Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 02:31
Static task
static1
Behavioral task
behavioral1
Sample
3244b4c9c672fc16b4af591d2eed7544_JaffaCakes118.html
Resource
win7-20240419-en
General
-
Target
3244b4c9c672fc16b4af591d2eed7544_JaffaCakes118.html
-
Size
17KB
-
MD5
3244b4c9c672fc16b4af591d2eed7544
-
SHA1
fd65a4a22640f808adb491d30fdafe4ac0e8f021
-
SHA256
64d5d27a592a66910904edd3652ee37bdb417dca979472da4f83280bbfbb6895
-
SHA512
4a994462ffa04249a628c8e5a4ae9aa5fec529edfa61b6bbde0b9de846c3b6586c41b43e26d9ffdb51fb21f638152c6a5bcea8d2b5843c0cbfdd74b63827372e
-
SSDEEP
384:SIHwk6z88Wz6OrVFFUjBQVxkHudBGVlDDYC/YjX:SWyz8806OXX
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 45 IoCs
Processes:
flow ioc 49 https://hi98.cc/gg.html 50 https://hi98.cc/gg.html 65 https://hi98.cc/gg.html 69 https://hi98.cc/gg.html 19 https://hi98.cc/gg.html 48 https://hi98.cc/gg.html 56 https://hi98.cc/gg.html 64 https://hi98.cc/gg.html 53 https://hi98.cc/gg.html 67 https://hi98.cc/gg.html 71 https://hi98.cc/gg.html 42 https://hi98.cc/gg.html 32 https://hi98.cc/gg.html 39 https://hi98.cc/gg.html 47 https://hi98.cc/gg.html 21 https://hi98.cc/gg.html 36 https://hi98.cc/gg.html 41 https://hi98.cc/gg.html 16 https://hi98.cc/gg.html 55 https://hi98.cc/gg.html 66 https://hi98.cc/gg.html 70 https://hi98.cc/gg.html 14 https://hi98.cc/gg.html 30 https://hi98.cc/gg.html 31 https://hi98.cc/gg.html 46 https://hi98.cc/gg.html 57 https://hi98.cc/gg.html 17 https://hi98.cc/gg.html 33 https://hi98.cc/gg.html 40 https://hi98.cc/gg.html 29 https://hi98.cc/gg.html 54 https://hi98.cc/gg.html 63 https://hi98.cc/gg.html 44 https://hi98.cc/gg.html 18 https://hi98.cc/gg.html 20 https://hi98.cc/gg.html 52 https://hi98.cc/gg.html 28 https://hi98.cc/gg.html 22 https://hi98.cc/gg.html 43 https://hi98.cc/gg.html 51 https://hi98.cc/gg.html 15 https://hi98.cc/gg.html 62 https://hi98.cc/gg.html 68 https://hi98.cc/gg.html 34 https://hi98.cc/gg.html -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1788 msedge.exe 1788 msedge.exe 2896 msedge.exe 2896 msedge.exe 3440 identity_helper.exe 3440 identity_helper.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe 2896 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2896 wrote to memory of 736 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 736 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 4880 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 1788 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 1788 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe PID 2896 wrote to memory of 3324 2896 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3244b4c9c672fc16b4af591d2eed7544_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9da146f8,0x7ffb9da14708,0x7ffb9da147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10021144721043553889,17228538951980742727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5979f5067a5abf72d85418f4446c910fd
SHA129381f33e4709fbff6355e62f6079d24189bd951
SHA256961af11726f0e3d1c9584cfc9f49fc24a16b2d1c99326f354cfa3c58a61a13b4
SHA51274738284f9ec3b73521f49691a162ea3ec04449055df65f3e95cce0d5684bef14183b521badc998f8083d546a654b355c9be82a978f0208dd69d7884a1224941
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c4c756299ea959a7c7c8c8707fd1e3e8
SHA1a54428a8d4f5863d49f6c86129022d5bb6db5ff5
SHA256b80810a9f6051dce43ce7b4ba3173b2748810ce3dfbe1a20c964e6dcf4e842cd
SHA512e93a826cb7ee7c74f49c33cc41b38f0d9de16255794328c1e722ee16ef58d697bf200279196f34ab94c269f5430a4facd1078f9b5fe98c58f5f231ca60c55491
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57077fa62637663783f4c212cb611eba9
SHA11f3a63f046488c6288d0b30f2f7df99c8bcae9ec
SHA256e7c65b4cbb8a3b75b2d56da9855e8f22cac48589386c6e38f0051ce5805269c6
SHA512ec78b0ed438c8ed5621f6534abf850bd7b1f674747865feff8a6c1e3a2b34b151e6f30625e0c0681109d2bd72fea66baa69d17f3f9ee66969c2f012cdf527ecf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD513cc1878d4582fc839183c1cca3486ef
SHA1413080a6b816e65539899bbda34e8144de37aa7b
SHA256e1122c10107d05051aaafe292324f59ce4ab6c9f8debc03327249f447719267d
SHA51203eaa2e1f81c8fd48d56e11e15df8fb6b3b9ecc1d5118358d217b0e3c9218bba90f73fef48db33b275cbfd84f5328b09012611bb98d80c2b6ff9f31defd092b7
-
\??\pipe\LOCAL\crashpad_2896_CWXERINBZVIFQMQBMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e