Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 20:53
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20241010-en
windows7-x64
9 signatures
900 seconds
General
-
Target
sample.html
-
Size
54KB
-
MD5
2e9a1ce275ece7eb7d1c83cf238d498c
-
SHA1
3f2461f8b3232470cb7c8b8b8d5ca175d387b9a1
-
SHA256
fc4e3a03bb5fcd265ebbc4ccfa5679fc11c0fe7924fa96cf5223893814209c55
-
SHA512
d760380381fceec52c9c5589700bff8f11a769133a45712797a7767b25438ae57b9b24838ae958f06cc4e7311a67405e25b09743f3fe0d8e3723b468867041b8
-
SSDEEP
1536:NSFzX6aponJVi0rqs5cgVJCIxXuBFA859F9DvZ7hbqA6v/GmEKOMB/MXiglZwegO:NSFz9iJVi0rqs5cgVJCIxXuBFA859LF3
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language csrss.exe -
Enumerates system info in registry 2 TTPs 35 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2864 chrome.exe 2864 chrome.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2864 chrome.exe Token: SeShutdownPrivilege 2832 LogonUI.exe Token: SeShutdownPrivilege 2832 LogonUI.exe Token: SeSecurityPrivilege 2672 winlogon.exe Token: SeBackupPrivilege 2672 winlogon.exe Token: SeSecurityPrivilege 2672 winlogon.exe Token: SeTcbPrivilege 2672 winlogon.exe Token: SeShutdownPrivilege 2832 LogonUI.exe Token: SeSecurityPrivilege 2672 winlogon.exe Token: SeBackupPrivilege 2672 winlogon.exe Token: SeSecurityPrivilege 2672 winlogon.exe Token: SeShutdownPrivilege 2832 LogonUI.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe 2864 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2880 2864 chrome.exe 31 PID 2864 wrote to memory of 2880 2864 chrome.exe 31 PID 2864 wrote to memory of 2880 2864 chrome.exe 31 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2612 2864 chrome.exe 33 PID 2864 wrote to memory of 2724 2864 chrome.exe 34 PID 2864 wrote to memory of 2724 2864 chrome.exe 34 PID 2864 wrote to memory of 2724 2864 chrome.exe 34 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35 PID 2864 wrote to memory of 2652 2864 chrome.exe 35
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7bf9758,0x7fef7bf9768,0x7fef7bf97782⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:22⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:82⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:82⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:12⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=992 --field-trial-handle=1280,i,17472445639692488276,3049913030374424134,131072 /prefetch:22⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2244
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2008
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:1672
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
177KB
MD560c8c622a6a027b65f1cdfdd366ef638
SHA1802f77bda8f10cf820d4258864263beb4ada1b14
SHA25643c15568efaffd097c5ebf99cc5c514c3dc6435bb36c2d4d795f56823d4e1563
SHA5128e2002074b9b60014a74f36dc3d943d3a0b4cbcb7438b396d01bd7402ba4322de5771990dbc7e76625479251a26c1647d3257b348b4bb29ad01b8601811ddc75
-
Filesize
178KB
MD5cbb96ea5a5f539a66924a8c699ad9ddb
SHA167101833a59a5d67207fc28eef164dab72ae8608
SHA256ae1df8558bcbf88d927631fad090d34c1437d94246c0d5a6a21c8d8792831166
SHA512b2391ffa6e3d96ec1fd4e51853f789efaa4ce33ce934736156afbea272d3156c57470f13f504abaf2a7ecc4ff67eef114d094f1b10a568210e08ea64644f9b76