Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 14:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/P7Jgb
Resource
win10v2004-20240221-en
General
-
Target
https://go-link.ru/P7Jgb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2232 msedge.exe 2232 msedge.exe 5116 msedge.exe 5116 msedge.exe 1132 identity_helper.exe 1132 identity_helper.exe 4132 msedge.exe 4132 msedge.exe 4132 msedge.exe 4132 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5116 wrote to memory of 3592 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 3592 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 1472 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 2232 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 2232 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe PID 5116 wrote to memory of 4508 5116 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/P7Jgb1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff924146f8,0x7fff92414708,0x7fff924147182⤵PID:3592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:4508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:2064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵PID:2336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:768
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:2184
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:12⤵PID:2828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:1700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,15346913870521828106,2827347500641858082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d62cefeb0c8fbab806b3b96c7b215c16
SHA1dc36684019f7ac8a632f5401cc3bedd482526ed7
SHA256752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01
SHA5129fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57ee1c6757da82ca0a9ae699227f619bc
SHA172dcf8262c6400dcbb5228afcb36795ae1b8001f
SHA25662320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31
SHA512dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD54ac074d7d3031ca6c1ae07efe98477db
SHA16c27dabe65ec105c666e3ac61dcface98237942b
SHA2568bc81b208cb3f778d4dc95bbd7b5c41c37865ccd2a3c6c8be856839fec83d2f9
SHA512c4f3be5a65dc5b0735ebc1d87384ec8e522d710a90c6c80654f90b339543771c85f545d008e98d0413847ae84fcc8cad21356e06f299372ba20ba2b860650374
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD5b2a5584a6bcff6679665d5075395cf7b
SHA17cc6a3cc55d0df2fe1bd6de732fc342b618b69fd
SHA25627c2feb6c40c8fddf6ab025e52b6538062b155f4d518105ea092e639a9db1b10
SHA51254e6b9a1d340a625c1c6bbe435ec1cd309a969f2d4a72eda2e20825267132f125899e1071f744b7dbfc7cfb150fa7fd32c3b2c476f0b5b47bc89da51657db27d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
789B
MD5265b873652a7c635572615f394e02213
SHA1f385a35b20b4e4245c0572a91713e10d37187675
SHA25672ae39c0132a9c0c80d245a95f90d005e12c2b9a98dac89b1bac2aaa11303c58
SHA512f334d28c63b1bb0733d512c60c3d99656b866e5e6c683150f5a477b434b7ef85195cd86d0cfe8e7a8aa08f4365f5ffd6e2d0dc33dbe8571f8310de520d8eac56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD559730f3f279539627a94fd7cd7be69e1
SHA19f90d8879b6f643efc31dbd2eba62d0e68864509
SHA256e6688cbe9505e0d576464e4eeb2a79155b903c4e7809d8d03375f9ce90e443eb
SHA512669b02b7d7e44feb8fd19cb394e7082f700c4fbd1dec3f6824b15fd7b29ca8dd7f13f3586417dc6017b5a5a79d2fc0ba775b7db8af89624465011d0029bde579
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56221fc006a6a05e5c38be4374bf4beac
SHA1e1dca6710c8eaebf2f221adba1f30d3e1e732840
SHA256266ce071dbb6d933d5ba754899b593c32440af3bb8ddc8f84191697e848a8bed
SHA5127ceaa09a7feab916d4cd1a20193ac3be829e13a9a24f0e563ae12b17259da0d86fe7bcf4c0bb876574b9c6ebd758fb504e5d3f46474ec9aab680d95939a36114
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53c2910ea9781240b1ac3b2c5953dd29e
SHA1d52cd3e10195810e169a97919d7a350bbfa3b4bf
SHA256fcd56dbb108bf603857d3bfc9b8fe4fa4732fd602dba458c54457402b11c180c
SHA51273f366067ed21d1f1098b5dfa3bae7019a829cbd93107a53b9d170592df25968aa8ba6330332a7847f6b581362078e73623122299175c9ba5d786f588a269281
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54f5d736e3e41b532b9b99d8a7465fbdc
SHA119c0b020586b5d2fa6c4142ebad9f5be859c9962
SHA25679752eb64ab4545a6c558a32738b254209d321f4c4241f07bdbb53ac11c6b6f1
SHA512a5ada14193991a29c6551eb25cf51879f668a0ac4e57d67018f61d844aa0b95d4e52e3c1b1e010a37eeb7ad99dfa7266e0ea789688bc24e58beaafd2498faf50
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5dbf33d493ced0a5acb905826430c9773
SHA15fd14e358a2d4bd56f44541ed700021bd5bf2fe2
SHA25650da133329d699fb2c576d528678f9b420e615303eea17aeb51eebd1f4845a72
SHA5126936b658f29f8281968afaaaeb8074adaf38a4c4d85318556b6a84812b5e2609f6800ce6b6cb8d218e8fd0b5c0f5324fe705ca5a1ad972b8141811da65cb9190
-
\??\pipe\LOCAL\crashpad_5116_ASQBRTVSYKCDGCYBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e