe 14 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1980 1684 msedge.exe 25 PID 1684 wrote to memory of 1888 1684 msedge.exe 24 PID 1684 wrote to memory of 1888 1684 msedge.exe 24 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19 PID 1684 wrote to memory of 4896 1684 msedge.exe 19
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb86aa3cb8,0x7ffb86aa3cc8,0x7ffb86aa3cd81⤵PID:1072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vskyn.com/#JTNDbWV0YSUyMGh0dHAtZXF1aXYlM0QlMjJyZWZyZXNoJTIyJTIwY29udGVudCUzRCUyMjAlM0IlMjB1cmwlM0RodHRwcyUzQS8vdDUyOC5jb20vL3NlbmRncmlkYXBwLyUyMiUyMC8lM0UlMEE1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:82⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:12⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:12⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 /prefetch:82⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5600 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8638889509685817493,4556084224525981788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:5056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5486b02f7a99a0a17694b126bf15047e3
SHA151d94e7099b5f33f8e1df8d140cd9996a7e967b9
SHA2567232449ea5ad966077bd420c1d6c4aa451e24839f66df3281243f6fcabd25e4b
SHA5129d553d38024109a271f7841b7e106e3802abb0d23beeb9eaf19cda51e3541e7bf1c5026871cf128a534610e9c791b481eb86d695adc54e74bfd524cc6239de15
-
Filesize
152B
MD55cabc17286e25c0ade7a7f050b6e92a6
SHA1c25ab09177ad0da9ee6caf78310236bdc2cba319
SHA2560e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6
SHA5120cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
4KB
MD55abc11318d8b16b2b6574a8060e05ed4
SHA1ba1c08a4ee446296860f27e16795c574d5d06286
SHA25698c5b069f39b6b8774563193d01a1cf2523c5bc59e1504669aee449410af8b20
SHA512b55b84b393b9934376074b636d669c7083be7966de31b88719264312fdb721350f3e92a0161a6b80662804a4a492af0a7f2ed70a9412228c02926dab0489c317
-
Filesize
5KB
MD5baa579a01e5c6905d8dcaab935dbb30f
SHA179f4332ce7687632aae9cc5e24a664a73f1709bd
SHA2564595a1a30daa67b376930997e3caef93fbef0c23d6f55f7c1708b7d1edd37da7
SHA512ac9b8a8cc1b4fe32b565ff6d57842fbc4a542e7c202fd580645758575bc6c009cb860bfe07855d53a497bb1d9394dba3f2b2049f163f7bebc046550b4d810572
-
Filesize
5KB
MD5857766005a4f150e6403a05512fd1852
SHA167ce5d6f11f9010cdfbd3d8fea3f1860df13b8ef
SHA256a2fde3a3b2870dd11c463cac6e1bca53380e989f240886c315de0367cdba311e
SHA512875b42e399638fb24c8281d64a689a4474d0964d04d376221abb3a0845bdd4d549ed5cc29a1f9f32717cee41966e7c93cf361b6d3e3f99a028563069f46e1dbb
-
Filesize
5KB
MD5a16fcbf7da1a54762eab673a6f7e6f6a
SHA11e67b86162590d97e069d06f54d8722a56dc1f1c
SHA2568759d665c6b1b63f837a4c2c4d36c28f37b0ffa641840dda3c9ec3b80aa1c305
SHA51254dcdd08e410c13253a938121ae571785c069473cd2abaa9900c2539ecd3587337a46b6670b8386a2cd963932bd8d38f22b8d67c9fb4228a5af41ae1565bdaa4
-
Filesize
25KB
MD568fe6f34e7d6603a3d2f4c95919f8408
SHA1c7be30582f94d46f05338cc39726f72c9e2fa4cf
SHA2568cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a
SHA51248eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5bfd5dde348e00aba738b74f742beb06c
SHA1ceaabc09ab74f2eab55f9c3461c7a80db3a5188e
SHA25645f4513c351a85de070c067daaa460309677066f23d51a1cbda39bc7dfd127de
SHA5120ae8ab201b2298d04a55f8a2265067f1cb201321a5d8799fd37870d941fed769be69e3ee91de058c923310be655d66b79d60efb983cca916ee975b53c31408d9