Resubmissions
17/03/2024, 13:25
240317-qpfzdafc72 116/03/2024, 11:53
240316-n2tpwsae21 116/03/2024, 10:31
240316-mknlwabb86 116/03/2024, 10:28
240316-mh4kbabb46 816/03/2024, 09:43
240316-lpxvnsgd3t 116/03/2024, 09:42
240316-lpqflagd2y 715/03/2024, 19:28
240315-x6vx7aha7v 815/03/2024, 12:26
240315-pl6j7aac75 714/03/2024, 11:42
240314-nt9q5sba9s 614/03/2024, 11:40
240314-nsz6baba5t 1Analysis
-
max time kernel
261s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 10:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://google.com
Resource
win10v2004-20240221-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
https://google.com
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2232 msedge.exe 2232 msedge.exe 1748 msedge.exe 1748 msedge.exe 4364 identity_helper.exe 4364 identity_helper.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4508 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4508 taskmgr.exe Token: SeSystemProfilePrivilege 4508 taskmgr.exe Token: SeCreateGlobalPrivilege 4508 taskmgr.exe Token: SeBackupPrivilege 2408 svchost.exe Token: SeRestorePrivilege 2408 svchost.exe Token: SeSecurityPrivilege 2408 svchost.exe Token: SeTakeOwnershipPrivilege 2408 svchost.exe Token: 35 2408 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe 4508 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1748 wrote to memory of 4176 1748 msedge.exe 45 PID 1748 wrote to memory of 4176 1748 msedge.exe 45 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 4292 1748 msedge.exe 87 PID 1748 wrote to memory of 2232 1748 msedge.exe 86 PID 1748 wrote to memory of 2232 1748 msedge.exe 86 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88 PID 1748 wrote to memory of 2608 1748 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf6ad46f8,0x7ffbf6ad4708,0x7ffbf6ad47182⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4386067298249487364,14296514061942835792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD591746379e314b064719e43e3422d0388
SHA165f1a2b5a93922d589142a6edf99b5b35d986dba
SHA2560b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7
SHA512a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808
-
Filesize
152B
MD5ccf8b7b618672b2da2775b890d06c7af
SHA183717bc0ff28b8775a1360ef02882be22e4a5263
SHA256ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420
SHA512eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97
-
Filesize
195KB
MD5873734b55d4c7d35a177c8318b0caec7
SHA1469b913b09ea5b55e60098c95120cc9b935ddb28
SHA2564ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d
SHA51224f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5ee8cf9571058a313043800dc955d4868
SHA143d707f49bce0afcff53b406bc5eb79e94ed51d6
SHA256af8d451b828b894e2c359d06e89937154c3e7502155b85ce28858f4599b3a4f3
SHA512b262eeefdff4e67eb51cff3a7ac6e8aaf7da2a389a975afcbb62ec437cf3f1b05733cf134c7ca8cf5b30d99b195c728b12b2ff0c7d2f1f0a0a5a272301483ea2
-
Filesize
1003B
MD5d5910ac16ee2e4d8519473392a66bb60
SHA12ae08814b15cf6bab00b17b5349261300e1c9f7c
SHA2560e5c3f0bdf33d513ea812cfc80d6a43e95fd405fd3a888c68363c6991309009e
SHA5129cd9fbfc1dd5357d288b9eaca3e299b113695883496ddcf5ff9c7fb710e03284108065a674bfba87d958bb6edc135238949b6137f85f4d9dea5e1d5e95a241c1
-
Filesize
6KB
MD52c6950f4bc822c827973530c15c32d86
SHA155eff71a1f46f3ea8eb24acd3ab854187f6fd30f
SHA2566e22fa4f76bd02f0a57741e0d10b10bf5feaebf42d6282c03b392af4c34ddb25
SHA5125071a84931d3556cca80cf82d77320004369fb8d5fdc887934057d1215d07a287251f9676cbc58d2004dc121a89931b41e80715ce724b3f187f6dfb61d4aa3a5
-
Filesize
7KB
MD5ea8675b4f0618d0ac9d27e47b19aacb2
SHA1942cff425519ce686845e467d53ac7da47df7393
SHA2568f4395f9fd9b4411a947750ea98f04e5167f289905e9faac352a177a695dcea0
SHA512985afb04a2a3bd74bfab433f86b62ddab74049e6c23c62d61abb72401f09d272bd228065e705257fbf4210731b5434337744e5fcffc8ff49782da574745b08b9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53a719cbba5e8149458ad14aff4826799
SHA17f44eee9a1f859e5788d9ad331132b888036f394
SHA25645e5e0ad59d99f9ea24fac450eca3a57da65a8bca862ad9861ca65ad965b3cb2
SHA51203ca9c45d3afe5682fef1533da87d0329e5e33c241f40f5edb5f8e692377bbbc85471a3b910b5570bd7fe1cbe91a3fe0b00fd4d715f3837d398a10f82cfc935e