Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
14/02/2024, 13:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.com%2fv3%2f%5f%5fhttps%3a%2faxa.vuecloud.net%2fguest%2f0a40e1b50c73d49f23618cd3ea28f0fd9258dc88fce2040cc067f4f1aa9c3601%5f%5f%3b%21%21NT3rrZz%5fVG2e%21N6D%5fx8nS9t9KHaXiMoJqf8pREC7OFypnFCv8QKIC4nUZclBhB1DY9y27xX1zuLsXLyBgI%2dp1qbRf9CSN12p2DuaSO5U%24&umid=4f485b96-9672-47ef-9c83-d6f6b93bc8f1&auth=663c9af02b28e622c0295e1568a206100d47dd90-787ae102314ed79243fc563ddccc87e51bce2600
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.com%2fv3%2f%5f%5fhttps%3a%2faxa.vuecloud.net%2fguest%2f0a40e1b50c73d49f23618cd3ea28f0fd9258dc88fce2040cc067f4f1aa9c3601%5f%5f%3b%21%21NT3rrZz%5fVG2e%21N6D%5fx8nS9t9KHaXiMoJqf8pREC7OFypnFCv8QKIC4nUZclBhB1DY9y27xX1zuLsXLyBgI%2dp1qbRf9CSN12p2DuaSO5U%24&umid=4f485b96-9672-47ef-9c83-d6f6b93bc8f1&auth=663c9af02b28e622c0295e1568a206100d47dd90-787ae102314ed79243fc563ddccc87e51bce2600
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133523913448406428" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4776 chrome.exe 4776 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe Token: SeShutdownPrivilege 4212 chrome.exe Token: SeCreatePagefilePrivilege 4212 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe 4212 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 4360 4212 chrome.exe 54 PID 4212 wrote to memory of 4360 4212 chrome.exe 54 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 4252 4212 chrome.exe 74 PID 4212 wrote to memory of 540 4212 chrome.exe 73 PID 4212 wrote to memory of 540 4212 chrome.exe 73 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77 PID 4212 wrote to memory of 1600 4212 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2furldefense.com%2fv3%2f%5f%5fhttps%3a%2faxa.vuecloud.net%2fguest%2f0a40e1b50c73d49f23618cd3ea28f0fd9258dc88fce2040cc067f4f1aa9c3601%5f%5f%3b%21%21NT3rrZz%5fVG2e%21N6D%5fx8nS9t9KHaXiMoJqf8pREC7OFypnFCv8QKIC4nUZclBhB1DY9y27xX1zuLsXLyBgI%2dp1qbRf9CSN12p2DuaSO5U%24&umid=4f485b96-9672-47ef-9c83-d6f6b93bc8f1&auth=663c9af02b28e622c0295e1568a206100d47dd90-787ae102314ed79243fc563ddccc87e51bce26001⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffea4629758,0x7ffea4629768,0x7ffea46297782⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:82⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:22⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2820 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:12⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2812 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:12⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4728 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:82⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1844,i,105465269715761802,7127725001416379892,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4d49dcd5-c37b-4753-b1a1-4db5ff6ef11f.tmp
Filesize6KB
MD56c6df58bce35e61d68f622cec8f4d8d7
SHA1f81d38615f9e86ad277089b523877e79af28c18f
SHA256761820acab1c5f5268a42c61e28b3417a8713ad796abe34d3dfa0d8cb29519f5
SHA5121632ca3ab4e878546f26ffaaa9ab2c59afc901098400ff15a6eb520a60af859a6ba96af7f707e69694e106b162d3139b0cb351ac0bda37b6c9e2110d154e95d3
-
Filesize
216B
MD53f7b9be434c8492374b1986ef56e017b
SHA106960cdd13c93605aadfe0a9a861a26adc07c319
SHA256621409d9489e42c14a232167511124652b9b6ad9391a94d52cf6f11ca29e04bf
SHA512903ece3cf7f7a1438cb6b2e231da9bfcfa07b269d8eedd47cc9632b43682b14575723c11af3e63ffb92c5a943ce3638587cbb49437187936d63c5fd6a1d675d0
-
Filesize
996B
MD59a91a159004103e3962460a3c38a6547
SHA121aebeac3d28962290d0024dfd3e515de8077da0
SHA256ec69315be5f96d53af3b2be776aed9759e0b71e6b2e231dbba915c7e4529177e
SHA512b0956b4564e9b6fbabc92840c25ba3c9c339bf35dc31f3bb8549447999ef2770ca547d6fe078d2ae5dbc12f818daa730a0d2e01242ce4f79857e42b7eb9b491b
-
Filesize
706B
MD57d2e2a2af441415f09e0576cd0efedd4
SHA156ee6d8d0c40ddae26af68b19295bca02e6c1668
SHA2567a005aa36b96f58907fafaaf74ce2fb5bdeba647fbe6ed8e28fe565425f9bc96
SHA51298a499f2e363098e07f12c7c02aa75b702f8039704689e9ddb4705030a10d5a6ff1a893a70694dd99d2ca0397458f3071d5c0116b12f151aa839da00439ef571
-
Filesize
6KB
MD5e035345a8dc18c55cc72c59fd51cb949
SHA130882eeeec09cc1327cb3e39f0ee8211616638c3
SHA2565a6173894d791b87185d3b9c3a9fff78f517f4c30b3de51359f0d7ebe6cdb0c5
SHA5129932d8cd2dc9d7d79d96183a8a9ab8b073312a485b05ab238a8df8c640c9a34410f408e50d115305907f2a3a5a3a7aaa095be270162955e2f8b5de99ab574427
-
Filesize
6KB
MD596a30f8a7ae277b68bb4135d168c1d36
SHA195baf2824238ebe090f5e2bd3440b439fcdcf938
SHA256b9a9c4305705b2b01a2413b2e86544c043e743a5b84f8d92ae0b1330d16379b5
SHA512a0e27271c2ec0bae2f8741f6ca62da1634090d2fec8efae70678d59784bb05f07e289547c9a497aa9639b1867519cf989df11ba4feb65e58b99a5530d8369c08
-
Filesize
114KB
MD5601b5890bc74ecab6b21b87bcabd6ef7
SHA1c480e129823b22dff3b1e2a6fa8afc861dda0fa4
SHA2565e632b62cf79fa5c2b99f64d3885850361743f13f8d419cb3d2e543ff0d83801
SHA5120ba9aca6b283bb8b06a59f3b1ea9cf1e2e96b09e731114aae791b74455b3956b5d164b83e4fb54a3dee8ef04e98ae46883d55b0df4ca2fc1ae37c766d60f6fd2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd