Overview
overview
4Static
static
32bsk.zip
windows11-21h2-x64
12bsk/!!!Re...!!.txt
windows11-21h2-x64
32bsk/Gold WareZ.nfo
windows11-21h2-x64
12bsk/Readme.txt
windows11-21h2-x64
32bsk/crack.rar
windows11-21h2-x64
32bsk/groceryc.dll
windows11-21h2-x64
32bsk/mobik...er.exe
windows11-21h2-x64
4Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...al.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/loading.gif
windows11-21h2-x64
1Resources/...it.png
windows11-21h2-x64
3Resources/...ow.png
windows11-21h2-x64
3Resources/...wn.png
windows11-21h2-x64
3Resources/...up.png
windows11-21h2-x64
3Resources/...it.png
windows11-21h2-x64
3Resources/...il.png
windows11-21h2-x64
3Resources/...ey.png
windows11-21h2-x64
3Resources/...no.png
windows11-21h2-x64
3Resources/...re.png
windows11-21h2-x64
3Resources/...er.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...er.png
windows11-21h2-x64
3Resources/...ed.png
windows11-21h2-x64
3Resources/...es.png
windows11-21h2-x64
3bubble.html
windows11-21h2-x64
1license.txt
windows11-21h2-x64
3template.html
windows11-21h2-x64
1uninst.exe
windows11-21h2-x64
4Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/02/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
2bsk.zip
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
2bsk/!!!Readme_first!!!!.txt
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
2bsk/Gold WareZ.nfo
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
2bsk/Readme.txt
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
2bsk/crack.rar
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
2bsk/groceryc.dll
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
2bsk/mobikin-heic-to-jpg-converter.exe
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
Resources/close-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
Resources/close-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
Resources/dialog/slide-down-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
Resources/dialog/slide-down-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
Resources/dialog/take-back-normal.png
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
Resources/dialog/take-back-pressed.png
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
Resources/loading.gif
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
Resources/preview-edit.png
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
Resources/register/buy-now.png
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
Resources/register/dropdown.png
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
Resources/register/dropup.png
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
Resources/register/edit.png
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
Resources/register/email.png
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
Resources/register/key.png
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
Resources/register/no.png
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
Resources/register/read-more.png
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
Resources/register/register.png
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
Resources/register/registered.png
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
Resources/register/tip-register.png
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
Resources/register/unregistered.png
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
Resources/register/yes.png
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
bubble.html
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
license.txt
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
template.html
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
uninst.exe
Resource
win11-20240221-en
General
-
Target
bubble.html
-
Size
6KB
-
MD5
b9a299e155b97e784b46b3e59a4c5639
-
SHA1
4d90ec6278eed8691663c25c2a20daac2615092d
-
SHA256
5ceceb15c6d81382f37c78b68f3ac800f66692c9060b4869bfdc9da1e5c09418
-
SHA512
e9de334dfd096a33f97480846c8d0aeee9ff50bb3be3c8260a29875bc31121208ec28ff97b5fb5ff8222ddcf76037ef812dfa5233faf6afb60e84f765adc7253
-
SSDEEP
48:uSUT6SLU44x1KARDcxLOLfLBP0SLU44uDKAalcxLOLfLqvUT6SLU44x1KARDcxLm:5UmOsbyOsC7vUmOsb5OsC0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4088 msedge.exe 4088 msedge.exe 1236 msedge.exe 1236 msedge.exe 2916 identity_helper.exe 2916 identity_helper.exe 1204 msedge.exe 1204 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe 1236 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 4972 1236 msedge.exe 77 PID 1236 wrote to memory of 4972 1236 msedge.exe 77 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 2972 1236 msedge.exe 78 PID 1236 wrote to memory of 4088 1236 msedge.exe 79 PID 1236 wrote to memory of 4088 1236 msedge.exe 79 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80 PID 1236 wrote to memory of 3860 1236 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bubble.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff885e03cb8,0x7ff885e03cc8,0x7ff885e03cd82⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10555026738005497363,1282817767567836454,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD596899614360333c9904499393c6e3d75
SHA1bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA256486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
SHA512974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7
-
Filesize
152B
MD519a8bcb40a17253313345edd2a0da1e7
SHA186fac74b5bbc59e910248caebd1176a48a46d72e
SHA256b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
SHA5129f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0
-
Filesize
5KB
MD588d5f5e94d2cbeff545e957a7f8129fa
SHA178a1f5b07dc3c0a83eb8419ba06ea16ad6f8b03a
SHA256631b7b2a6bb1acef6eac86aafbcc682c12a8f151f7aa06957c87ee073a42e71c
SHA5128a37fef62e61eef16aa3eb0ac88c0c9cca9be32ad0f0cb7f1a07250da6ffba841ef5ff3e17740a9f9b3db895a6a736fb47deee6d912e9723ed8631908ffb4cf5
-
Filesize
5KB
MD54c7cd790dbcaeed3d7e25cf106a7f102
SHA1b748a45cece2bf509398178344f624ccaa555d1f
SHA256acbd9692595af36fbd597eaebff7297daf77636d386370a3c1eaf7b08ec3e0c9
SHA5121138fb99dad4d2686bba986b7509d1a89653e3ae1f16b753b1e1af6a35fad5e5b1be6da09470bec78fb87dd779290abe28696a49ebd594adaf1c80f317bfd6d7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD502980b1339c817652143c369670ae958
SHA19bfe23517b6fe3fc169cfc2e94e24049e76d0746
SHA256729a388e915a40ff46eca09df8cb5d62146e644fbc924285276fd4947dd687cd
SHA512ae3da84c899a01cbb8c1e9feccea582cee0c4489ed88319c8bdd7fa3d6144c30e42837441301ad32c2b00545b517da31a8f7d3177dbd6617f125abad4a6e3542