Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 03:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1222016082525814784/1222017140157059162/main_1.rar?ex=6614af26&is=66023a26&hm=f9b3851814af86ad16884dce5bf89fcb66c88bda065b7566247aaa11a42dbac5&
Resource
win10v2004-20240226-en
General
-
Target
https://cdn.discordapp.com/attachments/1222016082525814784/1222017140157059162/main_1.rar?ex=6614af26&is=66023a26&hm=f9b3851814af86ad16884dce5bf89fcb66c88bda065b7566247aaa11a42dbac5&
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4040 msedge.exe 4040 msedge.exe 2984 msedge.exe 2984 msedge.exe 2416 identity_helper.exe 2416 identity_helper.exe 3644 msedge.exe 3644 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe 2120 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 5456 7zG.exe Token: 35 5456 7zG.exe Token: SeSecurityPrivilege 5456 7zG.exe Token: SeSecurityPrivilege 5456 7zG.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 5456 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe 2984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2920 2984 msedge.exe 87 PID 2984 wrote to memory of 2920 2984 msedge.exe 87 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 316 2984 msedge.exe 88 PID 2984 wrote to memory of 4040 2984 msedge.exe 89 PID 2984 wrote to memory of 4040 2984 msedge.exe 89 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90 PID 2984 wrote to memory of 1352 2984 msedge.exe 90
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1222016082525814784/1222017140157059162/main_1.rar?ex=6614af26&is=66023a26&hm=f9b3851814af86ad16884dce5bf89fcb66c88bda065b7566247aaa11a42dbac5&1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c04c46f8,0x7ff9c04c4708,0x7ff9c04c47182⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:5280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:5288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9003035050249655003,2552960722497903272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2696
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4856
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap5807:74:7zEvent279841⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5456
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\main (1)\Weights.txt1⤵PID:5920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73f23434-221b-4154-a539-30c200675495.tmp
Filesize6KB
MD5bfef1015a10f73421e099a04d478ec40
SHA1705b521e729138348e5b9e88782ca57151bc0893
SHA256cbc6e0905aa932562c602b54b7fd81cb209a6558d5ae2dcf22a52a60c1c2fd48
SHA51258847d76480c9efcfe9092b88745e30781a8e57927123b7f4977688d1f5f408beab6b16c73e9f112451b1e1b30fd469bafb276d8aaa954cd8fe7bdfcec121783
-
Filesize
186B
MD5094ab275342c45551894b7940ae9ad0d
SHA12e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA256ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
SHA51219d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
-
Filesize
6KB
MD5720a18e776b9f29fa7e376e8b97eb62f
SHA1aa8accef0f106fd0e58f638c267a452dbc486495
SHA25622f4ea6df7eda1e51b69e18ad6b0c0b5971f89a770e62655cbc0ca4fad88f0a3
SHA512fe6bcf0dfa97594dd0bea753b25c35969710aa79987fda02592a2773a1839e837f136e446780de7fc43223574fdbbdbcdb5a95f1da997efc7043dc255864cbb2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a08aa48dc31789df122d18e59741354d
SHA1ce874563ee0419a0c88ec80b0cec81189e8ab948
SHA2565e9c1b0c6b25f6bd07fe6cf70f5889304ea39d8d20a636be3c8b0bca3c9641f4
SHA512a6ed3934473db3ad7d61bdede9e95c6ac2dd913a4c9f64662942d45d76eb098ba0385495ae662b0f2e6994ce7ffdb603f77767985242dd28d5ef0c6a4a05d7b4
-
Filesize
46.5MB
MD5dfd6c458a3114231ac833a26545e7d60
SHA15cb1970f57652cdfce10d4f061a5b566d67797fb
SHA256e0a66e9c759c2eeb76944e435f32071bbd4e7cb5435688a4463a0455b6f78f29
SHA51266b78e0509538c29f1905018c76095851f092c64b826f60121434f2990d07d87019369f95b150a7919dbd12762db6b900ec1d54824e7ce4b0b8a66e6f4e6a084
-
Filesize
35KB
MD5cbe59e5d961ef00df4bdcfd677d80b22
SHA1c87164c2cdd382d979adf79545745b099622bbc0
SHA2565d9596f805f1ddf42512d7611f03d979f04dc8f11043758aff4e4c90217931ec
SHA512cae49e4ae6839134731f41451db5c59505540a4ae8c45a17ee87888badb52b70f012417316d866633d9d2c6ce9e6b73798b2d925bddb770d8bd45bfdfd2b7a1b