Analysis
-
max time kernel
35s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 09:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qptr.ru/In7t
Resource
win10v2004-20240419-en
General
-
Target
https://qptr.ru/In7t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133586833009401231" chrome.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1256 notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 1188 chrome.exe 1188 chrome.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid 4 4 4 4 4 660 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
chrome.exepid process 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe Token: SeShutdownPrivilege 1188 chrome.exe Token: SeCreatePagefilePrivilege 1188 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exenotepad.exepid process 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1256 notepad.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe 1188 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1188 wrote to memory of 2916 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2916 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 3112 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2192 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2192 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe PID 1188 wrote to memory of 2156 1188 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qptr.ru/In7t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe4e91cc40,0x7ffe4e91cc4c,0x7ffe4e91cc582⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1860 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2148 /prefetch:32⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2428 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3180 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4508,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4720 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4368,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3660,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5016 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3364,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4720 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5040,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4624,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4900 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4996,i,10680398430622679974,17559846934042730971,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4864 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\WaitOptimize.ps1"1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD5a64ec0cf759d6c8a005c13effbaa5d50
SHA1dbf6c9572bd9d6f6d475b6f83d3bd8f557bba018
SHA256f1739c195acade772d5deaca58c3448f37190c706d869f25e572eed50821cdc9
SHA512d2e5a4c4d27b0f4c293a079a636594a4ca68a5838f0d94bf0fcd2bd04f0bd884b78622bf2aafe42391081cbe34a0762a6fc5e7331351b1bc382eb1e5d5e5ce7b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5582b9e111eb74c630fa8fcf8359a3ecf
SHA1aa86ae11ec44564a6059af69b760362c3c151151
SHA256a03f0fc2740ee9583bc1186605ccff2194570a470e9ce3f71039e55939d5908d
SHA51241986ee2dc5112aa7c0ca600ef97847ca1b59b5a644799c5f128fa31525e8db232a4c2f6ed00f74dd83b1ed9b6af340e6c4dd854ac5627c03272918d08c07d94
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD5cbbf9ab003549218938abb4dbb95693d
SHA1a7a32ab59768fcd05e235801731f10a77cbbd5ea
SHA2565acf08dcc611a0af20c9d33603ad20ca0cf67b6840449b1d2be22f763c53ef7b
SHA512548b5cb6222b67e1d7641618ffa0cd1c36b79ecd517d504fa0d188fc5e8190d74276e21441f452a34b81815bcdb6a4d09bce2d26610708b8a9ce797420433ea5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD54eb35798a2ea1b50f154f3ab594af8ef
SHA1080ae01fefd40e49e6d01564ccfba107e36e31d5
SHA25674d0ad1be9a3f11ad0800e6df243e6443a06389d694d030caa5e6af34f8dec0a
SHA5122e6c688a702386b42436f4a93657ff0f8af2f6904d1dcbd20e2688427a8952ed461ee2d99770df9bfef3de11f46b0e7111a3e4bfa2f5bf608adcb91a93899477
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD57682dd7b6c4aa4d3d914c2cc401837fd
SHA181644d4349590129f63bfb94bab9fb46149a7950
SHA2562f3795233934e7880930fef064e9da7a901d0752d2bff42aeca81eb53904cff3
SHA512d8350d2a1ebc4a20a20128fe609f724fd9a77d33975854ca9143f90e876a5bc938902a186f6d37728a8d7caf14b3991801707ba6c751fe50ca5e665e451d6aa6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
77KB
MD51695b4e1e723d50f1c8770585e72554d
SHA1fbc8807c8f47a10f706daa68fa2651d39616f1f7
SHA256ba24cec78e224b0a52213e223538fc55e0f6b84c4ca0f0bbbc250f683260e096
SHA5128bd337e153ca627d079e1439073aebaaf986e25cde2a4faacbe3354b104ab91bfa125383cd2a9f3a7466f5108ecece64a75d58f03d9c5f8d9034f07b6d6d5f4d
-
\??\pipe\crashpad_1188_JBUGCUBCWZBFNNFGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e