Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
ec9097174d35d9fa629c34da502aa991_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ec9097174d35d9fa629c34da502aa991_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
ec9097174d35d9fa629c34da502aa991_JaffaCakes118.html
-
Size
432B
-
MD5
ec9097174d35d9fa629c34da502aa991
-
SHA1
e519b6116bb8e3d8c29da63038a3c675dd5a4522
-
SHA256
b98174cf2483ff53b97ea8ea39f010b44f85348ea8f3fd3296e21804e9372042
-
SHA512
f38685897cbb8ea617c02fe466ac4857fab2523cc0386d7b5b8cae6bbdc7821559e8b9f80be22cf79487a51b677b0557460134d0d12c945107ef164d4aa31155
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2892 msedge.exe 2892 msedge.exe 2976 msedge.exe 2976 msedge.exe 3572 identity_helper.exe 3572 identity_helper.exe 3148 msedge.exe 3148 msedge.exe 3148 msedge.exe 3148 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe 2976 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 5076 2976 msedge.exe 84 PID 2976 wrote to memory of 5076 2976 msedge.exe 84 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2996 2976 msedge.exe 85 PID 2976 wrote to memory of 2892 2976 msedge.exe 86 PID 2976 wrote to memory of 2892 2976 msedge.exe 86 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87 PID 2976 wrote to memory of 4912 2976 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ec9097174d35d9fa629c34da502aa991_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf56246f8,0x7ffdf5624708,0x7ffdf56247182⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14824702277045517638,967742018182786486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1480
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
360B
MD56e1943f5a783b2412c667b828592af5c
SHA1983becf61c44577a68cbc6f75993f411a46884d7
SHA256934af73b3ef7ca400e625fbd37cdbe89439c25a5fd7349c206a82b99f3d61969
SHA512e397286603cce28ee158163246d9a788ba47c4fe340e5825f9b4b0fd7154f77663f6235bbe5e8adf18a4e1a576260186b4e29b4223c6a7f82e801fbc74351175
-
Filesize
6KB
MD5d5168e2abe8fec05ffa612e174c0c9e2
SHA19737b0506d81952c1a149fb52624be01038eef97
SHA256466978c1059c1bf5bf2ab12c5eb5cdd73e6b2b4b3b100e2e88b6deba40680b2b
SHA5124d7115baea4d57854f732b01b0994acfa1a30ec1d51a11aa6930c641396a70be961c073c7292488c887199cf28c640ba7291e1fa8fa9b66c29894c3e32555362
-
Filesize
7KB
MD5406ff135418e891cab5291dba6c8fb73
SHA1e86549b11e68e70df77cd21642acc372c09bb803
SHA2560c00c1c5622fc9a3e7844c8ef391a5a6ea8fd9089d1158801680a20ad8d9784d
SHA512f3a1ae70886b5e1d5f040fbb7215bb5e29a18c04617f1e6177bc46fad9066bd3d0a2aabe6eef93bdd4163c0a9da17f0abb944490a5a5b776a886cdfcebd7e475
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5f5c7d9208a4c64b56d0df984da50c236
SHA1a6006e9e397a41532ded9d7af197b1d8c321282d
SHA256466f76df38698d683295df6a5be3cea2e1994a4a93cb18e6ab50f178e3f636b7
SHA51248b78237b38d5d6966b0cc7baa5917f5c381e4743499a59ff61a20ae487fc5033bb75d51b32ba33653b69a84e0d0cda756f6b96a9f07c228e81b37ad333ef733
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bc99.TMP
Filesize48B
MD509bd484add6b19e327ef60004bff608d
SHA1b46979f79e3e4ade289a56a240beddef708bfa1c
SHA256f97f6af09cacdf136ccbe8afe56e26449d8521c08bc788f19041f98a66d9405c
SHA512afe4a5c5d23dbcec421967033e3cdba969e11cddd443cbf0cac4d722bb77e124cf4a81b451efbe431b674f642ea3f5e8a8b28b4c2df7cfc91c1743737bdb4da3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5224d4258f411c904dec64feb5942d4d0
SHA1ba978225feb658ff0fd0b5a71f5e5af9c477cf7c
SHA25600fbf86b926a5b8b449ac9e93833ef572e9d2da862a5607e278b406a92967f2b
SHA5122f4007b0b5e3b823ca440cd91d15f0a771a8cac6e79560fb66d37be8f66d07b0c377d33265c1e1f7949a3c99eeeb1c7e994039987a71f2bf02e2f44253a70a95
-
Filesize
11KB
MD5f33631ca3db8766501d7ab7236f56587
SHA17f4b21e1810e1bc100c6e8040b78c584bc19e6e4
SHA2566c25b6262508af0e58f3279048aaaef1a68b6a08e6bc92501d706126f394a60d
SHA51253dcaaa33cb7dff620f1b8cd6fddea71019fd11b9d0ceff883456c9c07bccbf81c6869ceff32b23295320c287518f97b53251b268bb95bb2c8599598b5a72fb0