Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
878b495efa9e9573ea89405db54cd82a_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
878b495efa9e9573ea89405db54cd82a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
878b495efa9e9573ea89405db54cd82a_JaffaCakes118.html
-
Size
15KB
-
MD5
878b495efa9e9573ea89405db54cd82a
-
SHA1
4c9057447fb92a95072f5faab895c7f98240fe1c
-
SHA256
e5d41bc1356d1e92371de39a9aeabdbb26759810b0d429a314a0d00e598317ff
-
SHA512
160372f1468cc318e6f781b88f23e3b7033615b3d610537644ac44038dd008f1006a13eb0518df58a5daa2dbafa4c1ef5741785fb171699a76688b32d877dfc9
-
SSDEEP
384:lwmONbk/HDqRxiZK1eMSeSiQAUSQBKwAhLSi:lw/NUDq6Z8evtidHrmi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423332641" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D723A491-1F65-11EF-8E9F-FAB46556C0ED} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000003396d77d77f13ad9114f461a52ed235b23080c78f04e5fe3905ea537e2c16fed000000000e8000000002000020000000232fcceffc652d514bb1af3b32a2ef77d50ba5d792ea15da71203fa1a1a09feb90000000e69fdd8d4e068495256697ac7857634951e9c4900139668882b847ced1f14ffd9c274cee82d7c666428d44f010211b87a1d3b91c4571f3ab6c474806bd9e108ed71a31da62387aa61ace928dda924c806a0fb11b0e8eec2660ea165a29928af7f6829e7b9b1517922269de45c19598a6687e0f52358c5d2abc7f7f5ce17106d124331dc88618519d07c24f9f4df95ae5400000005cde5dc283b0150e31f52ab0e2a9e0ebfeb04e7280dd5d51083c72cbc04db98d1002cb636b7fa6713ae6346c670766580934677f578a06b75b0223f75ed3402b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07e16ac72b3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000830dde1eaacd2a03d935a3daf34a2ea2b6e1433edd1f49bfcf7ff09fcf6b6591000000000e8000000002000020000000bb9d75972f230e690716170552e16db372923f5fc2e2ea0e18b125801ca6fed120000000b5ce69cd06fa320330cfeeb591baf857f3cfb5f8cddc9a2d96ec1c9310b7746b4000000007c3e76ae4c796229ad5a5da4cb3f1443dae4d7226391f98ac3d9c9707565e5fba243a77e9378ef4ddb5bb96c625c820ad7c323edf6b173a34be394969addb49 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2980 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2980 iexplore.exe 2980 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28 PID 2980 wrote to memory of 2916 2980 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\878b495efa9e9573ea89405db54cd82a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5738c286c7631a286ee88f2162b482b09
SHA11e0298fbd69b7c6ae56a63f7b53a350faf864155
SHA256a0464d88ec255043e3c91b688120440ae35508566cb3b07558ddd9549278e877
SHA5120f7b4fa105997e1fa047e8dc9ca41f829c3deb4cfd3c21e75c92398b5cdb3c55e29539315afe2a18fd3365964929810eac3c39798b692c1006c2f34add336205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57adb6577b2a2c632e2cc1c12feae27aa
SHA1ec114e95e439613280249c0f6cc03038cc10b1a5
SHA2567606e65c64b559dc7e0d43043b227d5efda898cc5849fe95914f7bfe398d92cf
SHA512c5d6a978cd00e90b958183efb1ce3055e187fa4f5f1a3d81d2ef35e66b8a229325caca2e3cec9722fb282f71fc60f34369b6ad02894b5b8d3f74f72869cdd0bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad420617ac4373a89a3ff49eb69b386a
SHA19ad1af389c9d97ba204238901eb4af02124d4cda
SHA256f82f537b288936680ad8240f7137eb4ed95fb75bed65a362d4d8746b5d4bfef1
SHA512d387d2da1c873bdc063efa5a00caf61604d509bc1a9b6b20d728b23f326d1f9f6cc6966034a8e85d8cefae2c8e241298f9ccefbfdcb62a5cd6fe70f1e1027abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e04b77a0d11ce9a834506dedd99fc95
SHA12b3ae7eb28f5ef221b5615518648bb0a20e8eeb2
SHA256e1ce0eb25403007a0ecaeb847f29811d5644260125c203d2a2fefc7da31ff797
SHA512378202dbe138a4d299be81a731e70dc11ca19209b3a888c5ab80a03fdca3075574fe164398f2be6ce50ecc2217b9f0b207dc903fb7afac9e3a63fd283dc78b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3c32b08105e8ca8a535332a4970ddc2
SHA1235f482dbaddeffc5d36e9583a34c6dfee0a065b
SHA256bef5ca9eeb6cc8cfbfc1a5941f23d6ec41bd791aa23cbe86ab951dee98b8b1be
SHA5126f31c33114ca8699e111d730286e73221a25a8a13fa363aeab21ff15d027691a134c7ea543d2cc04bd7f9178a2202bcad46cc430f942e2564e72a9c83de8c48b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5794cd28aa869a209a26be38b1c9fb33a
SHA1c9ae307a51041e1578a967ef17b6b4a0e4c57f55
SHA2560990917a4866cec4f1e389609678ce185f41a58ccb2bf08d51e9418fbaa868e9
