Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-03-2024 12:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://se.boberaceb.ink/itodkebhyit/&umid=94C91EFA-11D8-2606-9F65-45A2B7AA1753&auth=8f3b079e48d090dabfdbad44b8980c97bb425824-24f4212f026ecf27c2a7c063629c8dd5aab616a2
Resource
win10v2004-20240226-en
General
-
Target
https://se.boberaceb.ink/itodkebhyit/&umid=94C91EFA-11D8-2606-9F65-45A2B7AA1753&auth=8f3b079e48d090dabfdbad44b8980c97bb425824-24f4212f026ecf27c2a7c063629c8dd5aab616a2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2732 msedge.exe 2732 msedge.exe 1208 msedge.exe 1208 msedge.exe 972 identity_helper.exe 972 identity_helper.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe 1208 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1208 wrote to memory of 1056 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1056 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 4444 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 2732 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 2732 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe PID 1208 wrote to memory of 1896 1208 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://se.boberaceb.ink/itodkebhyit/&umid=94C91EFA-11D8-2606-9F65-45A2B7AA1753&auth=8f3b079e48d090dabfdbad44b8980c97bb425824-24f4212f026ecf27c2a7c063629c8dd5aab616a21⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff608d46f8,0x7fff608d4708,0x7fff608d47182⤵PID:1056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:4444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:1896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:4448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵PID:5088
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2088
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:1748
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:1076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:12⤵PID:1488
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:4920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,16023756664295850899,830786427108473201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3832 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4624
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD535f1f8d6a7dc9839c408bc619f68c683
SHA187d81b1ccaa9ce6f38c76149b8ab1092404ce09f
SHA256706dae5b259b99a5128c40591a2bf9f4c9f28d96907a3208157437c6b1a1cc5f
SHA512721259ceec6e4a54bacd4338bdd31eafcb45421da06b8410c50f63e7217413f534d4721cb34400b8bfccc6ea3009b97e5e9b082f8e76a93301e123fdd5a9c56d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
579B
MD50a5eeddbcdd6495208e24559c9f0d23f
SHA1184e83ad58c11bb6fbadae6a17441a114f976cce
SHA256bee3c8a8b7092f979f5a7fd56ec870795983a6d7c62306b3eaadf4f4936d86ad
SHA5123c8a1402fbdac0d29a1ffc2860d41c683091e9051fe12fd69fc22299ff88352cb4a6c27f0b9cbb5914cf91dd78a90fbad17ec5573572fc8ec58518837f623330
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f47e02c2f60fe89d1af329517ba0a373
SHA1ebd62798a0496ce7329fdbc4dafab8c3743e0439
SHA25625553f5c374574c2f5702082fba0ba1848cd1fdfaf4cdcd6ab050d91373f8735
SHA5123a17b041ecae08f103ad0896822196dc33c25492eef63170292f57cec8343ec3af469f5018a899c5f633be1591c10de3bb58f350204db67a053ceb383a71b873
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e383026e087f6e837ae045bd988e3958
SHA1de75d9697005fa68f779e55eae745af227d574de
SHA2564192610124b616ef3ced8c3c1996d03b6d02b1e48224ca4cba7ec1d61f8c77de
SHA512356cfd7a40c77a5073af2460537a3092540c5237a4f98e6ec6a3550b4c39ed037582ea3be738f759c8680eeff10742f2074da192b7a89bbee452108cfbf02fb5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5ab8a0d409d1527853f561f62d3cc76b8
SHA1ccc9b7168ddee2411bcbe07ccb620ce09fb7ddb0
SHA256fa8c04d5902f1721eb7a4106af8074e4dea7d73bb55e8ee3cba95042f36c4f0f
SHA51287a6f64b2caeb372204eb38677ed29c4f00ed4673c42a19c0f4951d832d013e93e1968f7bf09b11db780d23dfde6152ea30100d1edaf173f4302c742386b1176
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5ebda849af541ece2e2d4002cfb7c2de7
SHA1e3b738a3ae3bb99f854888ea80b419dc0136bd50
SHA25693411fe601b3331a762b23a5b07d169f329b37befefe57b9bc5cc17265c3b2dd
SHA5123edafac5604e6ffd1da33bec70a6bda75bb84a958b32040bbae2e38465f06b976ca08c854d1e80bbc2cfac33d5e45eec0df276f7ca470bae1b56b9be5ad78181
-
\??\pipe\LOCAL\crashpad_1208_AHEFHQHMAVMIRPEWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e