Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:06
Static task
static1
Behavioral task
behavioral1
Sample
3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html
-
Size
57KB
-
MD5
3661aab5b01318a3f1cd4bf43dbb89cd
-
SHA1
3438aa3fda58e63d1a8ddd643c3df5a9ebfb9ab1
-
SHA256
1e14451084521a899f88a7370f1a51a36f97f7265ab1e6140c9b9f824c00bb5b
-
SHA512
25feaa8d75b2946d6baf0e1ebeefbac0c1b4f0fdaa52a1a23e5988ddcc90b9304d870d2c8cd84a1247c6616e050ad5fc2d0f7da0078d1956815d8e6deb1c8081
-
SSDEEP
1536:gQZBCCOd30IxCatcZfefgfPfffSf3fWfHfXf+fUfGfIfRfcf3f7fEfJf8fefafcv:gk2Z0IxSmo3XqPuP/mMeg5kPTsxE2yUv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2344 msedge.exe 2344 msedge.exe 440 msedge.exe 440 msedge.exe 2224 identity_helper.exe 2224 identity_helper.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe 440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 440 wrote to memory of 2408 440 msedge.exe msedge.exe PID 440 wrote to memory of 2408 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 864 440 msedge.exe msedge.exe PID 440 wrote to memory of 2344 440 msedge.exe msedge.exe PID 440 wrote to memory of 2344 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe PID 440 wrote to memory of 4760 440 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3661aab5b01318a3f1cd4bf43dbb89cd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9549c46f8,0x7ff9549c4708,0x7ff9549c47182⤵PID:2408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:4760
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:4616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:4436
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:4440
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:82⤵PID:4260
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:2656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:3792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:4364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10831667743404691399,773107107265346404,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4644 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3700
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD520cb182f96e73d8b500c3c56acd455bd
SHA16c2428e516cdb39a2161da850e2f0e9aa49983f3
SHA2563d5c84772d4a892dfffb07878e1ff6007dba633362e2f62bea52c8ca15921ea8
SHA512916c02b5a635f3fb1dfb3dd398023acd0f0c3f99746f80ae7a6c9605a80d9a60060bec761a3562fec726586132280202e4042e7f39e8cd176483867fd1ec0d53
-
Filesize
1KB
MD5e4e9b80ea986872228c6e2b81bbd44b4
SHA1637a8877b410a314cf6de296779a09e5ead8e4ad
SHA25629856080017c39e890636d025accbfb1d2599ea57df4942342b32e4fe86a9f5a
SHA51284dc7ec4282cde2247115b7b09b0cad206ef3ccdda5c9b639d9629e80a4706213cc8cf53232a2d773038a6ae95c7be5714420dd08583e4cd259275c2638d590f
-
Filesize
6KB
MD53a603e8963631c7eb5b1f8c1f2c98cbc
SHA12c087666d8f1136d3a2ef5fd40690648f9c8de3f
SHA256fa5f45947691fbf37622ea1345f7e521a1ed6499023acb61b67ca0d26f6bcda1
SHA5121834bbfcc1935a17b72ed629c4398c1e0292e68eb04f46383ef5fe5d711d3c8165e09793fb88120abb336f8657bf609893988df42f8f98c075a59711945930f7
-
Filesize
6KB
MD520861459a4068b4992d1ccb2468de2c2
SHA1861bd580425535c42da55a538e86dc482d544c1c
SHA2568869824897cc14b9e2e2794e10632873e0fafa10f8960340ae1f60ed3e1452dc
SHA512f83b675156e62cac7aeb1868f580f9cdbbe4e5156702ff411847397baf5549c05929e54ee8efebf1cf3d5d13caac6371b4928d297a7221e0e98a640f9ba7bbbb
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD593f577bacef81edc6e9d0854a05f1785
SHA1372ecfab1d255faae29f532a4372a38e773c6ce2
SHA256dbae7d96dbcbee0aac0e16ca24bbc57cca24dea181a227ef8bf0788677855d62
SHA5121d1f3afd8b70c012fe467eb44f8d2364ebfa24ed7066712797b9a573ee40766148bd268202326b68299600d39fa1534dbdb2dcf5ed7a070cc41fc14c6b6a99ad
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e