Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3E1cjZnQXBXR3ZteDJuc0pDbUFlWnhZX21xZ3xBQ3Jtc0trRkQyclh2Zm4zZW9xdUxkemVxTlp6X0FIazRIMVpoYVZwM3NiYlNjUWUtbVBIOUh0SUgzdnFSZ0llRzhjOEV2ZDV1VFFDbklna25Lc1lxdHpmb055XzlfMjZqMXZJYTMxaF8zVDVkcTlfdjhlNzhLRQ&q=https%3A%2F%2Fassettoland.wixsite.com%2Fassettoland%2Fcars&v=lB3Lc9pDW1g
Resource
win10v2004-20240508-en
General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3E1cjZnQXBXR3ZteDJuc0pDbUFlWnhZX21xZ3xBQ3Jtc0trRkQyclh2Zm4zZW9xdUxkemVxTlp6X0FIazRIMVpoYVZwM3NiYlNjUWUtbVBIOUh0SUgzdnFSZ0llRzhjOEV2ZDV1VFFDbklna25Lc1lxdHpmb055XzlfMjZqMXZJYTMxaF8zVDVkcTlfdjhlNzhLRQ&q=https%3A%2F%2Fassettoland.wixsite.com%2Fassettoland%2Fcars&v=lB3Lc9pDW1g
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 516 msedge.exe 516 msedge.exe 2088 msedge.exe 2088 msedge.exe 1940 identity_helper.exe 1940 identity_helper.exe 5292 msedge.exe 5292 msedge.exe 5292 msedge.exe 5292 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe 2088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2088 wrote to memory of 1928 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 1928 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 3624 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 516 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 516 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe PID 2088 wrote to memory of 2996 2088 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3E1cjZnQXBXR3ZteDJuc0pDbUFlWnhZX21xZ3xBQ3Jtc0trRkQyclh2Zm4zZW9xdUxkemVxTlp6X0FIazRIMVpoYVZwM3NiYlNjUWUtbVBIOUh0SUgzdnFSZ0llRzhjOEV2ZDV1VFFDbklna25Lc1lxdHpmb055XzlfMjZqMXZJYTMxaF8zVDVkcTlfdjhlNzhLRQ&q=https%3A%2F%2Fassettoland.wixsite.com%2Fassettoland%2Fcars&v=lB3Lc9pDW1g1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40aa46f8,0x7ffe40aa4708,0x7ffe40aa47182⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2548718258045834223,9098101846700323674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5292
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3180
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5838d85fbaa8419fc43c6ff23ebd95f09
SHA17d8358ca39c8f2eafeb8ad531b5c6c852029fbae
SHA25614e66859793e7173849ff4b8afff86e4e337f503578d86727269b1c90f181c22
SHA5129e74448d19d5547039aab22c64b2def92a04b817560363600254d8017c2c68e7d3b4f1dfdc18d9bfc7daab988d6d7f83853a0111eb989927791caf4f6d7d32bf
-
Filesize
1KB
MD5a5def3e374841728978fed765545a1e2
SHA16829008ad4d854c14631e1a3a2a35c6ec61db7a6
SHA256bd66a8dc2eff088b8f7cfac7d3c941694ad6d1514829989b9bc715c6723a9f41
SHA51264376bef3b115347c74184e9957950f2a30ad1c9861e8e8bbb59f743f740055617f2d946fe5ffc6445f768ccfecafaa93e2ee80b7badabfcb55f598e14735049
-
Filesize
5KB
MD598ace183f942b39c408e1ed03a7db9be
SHA1a9b7b0808e8b3b0ceaf5708624a9d7eeebb53958
SHA256663442b4ba1e0a77e8e3bfeed2a07c8ab97082a8ca28885a4bcc72486808f6c3
SHA512ba323906819f312d80e99a0948c7173a697941ce328077a925cb0e7c319a11c3a1d4a57ca0a1326baa095c25dbb3db6c113b01f966d27495eb529b48590cdcd7
-
Filesize
6KB
MD53cb20597350eb9aba683500cd496cd45
SHA19789cbb2fb62a6519201cb33e2685ffca7810783
SHA256292d795223c2b99f042af7d5be41828b6911fb6971552b18b2800e5272ba2f5b
SHA5125a49b04f027e402d775977fd27fa9ce1f8efb420cf4c93c0da2af9a15b71f247d7aff7d8b92714df5e35efcf1f41bd6aa5cd3455f2dd647829ec6edb7e08ee5e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59e4562d30fb3e6b44630cba8fdd38aca
SHA116604c85c348004acbc69c95486332e7456e30a2
SHA2569355cfd601d25ac4a345e04f98c4ba9653e538fbe22e7ceaaf1aab023e66c2a3
SHA51279e00948b3122f55bdd478ed1d43712528d44464b102d55284b9e1d8fe7829e3369107d7e7901d20780dfc03a047b7b9ea79d3e3754afb43e4003d51f39e7072
-
Filesize
11KB
MD5659844a33023e2298af76cc6cdeef0c0
SHA18c90e21d0b26d9f44f87091e56db58c77883b3b0
SHA2564b5a8c4fd0ec9fdb96b496f67ce3d977ac1b6533175d78d2bbe85c7d9c142e10
SHA51215f1b52392993dcfa37b551e2bcf7daa9e8c1c864270b6ad03be273c1080ae08fa2e3b5f0e434da2f7b3bc0ca047d8a4eb7873c00f41fdfe3b8285722fe79461
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e