SHA51272e9a33a9da36ce4a61f87939bfc3258fe011b0f6ffb370e98d0aa9b038ff74879f6c7cb6b4cbed752ac353dd8ac53a9e54f5367305396c072f3bc2fd59f637f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdadc1ade6cb86bc2998d388e8fdb894
SHA18c2f3ddc2144d61340932a841e1a1fee2a779474
SHA256e6e9f35b8420b989b459a82a4b854f710cfc554113a33a33a1b05da909d184be
SHA51213b9d3b3aa9c71fdbac7cf010de356ae813e91ba19586db7cf5a22fe06a4702e4872efa4b11be4e1dad3ed446b94b1cceda83c1f4cdd9ebdef42e3c7492760d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de9cb0f00fba3a48dfc6c18cc82a9e8
SHA11ea9639bef71ccce976c54dec9b8837061b7cde5
SHA2563050c697a1b2a424ca50d4246869a4b5f0d7760b2116bf202e738eeee243ccb2
SHA512c8c8a753c21e00d63cf63529b9801f10fdd226d15274bcc696fdd8fd83cc288f2a6af88608971240eed86775fa5e9b22d27ef1ee63664dbd55f699d3036da425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f845c6746e4dc77cf29d7f828b46ae10
SHA1f9b3955e1281ef2172800b62ab51c85205838bf4
SHA2561757e98e17e538a9a81a2cd1c2abca8eb3e292976debe6872f7a0a6ff70b36cd
SHA512c6dbd53a7bf26bc79435e7df9b36754e40a41dc457a95acdf536d50f60d4cfa67572b25c6c1e4ba28e58d636a8b3065ab5962f4b39b8c7905f8401aef4a67b94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593e86fdc3fdc028f6c82241b1f7b40f6
SHA1c738f4aba1ddb071e12fe16228a86a544e319f2c
SHA2564f6ef023929fa08d7f7c16d154b4937c8381c3613bf2659938448ff65bedc9e0
SHA51276cdbd48a1d9bd076e2f9fd1f9e4320a3092afcf86f35499206e8efd8de3753f054672bbda23bfcd08535dee998837707ac5c0650299ba3f732bd8ed6dccb808
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ad9afe98ffe2e45cc29a7fbd77e13e5
SHA1999e1d893d7ccd34f3f08252a54a8fef39da360f
SHA2568ed44703d637893bc718f58025e6eadcc08e072808ea260056d9da0bfb35ff3d
SHA512f8ebcacef0201e8fbd7671816ed4eebc74057d550f89077ea098d24db2d72ec32fdd5ae555568efa3367c79f5604197923106fb9b10c19eae310f5401257b1be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e14faa7e9dea86a1c434d6af6e80b085
SHA18381f17f1f70215957bf6029fc0f14eed0b85414
SHA256f14d39fbb1c99bec3408ee62484132ff7188227da99a7a07287743c9c286c268
SHA5124b77c49f1e6cf146080cc6971cdae0fb91c1b511d8109ae64c74d7ac304446238c05a222e073300667898521ac77f0dfc5a2f31b333a109715fd98f8d4e1ab2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552bedcb2d01461ba5a2e67ba475fc3e1
SHA15ca53d40f29c9a293722c417c912043dca8426fb
SHA256c0c270e8225540ac8473230f99e8f26eb36f85933493b55e64d601567ccd2d11
SHA5121bc1f49053ffb99239d26ef59f91210027102ce76080781936d358f353f85e493af3b34263d116e9780c11ac78c01c56ab18f3b1bf34c93fdafe937fe5b3e85d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dc99a9c1d437c12fb16f9a2342b15b7
SHA16e990fbffff024ca6de1b3ef8bc479e268438fc4
SHA256e0fde582eef085f306449ed33d3884f97d8184f3b9720b1b3a96de7ddfef0088
SHA512c7e2fb1af540207c804c4991a2e7b3ee91281af2a47da51cd0038f3780a27c0672cecdb69788e36ed4f2cf43f17901502df5072a5cc5e6a0b4b13f78de004303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d57f29c83c868f16cdf1aa9a81ab83c
SHA14c17f7eb066f8705f0ea702173df440d1fd6360b
SHA256d5bab7fc77b31bab1f411dae825355ad754578593aeedfe6c93236e7cd5780f5
SHA51215b7739ad904e4bcc05a6051be90ce2dc6438ef3456031e12cc758242232d41c36de22633e683bc2bae0e74a6e3b34c58bb530c54239aea1ec9891136122d01c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525349d41c52040ef1dbc8c08f1335b9d
SHA1ffdbf69e151b3905fe1a934509454790fef8f7da
SHA256315450a13afd070edd6314272cac34f855ad2ee866e9b3ca13fa0f373a22ffd8
SHA512b188d82f12250e1956ac2f7066479342c5da1a74364d6f2ab12f6b3a83b8aa93e7ba0b0bc2815fb44fd6fba8451c57444dd5f97ee8e79d6ecd20b2e8ef34db34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822c29b6fca7bf8395507dd0f80116ac
SHA1ee3c26440315a3eb130ea0b39ff268307aaa8b0c
SHA256393142895c20c098ad800b2f89e100c5f6a2171ae70b87ab9a1cdf6303c25cae
SHA5125a124a316ac93553b9a845e7e2a44c7baf1189c76384ba4135cfd0ed8e5ac3f302ee897ab968da8729d06315133a08bbae08f81540d8ee70c1d4e242a50f620c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550aec08a03a38571ba61c65eb885b493
SHA1e7d2bf3500e6c6b9382d4c6fcab9945c3d80c313
SHA25693a0092b521e38e497f8589cce17479dceb99efb7bebbb2734e59ede36cddd7a
SHA512b2b3241f3f1c8bc722041855941104667e2e686f2436bf4a0fe9273446f532b1d090dfe0570e6b4fe09c4e355d76055d2b667586c0870c2d4a950f836256784a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b