Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
5b46e2b55c16aec29999d4dbb223f4c9_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b46e2b55c16aec29999d4dbb223f4c9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5b46e2b55c16aec29999d4dbb223f4c9_JaffaCakes118.html
-
Size
18KB
-
MD5
5b46e2b55c16aec29999d4dbb223f4c9
-
SHA1
7fe61283f0b64f883ac5687b920195900742f182
-
SHA256
d56adc423ec0f093783d518e924cb284f3bc051116880459317ceea3e19be02a
-
SHA512
ffa21c9ac3d244003311e8db7defa419f571d358b8a6d76c13dd5c19ea6e26bccb349b7b74773c5c307356fcc93c68aec5bb1763b04009aa2164730e8e1299a9
-
SSDEEP
384:msL3cZ3L7/pQu7+slwpaoOi9/QxHr8p2V:bTctLNLtU+U/QP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2752 msedge.exe 2752 msedge.exe 1996 msedge.exe 1996 msedge.exe 1052 identity_helper.exe 1052 identity_helper.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2604 1996 msedge.exe 84 PID 1996 wrote to memory of 2604 1996 msedge.exe 84 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 4848 1996 msedge.exe 85 PID 1996 wrote to memory of 2752 1996 msedge.exe 86 PID 1996 wrote to memory of 2752 1996 msedge.exe 86 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87 PID 1996 wrote to memory of 1512 1996 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b46e2b55c16aec29999d4dbb223f4c9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9923746f8,0x7ff992374708,0x7ff9923747182⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:12⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:82⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:12⤵PID:1316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6145961998873889354,6622142499005245533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5fa8f37c98e1880ede4c23ee120a9f6ee
SHA12f4c4f8c2327b173a7830b6a2a503d6b2b980d65
SHA256ffaa6dde8e8bc0478bc8a68f367af893d635452c19d3023033f96efe17f378f0
SHA5121c6f7789620ed62e28dd8790d20f66d60d7a58beac69e5715c795bb0aa00186f8ea4e5422fc8259bce67778604ca52d1e9655a3bd1ffdb0d63b6e31d49adb0c0
-
Filesize
1KB
MD564957d6d4c1d4c49256ea4115e1eba1e
SHA19eb5aeff80d1e38faf77a2fae6daeda84be36dc6
SHA256674c1875c8864997fb897bd2028c75b454655e2b610371e60bce38d3fca0fe50
SHA5120ff42a26bb4cc9d636eadc706864328f1e0f04c4d2228ae6afc1fad179f07bb435927ab62b1a36708af21a6abd600e760f4c3391d2e1ab9fcca526daf8f7dcca
-
Filesize
5KB
MD5c2afd3bd628bdb0d814a730b530a5620
SHA103ac180ee4a9d931ca52c2b3e49109557def2fd9
SHA2565b009e152996c9b0d627bb7b2692b3588fb5f7ccd68d6d588392555b72727f0d
SHA51239b84b082bb5784d0570bec0a8d6b01d32ba5895938fd7d2be8779767352c246b3d90d28fb168b2cc2647b82e79af1acb23da1073e7599b87c1d9b637dd7a886
-
Filesize
6KB
MD53fafe7b9b34e3d3a81ea7e34da0145d0
SHA1a227de77b2ef64a035432338545e1b0dcb8696c6
SHA256c186dccdb7e5c7123d3b04ceab8cf45e74ba3f68d279c59c25de293e8f2ef5db
SHA51229c9b14d07cc19ac5630179e9fb9316d9b1f6ef13d092286d1ffecddbb20c72e5602df9f6c932a1dc37d5389e8083bc08535adb66be1d7dd3b8f544ae681d64f
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5df42e397d4190db996f0fe0211eafe51
SHA116fe9e6f22bc96f1f4221c417df428fc25f4abc1
SHA256083620af525dda6231697cae8a4fdc79946c18ccdb723b49123cc2be78e684bd
SHA51280f4d6a8cd4b94fd918305102757e740a6693af1238a335a07ed432ed050cc6bd2b9d5dc4ff96aed698c39cb1352a3105d7988b8c890aca53b87b7af20730d3e