Overview
overview
7Static
static
3Launcher S....0.exe
windows7-x64
7Launcher S....0.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Launcher.exe
windows7-x64
7Launcher.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/fa.ps1
windows7-x64
1locales/fa.ps1
windows10-2004-x64
1locales/hi.ps1
windows7-x64
1locales/hi.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
Launcher Setup 9.8.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Launcher Setup 9.8.0.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240221-en
Behavioral task
behavioral13
Sample
Launcher.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Launcher.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral22
Sample
locales/fa.ps1
Resource
win7-20240215-en
Behavioral task
behavioral23
Sample
locales/fa.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral24
Sample
locales/hi.ps1
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
locales/hi.ps1
Resource
win10v2004-20240221-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240215-en
General
-
Target
LICENSES.chromium.html
-
Size
6.5MB
-
MD5
d18c09a075cb6531d7ffd7c3da77bd4e
-
SHA1
571f29b6004007111782bf5727c4bc9510cca286
-
SHA256
86f5222580a4ab03dad8ea62e6cea22b23454dccf1c77e74ae0e0410a13b16fc
-
SHA512
091cd68e12633919fc6100b606f3002b16f4b9c7c6d7c820ff20e31a3b9ea690c8a1fc90529ff3e5c21e8d778e254743a8708049830c3bb046eda8f2653000b7
-
SSDEEP
24576:8P5K5WfWSJiJjQlaCmf2P6e666A6o69/kHPZQHpuQ:UrYR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 444 msedge.exe 444 msedge.exe 232 msedge.exe 232 msedge.exe 3528 identity_helper.exe 3528 identity_helper.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe 1892 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe 232 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 1688 232 msedge.exe 14 PID 232 wrote to memory of 1688 232 msedge.exe 14 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 1028 232 msedge.exe 62 PID 232 wrote to memory of 444 232 msedge.exe 61 PID 232 wrote to memory of 444 232 msedge.exe 61 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66 PID 232 wrote to memory of 868 232 msedge.exe 66
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9a7c46f8,0x7ffa9a7c4708,0x7ffa9a7c47181⤵PID:1688
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18326393914472181611,18334614327213510929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a65ab4f620efd5ba6c5e3cba8713e711
SHA1f79ff4397a980106300bb447ab9cd764af47db08
SHA2563964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76
SHA51290330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9
-
Filesize
152B
MD5854f73d7b3f85bf181d2f2002afd17db
SHA153e5e04c78d1b81b5e6c400ce226e6be25e0dea8
SHA25654c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4
SHA512de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971
-
Filesize
6KB
MD5be2965f82011db749e1fd1d03e8d94dd
SHA163510eec944ca5538d986dcb4f7ff5650eec81cc
SHA2561435d73605c15b9c7236ed3b749e67b621e60616be7ed3a563b89efec05ffb2c
SHA512d1650af5cfbc70e858ef387fe3f586b28f55d2dbeec9d8ef5508bb34363d2d5427d74beadc2f5493ff891d689642165937378207f7c8f1e750043e77d1d138cd
-
Filesize
6KB
MD5b310568d4ae053a0c70ac18b52d4a761
SHA16e0cd278a5dfadd7327319b78f295d779ad019cc
SHA256ef409c218694d63b1a0f81f08479652223aa0d3b1a659e9aa685b4f62ea3d709
SHA5127a9d763472bfa8135a3e0cd7f4d97a300a0fa379bdad6cc57f56a91f4355017b3581e82504cd00a0cc53450137468e42c06f80d4fccb243928fe5b7be7d72e84
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD590572df81483a8c27d49190ac106bada
SHA1706e0006e71959af9c9237d2677ff58b9e10c77b
SHA256009c2fbfc9ac4509c31d72f947b914a8f63fb12d2b11060e5969e3a5e3c13c63
SHA5121f04acd1e54c03f816b9c3eb17c87d4b9e6420ed73db1e8a2305a2503b239aac96d0b44be17ae6b0eb9bd33c0f0fda14d3edf99ede4e5069d59e93ed63860bb7