Analysis
-
max time kernel
63s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2024 17:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html#4VIWmJ47388CoAY271dqjlpdzuyh1465RHGLQRSDTSLTNWY200617/7898N18
Resource
win10v2004-20231215-en
General
-
Target
https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html#4VIWmJ47388CoAY271dqjlpdzuyh1465RHGLQRSDTSLTNWY200617/7898N18
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4752 msedge.exe 4752 msedge.exe 2176 msedge.exe 2176 msedge.exe 1164 identity_helper.exe 1164 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
msedge.exepid process 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe 2176 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2176 wrote to memory of 924 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 924 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4508 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4752 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 4752 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe PID 2176 wrote to memory of 1944 2176 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://storage.googleapis.com/qd6s45d6sd456q/kdsjhfdsjkhfdskjhfdsjkf.html#4VIWmJ47388CoAY271dqjlpdzuyh1465RHGLQRSDTSLTNWY200617/7898N181⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc82e846f8,0x7ffc82e84708,0x7ffc82e847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10152539143267331547,11013256387119222062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD584381d71cf667d9a138ea03b3283aea5
SHA133dfc8a32806beaaafaec25850b217c856ce6c7b
SHA25632dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
SHA512469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e8891cf5ce5f914c5c4039308dc28543
SHA110a71ca27bb8996497a65d7e1246c39b42a255a1
SHA256bdbdd72de5db2d437b68c0a70a1db8348f306bdd358da9fc5338ca80ff6369f8
SHA5126321fd9aa0faf151671dd241c0369f94af2765e0f61d8e259f7c05c40ca4d05a38071f4bac0778cb1a2d3d4aad911ef5f76622a05828baa9497acbe635bba9c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56bdae4b080507c73e492eb674f385940
SHA1a98095cd7235ae48e4bc9efe43fec179956fc3e2
SHA2566778de2a676b405f43a5c255719c2def076070444a2118d8366502ee082acbeb
SHA512ff202d42423d7ac777eb57b44ec812deba0db5b592ce111ae3e21662d71dd9520d1d28242352918c8b11ec50927a4550ea1cf1ec79f56c52d9afcdece2f8cbd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD535f77ec6332f541cd8469e0d77af0959
SHA1abaec73284cee460025c6fcbe3b4d9b6c00f628c
SHA256f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7
SHA512e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD50ea28029627cdba423f025e9e90517cb
SHA1dc902b6eab1c8d1081204bb0caa18d63549a82ac
SHA256be5e12d3490acbf80c977aa8e9830b8f56bb701baa16a65a2661105dc8a11f43
SHA512d31c518caf134e29ee231ebfc0583bd98917bcc77a2981e09cb61e57b18b1fe3622efa00dc10b930c07cf0232fb763edb845cb9a757ac6456f671adda46c7310
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84