Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 21:10
Static task
static1
Behavioral task
behavioral1
Sample
3664ea228a3cbc6666741b2a13695b48_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3664ea228a3cbc6666741b2a13695b48_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3664ea228a3cbc6666741b2a13695b48_JaffaCakes118.html
-
Size
118KB
-
MD5
3664ea228a3cbc6666741b2a13695b48
-
SHA1
eccddb81da64d18cebe286eca7ff8cc6048b2f47
-
SHA256
90467ae73de9a4a80287a93f45d10a04beb195b391a024a5fce6f3b7d0da57af
-
SHA512
eee1eb73431c7b8011eb3f97324604797a05de35c9f4be218004c0aaa9255247a7184baa356705ad05ef3f772ada3c9dcfdfd19b32c5cd31872b08b596efb787
-
SSDEEP
3072:gk2l0IxsNuHxbW0hpjzL48m1/8nRA/C9BW1W7PUi7dfSoJcRpuFxdMNkRlLjOedy:jTIiNuHxb7hpjzL48m1/8nRA/C9BW1WO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3968 msedge.exe 3968 msedge.exe 984 msedge.exe 984 msedge.exe 4700 identity_helper.exe 4700 identity_helper.exe 2312 msedge.exe 2312 msedge.exe 2312 msedge.exe 2312 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
Processes:
msedge.exepid process 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe 984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 984 wrote to memory of 4852 984 msedge.exe msedge.exe PID 984 wrote to memory of 4852 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 1708 984 msedge.exe msedge.exe PID 984 wrote to memory of 3968 984 msedge.exe msedge.exe PID 984 wrote to memory of 3968 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe PID 984 wrote to memory of 1976 984 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3664ea228a3cbc6666741b2a13695b48_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff587c46f8,0x7fff587c4708,0x7fff587c47182⤵PID:4852
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:1708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:1976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1360
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:12⤵PID:2776
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:12⤵PID:3520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:12⤵PID:4348
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:1260
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:12⤵PID:2960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:12⤵PID:2308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:2924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:12⤵PID:3024
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8701682058691646666,11591269090405991328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4768
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d406f3135e11b0a0829109c1090a41dc
SHA1810f00e803c17274f9af074fc6c47849ad6e873e
SHA25691f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4
SHA5122b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409
-
Filesize
152B
MD57f37f119665df6beaa925337bbff0e84
SHA1c2601d11f8aa77e12ab3508479cbf20c27cbd865
SHA2561073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027
SHA5128e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD502eb115007efa9420b5a1bf294a42706
SHA1c47fde71f68ad8a27f5d7add897f933a2d237b43
SHA25690dbd2724513fbd58080f5e7c4041d49b4d0cc9357deae549e2c50378d8c3b90
SHA512bbccaee621483f987259e4651d2bccb2d60f6d1d554a95a6a92b00d808f239c3dfe3fa1228e94de387715852101bd714f357630d5655c103585ed426b2bd019d
-
Filesize
1KB
MD507e83a04f3a3713a3d90403446b163d9
SHA17299dc866747e4f467a57303a8d9892e7a5a94a7
SHA256d4a006da786350e3a7fc5e874a744bc65a6c62c0c4362de3e46495f836065400
SHA5123405aea80d47b5bca07e53644dd4059a87892b4bb993d74b5f00fcd21e9aba6964ac07be84fc89d43466b6a22287d6c955c1c68616971f2d3ad7cecd7729d1b6
-
Filesize
6KB
MD5749a4746504399bc047df51bdb2f4ffa
SHA187d40bb07295248ac92e0e0f60044524344338e9
SHA256e820ef06ba23262ad4acd144ac23208f9037c7db03c379040f9d1a38b61b7121
SHA5123e17d7ee1a77aeeabdd22fb8e27286b3dd28e6b4a71c4f724f02bc052040331ea19c07b9592e9b336c8bca827d1f9f416c48ed1f54f17fd6a53623083231c0cc
-
Filesize
6KB
MD52641ae70c7af672e8ee5ef324460eed0
SHA11f3c3c816e1284302b744feaf6fcd9bbda54e84b
SHA256b75ba095720a2cc65f67d71b6e0b01365c5339755d30235b19aa05931389bea5
SHA51264fdd9493806655a6331905620392437ab3b3ef357ffde75eadb9fc0185123fe15c53b2f22ac530dfc23b63fc97457a2eb9bd32b7ab6536f37af8933821ebbc9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5667d01168e6b83df65ebe67cae53eb47
SHA1d41e2731ba039562b1f63f69d4277da2274d5f17
SHA2566c7cf50b670cec12df7eab1db781dc18078734688a46b180f875384c70fa0e34
SHA512e48fabee4de62f0bae49830dc3a2fe948a4a47041cd2ec4602f5bd90d4338d48bcf309c7dc0438e2817c156e6de66be47a37be29a106410291d5845064897f3f
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e