Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 08:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gabah.cloud/h8q9
Resource
win10v2004-20240426-en
General
-
Target
https://gabah.cloud/h8q9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588514086183734" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 4168 chrome.exe 4168 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 4168 wrote to memory of 3144 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 3144 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2588 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 4320 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 4320 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe PID 4168 wrote to memory of 2476 4168 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gabah.cloud/h8q91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8353ab58,0x7ffc8353ab68,0x7ffc8353ab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3200 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4472 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1636 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2280 --field-trial-handle=1888,i,14736335528158872553,16262336759290819487,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
456B
MD526168ceb0675fc27987fd374d75c094c
SHA100693074bc521f8df64e612276b64e3492cc4e98
SHA25615caad72bc02bb426731c7d54677efb5f3a016cb7017a9a5211ad0c7fb54b629
SHA512fe04bc7998285e541f916d91a82e599e6b90d8c13b25285ead7d6bc0c25b1b69c673d1ff1384a0a7fb2724e967f004e04137025b52109ed1357c6f2b70c9ac71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
432B
MD55773af49cf45eb6ec835ae3712e303fd
SHA1efd67ea1227800350a9615f960602ff8b8f7f6bb
SHA256168d1822ef9252a6dcf67e227306c153b5a4f80d07b5847f4091a0c1a130b349
SHA5122933c32909f9c553595c8ea7ee88fefe1fae3ec4b79721378f406a35a273d6c74d6b31565ff0cbccda052a0ca542b46a84f241e21cc61e9f949bdbcae6a6ad33
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD57de0d83ef09094839a846696f11b9ba9
SHA1ba9b0c9c7e80caf1ef2a526e2bb5f9321114b822
SHA2567ae1a3aa84a9ff0ac016839d7fad3ba63d0b37cf5fab3a9aeb4d9b2184345eb1
SHA5120676615fb15160171064a9059a0f3aa5156430b8d0fc213b53d17c83ead22b87bb2f7f873ac0b6117315d58baefaae7adc1d4f2676640d16e72e8c53e8b02bee
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
860B
MD5346a6063f327eb897859de4d9dcc56f2
SHA1c7b9959c49b26c62713848410983952d49811356
SHA256c543dd8631716eaf6fa614845257b98ecb9f7ccd09d2d3aaeb55cbe95320100f
SHA512d62ef17e9258a3006b4a59f3c3926add31a54d9df4dfecf94edae1652833704f762ed433ae8ad3f4be2ffbcfc09f4af30b337330def8f46c403c1a51391b043a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
860B
MD51fe7a79a990ea111355de037a71c7f93
SHA1590d5aa33e41b07e20a1e84812b687252c5bf5d9
SHA256650d1b94312fcde8a3b568315ddabd4534fc0e0b20dd7e9e9243313bc2aad85d
SHA5124166e164fb3e63f898a9e752c21720914706a17f399ffec9f27f342a1232ae767a9a78b58eb36d894913bd2324e3ddc2947da831424d1262815d5a075fcf9b93
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD59d1bf8bb2fd7a8084c0dc1b86a3a065e
SHA12d919e5d93bdd2a67cdf9649415c82e83a83c2a2
SHA2569931c455b6a6ba40bc352a6c2bd4047a5c4d420b8ecf2260710e951fbd6ab763
SHA5127b28b924d8dd18b36490ccedf230535c1c554029daf7a4677fa668501f1017d076fbba67f1b0ccc31cf9a501bc6bde34f745d412b0b6ce795a0708edae761f45
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
10KB
MD5c205cff83b931557b2878eb1c03d8472
SHA135ad00f645cbb571d113a0a7a295361e10f8f0c0
SHA256b656b43039a91069d5484c6bb9d37b9f8d32586a7611b178fdecdc482bdbfe4b
SHA5124c3af95377b25bc142f3709bf88e9f3eab7b516025e5a05ed4ec833a57e84ca2c486d9695567655c04f3cb6dfde8129ed16a3681ffd2e66b0204af7a7993a81e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD51d031c3d68605ea3674de4565575d46c
SHA1fc9631cfc581c28b9e42f707ef96edb4125f9842
SHA256dbd089490768cae8a99edd2edb719e88c039ada97b1dfa9e36bdaba710ee63b3
SHA512898cb0f2b7c2c833ef0a77f699523a0aae1acb4411e65a75c01d4a611a5d167596196f68066cc1cd81160f5b6b4124f05b2efa727e194481560288be068b643b
-
\??\pipe\crashpad_4168_CGQSNFIWEJTYOHFBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e