Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2023 20:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fpjgroup-1319541735.cos.ap-mumbai.myqcloud.com/fpjgroup.html
Resource
win10v2004-20230703-en
General
-
Target
https://fpjgroup-1319541735.cos.ap-mumbai.myqcloud.com/fpjgroup.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3076 msedge.exe 3076 msedge.exe 4288 msedge.exe 4288 msedge.exe 552 identity_helper.exe 552 identity_helper.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe 4288 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4288 wrote to memory of 2840 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2840 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2460 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 3076 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 3076 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe PID 4288 wrote to memory of 2804 4288 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fpjgroup-1319541735.cos.ap-mumbai.myqcloud.com/fpjgroup.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa14c946f8,0x7ffa14c94708,0x7ffa14c947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,99833383002752094,9461035935572177254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58411007bafe7b1182af1ad3a1809b4f8
SHA14a78ee0762aadd53accae8bb211b8b18dc602070
SHA2561f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3
SHA512909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
240B
MD527ea1ceb3ed82b262fb14e107a2e5269
SHA1481f6be37e473d38790b38888089629b51610480
SHA256e5b579c005b5a81907ebd3850bfc09a56141f96e0047bfa7c0a40171ca3ff9e7
SHA5121610cfc315b4c0a8712a957e87e84ebb5f456c56c78dfd1fffd37f8c562a7418a916a691f807b62e8692d4c9a3cb0df5d9e858a41b9e3c116c2d0f515ff1c0b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
968B
MD59e7a5956e013779d888abd8da86f030b
SHA1b4d4aec11c51705bf8d8a66bc13033bdc8cea933
SHA2566b805a3cf5c230ced3b6a08f05084f7c21e91b17b99237821e3fe8bb98de5f0a
SHA51274121eb7997505fcd916ead169b3e31ce4f53b0d76be68816de052538fadbd92371d6114745b04f9766e598ab3b2381f061cfbc2110efb5239ca7164a1b2cfdf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e8087855afbd16e34352ac21bf919327
SHA1611c05bf4807d2b18bbc3cfdd4aad372e0634b24
SHA2566a1f2e3d7da41b30b8824c0ca6246584fd00ee556513110f68c237172d2ed2fd
SHA51274c461e4ade9afbf6abf117b8f541a5250cf61c17da8289f3190b194c74c2ccb7e5e28fb5dd1da476f2cbf5aa1239b7de59879d1ca745603381303d1b83dc93e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD54468d55c7dc3b88e4b0d58d29a9efb98
SHA1e194df4b8bbe0586f98430997cd2c7c29775546a
SHA256cf9ab1f694e136a2a58d789c3f3c711727ca82bb904b553c4db501ecbd8efd91
SHA51286c72b7ee3c32b91d95f9d9b7da40f2008e1d8f7ae9408d2d310156d5103219a3f156650ad9ebd9d42991c08b921e480f8e40bd706cdfd0cde1e88a004fe6b3f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD571c18efd1f1c7cb9f0cdac7e6a5ab856
SHA18e23b05c20817da6d166e55d49c4902fb567bbf8
SHA256af2bf6c5b5ad8225016f30cff6eeec085f2f83a749bd8a40bb27f99b7accf67e
SHA512d547cb52ec876eca1c64055ee3a98adf38f9ac81f90c4fee39ace3e8a94f4625a628bf27b9f7bcc18ee2e7fdd02a3f05461b9bf76f64976ac131cbe2c11a3eba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD58caf4d73cc5a7d5e3fb3f9f1a9d4a0cc
SHA183f8586805286b716c70ddd14a2b7ec6a4d9d0fe
SHA2560e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c
SHA512084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD510f1f10d3b106d348508c4dc1a8eb9ec
SHA1ea7bc554c86bd475596c93f8240d1a0d3fc34876
SHA25642b79fcf470db34341ed52f9b8929c9185fd5ea066de419a7838f02409324b56
SHA512c848b0a2de160db719061e16bc7781a7289f12742184abdcb3551155a5bc5be8c83997b4b1a272156280db668f46ea2b566cdbd68079e4394b1850e96fda0f0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5efe27f8dc310893826af10f560d9cb3e
SHA15c9c8463411ea6824ed46021b32555ea516da267
SHA256c76518f50452782348adb095ea99d4dd919cdef70050ec1d7992b7e59d26570d
SHA5124d655de1c88a65477002a6d2bafa058f56052ebc915c5613faf27df0a00b1aed84230e913929ddcce5f2376adc895106c1007ceebb240d79b5e6c0844ffbeb5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\pipe\LOCAL\crashpad_4288_FJAFTLYRWOMDJGJSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e