Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
eb3f6f89ed0724718cf1ae579222819b_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb3f6f89ed0724718cf1ae579222819b_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
eb3f6f89ed0724718cf1ae579222819b_JaffaCakes118.html
-
Size
895B
-
MD5
eb3f6f89ed0724718cf1ae579222819b
-
SHA1
de93d1271f3d09188833efd60b36b92b93c56171
-
SHA256
84b70dde9ebd6e7420cc9599ab9e2b789e69425bc77f69e80a5a5d68e75ed86b
-
SHA512
5c4d77b48c14a6733657af09facdba8fc88de1454de29923f1b8dd0d11bb720cd5f5c885c7fe77380db9a60c269b8117f64f4e8224e2796c105752ad7cc3edc2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4960 msedge.exe 4960 msedge.exe 3216 msedge.exe 3216 msedge.exe 1304 identity_helper.exe 1304 identity_helper.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe 2696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe 3216 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 1072 3216 msedge.exe 84 PID 3216 wrote to memory of 1072 3216 msedge.exe 84 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 1880 3216 msedge.exe 85 PID 3216 wrote to memory of 4960 3216 msedge.exe 86 PID 3216 wrote to memory of 4960 3216 msedge.exe 86 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87 PID 3216 wrote to memory of 4840 3216 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eb3f6f89ed0724718cf1ae579222819b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff632046f8,0x7fff63204708,0x7fff632047182⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:82⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:12⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8848591298417302356,13464170415523931387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3688
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
Filesize
360B
MD56e1943f5a783b2412c667b828592af5c
SHA1983becf61c44577a68cbc6f75993f411a46884d7
SHA256934af73b3ef7ca400e625fbd37cdbe89439c25a5fd7349c206a82b99f3d61969
SHA512e397286603cce28ee158163246d9a788ba47c4fe340e5825f9b4b0fd7154f77663f6235bbe5e8adf18a4e1a576260186b4e29b4223c6a7f82e801fbc74351175
-
Filesize
6KB
MD5796f4e445ed6da68da47a7938655a707
SHA1936e73612e59f97bc2b4ed51fde1bbf1918fa870
SHA2569e9fb9e4b6c26d5156d7fd1d453855aad559af214098581f773d74f9a136c4f8
SHA51296b0d33ba38f1d1d8bbce083f70e3ed3eacaa34bdc59d0cf2c71a815697bfa2a1c22559647bc69a7b99513d3ce6a9d859e038b25170528073350ca1ef293b6b3
-
Filesize
7KB
MD55d7a3acce11314043fd7ed2b01abad53
SHA156001bbb6cc7e1b8848a83c5961d44b59003b3db
SHA25668e9a4f334b99331621b2c5cd81bb0d3a580bb0a4214a9a23d1551987864447c
SHA51232278dfbd11ab24b1e6f7813fab111997297d952be9b2aa841bf5711dd0b74767093eb202e2a3ef5eb74ff492978c425daa2543c146bb147c024f25ef191e9f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD558588227f1913fef2e8fc7db504c5cdb
SHA17ec255ae5b3628d670e61007d0d9ec750b332b3b
SHA256167d8dfcd85f9f9d37784bba6e73a43e3698c6c2257daa2ed27e7213e1b65ca7
SHA5125897c2afcf2f2ed8ffed18495cb372b059f16c6c51ace875c84d307b97bef08123080d46a15bd801ed996c116b1fa2b466e011e177f1f49a7959c6014fe972a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a400.TMP
Filesize48B
MD5f49c928b33db403fdfdb29aaa5e416bc
SHA1978982e77f7b2f294aedaee11ce7f75822ea1e46
SHA25617719443b55c927e2d3300753b15c424f36de3e378958ecc6238a81a890cd358
SHA512e3e5b3980c644a841e34a8833a07f8c52bff4375700f051752cb7c17c0621996234410a51139cae57b179e9a7739aa4e92a0102ce8987c5748cfebc8d10d1c6c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD525e9d39805bd7112e04a17b116c809e0
SHA1b457f197d44f31605a8f914067b6f36e8a37f185
SHA256c6e19263a48c7eaa65058d41c74bcb43389fd77f672af43e414ecc0c85305d62
SHA5125da1ee8eeea96d5264f3ad75b630806a78805e36777705af0909f021786dae76809cbeb5e6ac2cf364a3336a3a3a93d65638876e5fb084c1a7d188e02c86d877
-
Filesize
11KB
MD5e563b91c0381c98ccce7a29c3bdd988f
SHA16e289ede06c39719e794d94f5301b22c764e8258
SHA25655dabe2aa8143aac938ce3e0f2b019ec625d556b0830db164d8e6cee1f45d2d9
SHA5124951ff87fb4d1abfbad99ede3e722cf95335a3b921f7999959e4ef477f4c94ca3c55ae010cccac0ab5aacff03d85e00fd039f4f28df28517a5e471ba1fc63bea