Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 11:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://i
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
http://i
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
http://i
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
http://i
Resource
win11-20240214-en
windows11-21h2-x64
General
-
Target
http://i
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009eed8a9e03dd3cb60fcb0ba9132720dc3cff9de0e303ed6de6653f95f614a830000000000e80000000020000200000004de816d444e896f182f4e5bb74a36c0b350b07677ef92db684d9eb48aa9991b4200000009fe8a61f0db6617ad2aec82a39a26db246173c23b5efa2aec3458c0c58e3d45b40000000a8ed7503074e7f3f4953aafe97f778cbe2b418ad6dbe116ba4fa382eddce5849c504edd129674ff9e6324c080af1e6fead4e5ffb12bb61ca76949271080cc5aa iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fd59b22663da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA8FDF51-CF19-11EE-8AA0-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000065c9573482851824adb73262daa5f5884c0be2ebd6902f515e917cfd3393be37000000000e8000000002000020000000e743e374d9ac009c71138970665885596305df5b7fd6ba7c6bb142331944682f90000000bac8584af3465ace52a18f321609bee11ab81065a5374f86ce31e6c2daa444507412f2c6ae56bcfa47194f66daaeef5cf6870d7bbfcfeffd86ea3c5aa2419cbf67d54c22c8410042187265f7c279309ff26b099a74ac1f21b39f0d7811ff2dbc07c037068e9d19548830139ea643fc6d245cddd029cedfe6dd52a1d090de7f3b51a190303c237646f0157e7ddd174939400000006558b97419e86a8ba6efcf00b9e7af897e050269b3d83045e33edc65555349ade870cf02c08aa81ed58cfdb08b56b3bde2e6536c60963d03153f839c3daa8281 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2544 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2544 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1940 iexplore.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1940 iexplore.exe 1940 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2544 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2056 1940 iexplore.exe 28 PID 1940 wrote to memory of 2056 1940 iexplore.exe 28 PID 1940 wrote to memory of 2056 1940 iexplore.exe 28 PID 1940 wrote to memory of 2056 1940 iexplore.exe 28 PID 2544 wrote to memory of 2272 2544 taskmgr.exe 31 PID 2544 wrote to memory of 2272 2544 taskmgr.exe 31 PID 2544 wrote to memory of 2272 2544 taskmgr.exe 31 PID 2544 wrote to memory of 1804 2544 taskmgr.exe 34 PID 2544 wrote to memory of 1804 2544 taskmgr.exe 34 PID 2544 wrote to memory of 1804 2544 taskmgr.exe 34 PID 2544 wrote to memory of 2052 2544 taskmgr.exe 36 PID 2544 wrote to memory of 2052 2544 taskmgr.exe 36 PID 2544 wrote to memory of 2052 2544 taskmgr.exe 36 PID 2052 wrote to memory of 1932 2052 cmd.exe 37 PID 2052 wrote to memory of 1932 2052 cmd.exe 37 PID 2052 wrote to memory of 1932 2052 cmd.exe 37
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://i1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\wininit.exe"C:\Windows\system32\wininit.exe"2⤵PID:2272
-
-
C:\Windows\system32\wininit.exe"C:\Windows\system32\wininit.exe"2⤵PID:1804
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\wininit.exewininit.exe3⤵PID:1932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d177d2d4fd74964c1a8119e8bcbd1cde
SHA1ddba015a0b691412fca255a7a20dc6535bf08b2c
SHA256e321009a5ea15766b6861e8fed3c3182fe3450aba74070ab1e46ed3a05f270ad
SHA512a3f967dd5b90743edaf957cd57c8eff1109d8dab84f7331603d865a1851c266891f113dac6b3b2cfcff61ca26bd9ac9279bb4895bb0e05a9a82578af6e903356
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a7c655df8e5ca80d4921560275d1895
SHA1cad52b3792a320234b33baa217c4cfccb657da58
SHA25666df38fd4e1b02158edce10c83f46d3deb08f87a4de7109f7ff176023017596e
SHA512f9ee0eae8f28b44fc7d2a1c32518f75e62e91f7a876726ee55ca6bacc9b6e777b187d916fff7c4342cb1d41f7713553aff35cc5355518cc0c7796f43e659ebac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5070a3df43f32e2100dbf7d31e8e54d82
SHA1a441d32ce7b2939a3ab4d3e746c21af7056fc618
SHA256f981b8c9b805c6525b62cae2ccadfcebd2858cb60241178b5af4966536765086
SHA512bcc69ab95524caab749d2c8765a458cbc18fb4510055f2afee95dd68a23d257f584276ad07817b00af9fb6dfeaab8dcdf877c95e0aafff6c9a43801375bf047b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5638a32ecdb67b7643d1368796b7ff574
SHA116f16c323d4ab11cc2d70e3d297d536f7346dee9
SHA256a1435e000b3cd296bc67c2780dd3840beeb4eedb0dc27b50c5c86b7fdd7ae20b
SHA51243a767f335173a127f07e45ef82070e2af913a37951e39f3328cfbf1e78d8054c777adfa8ee0c9f1c469c56924a7d6b8a23174c2af7fafebe1339069aaa82aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59082d98bd9fe3dfe949d479e4a1cf466
SHA111866fda7f5048b051cb5fe8b806abcadeeb026c
SHA2566d190223b285312262bec8c812758336a684e324d734d1c31f089acaec7925c7
SHA51223eb664aaaa0a188fdca8d22414986bcd365ddf8a8179a84d6f75ed93b87b11e946b4b5d179a9bba10de428d29f1c7c1d8837019c5feb7cf14adad0c7ba43500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3a352070494e8aca512ce4b06b73ce0
SHA1472522e29e84cb089be90242b4caecb17d2d6c16
SHA256811896fce96102c262cebe4ac54dc844e450b82d608232bf2fb1a7d97598d82e
SHA512d587d3cf3c085b304e1b295ad79f11360c00ad3518e7584dd073fac34a29be0dad0ca9f6b19951e48a47a2123adb8f79ea520c8e13a710aba2e4706a55fcc6d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c4f652ac7c8ea0ff9466f34cc9db1b3
SHA1a306f671c65f8282c761498a3c8f0acb305b338e
SHA256eeed3d46e224dda998c1b341c1a3d760fd35bef7c26a947cba9ac9f0f8eb8233
SHA512598b039c7c62ac269f7d141f70d7176faa7282e74bf1e95ba4a9d53c8da540af39416cb24d96cec9b44f102bb3ace76ed25dccc1c023246e104f25c10fbdd0eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50edefba2265df890e683e8e17f73f7df
SHA1c37cb052672414a60a1a5df836f41f8a712b10d1
SHA2561ac6591afdd8e7bb476fec4ca672c5c742574500fe0bebcecdb1f5c552eaf711
SHA51201c4635f2c80adc21740aafa33337ad10d162151f7740e51f67063406924b806a9babaca411f670de36c4319ac642b77b914068d9a37c4454a0f3fa35e3fc328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d68fba5297d783ada82283358c974f2
SHA111cc2085aea6fc136b279b1a99cd53e530796554
SHA25693d2caef221279c8c73837ad62f6c60075ec78e1d9155649d2fc3776dc1b57f4
SHA512d9e05727dd96548baa99d3ee954f50a574efd8b6155ec63bfa4fc5d43f52e1d8488d93908e3baa3d8c28e26fe09cf7d453a266f1b3c9addedca97b4cd31079aa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06