Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
c81ed39cd508450fb8024a9bbbc119b3_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c81ed39cd508450fb8024a9bbbc119b3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c81ed39cd508450fb8024a9bbbc119b3_JaffaCakes118.html
-
Size
53KB
-
MD5
c81ed39cd508450fb8024a9bbbc119b3
-
SHA1
22602e1e7ac00cf3be9ff689a470c8bcba5f561c
-
SHA256
18b21b066704c3e97918a52a281dc5e29238383dd9805483480f4b6e28e0199b
-
SHA512
bc5dbae4157439454d14d217197aa12fd43baba665f3e35015694bddd8e16077171412e5eacb4d1dcc73521f8fc57d858ac720793c12f5896ecfed06300a3415
-
SSDEEP
1536:CkgUiIakTqGivi+PyU0runlYZ63Nj+q5VyvR0w2AzTICbbKom/t9M/dNwIUTDmDb:CkgUiIakTqGivi+PyU0runlYZ63Nj+q0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007dab1ff6bc445341982e959ed362c0fb8542194d0f528db2abda9d43c347e179000000000e80000000020000200000004ec7f978e820506083821a337039b7285ccbcb7dadc706eb53071ec1970db9c92000000098abd361c6682b157a3b35b8de8c0adb53adda97a5ed8967b3674917108f480940000000663ae9c86615b40a797c643970bf4352edf9fa7f6b7ffd06789c8d2a2bd88092671513437ba91a30b4591e5a356f29dc5e1c72050d0683f14deed7e00169860e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000036b2f90fbbe06e264036584483a12e4b492e292f34a4ae13551646177fb82698000000000e8000000002000020000000335d1f7eba50f19111b2d36eb3125a1d3fc9939f098442c1895441cc0439a05a900000009cc9990fef486e0b1d9463a9ae0074b3dfca3f9493962deaae283f641b11a760c7084fcdb4293ac6e8f028f50f169256db573759a70d874b4d7538f81e67d991af62433814dac57068e862155a1a9ae02a52aba45b2e1344d21eeca58d74c6c9af48f666bf84647cc180993f303dad30f684fae6dac03b8eb04086ee9239952219fd9e1746d884b16697e3da00fdbe834000000057861a7eb9012cc95c143fd002f13a021a62e4efe8e2e215cd9c0bf8ca628f295e6a3c6149a442e52033d77de216371f9b678260e3bc2d4fc86ecee3461707c4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0848c3cc0f9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{652DBB71-65B3-11EF-8153-46FE39DD2993} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431062532" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3024 iexplore.exe 3024 iexplore.exe 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1656 3024 iexplore.exe 30 PID 3024 wrote to memory of 1656 3024 iexplore.exe 30 PID 3024 wrote to memory of 1656 3024 iexplore.exe 30 PID 3024 wrote to memory of 1656 3024 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c81ed39cd508450fb8024a9bbbc119b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d2235e1c1e406080eb0b592e9032da2
SHA1997f869f0131764af6375b61561e5b578bb9f07a
SHA256f4c125dd1f5500827e56e90566a66cbdc480155a2d3225066ae287f2dc689d00
SHA512698d317dc57a48c67c76aeba3d7e6293639b24d63760fc9b9814d684fc9bdb12464460198c1c0ba4e471f4b78fb37d68859c3f4e6682d7b9d693db974d226e7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5c67b2e278f824d96998d92bc4898c5
SHA1ec90be98a73130797e8db588c0084a7d5e60ce0c
SHA25642b7c6fd06bba2d7f8c6ebfc39bfd37ced8e431bbd0ddcc05141d037c3eb1b6c
SHA512e8d82e291d91a2bb5eac15efa9a17976788a5cdb8abac41d99788886d00bb311aee0738fd8f5d1aaf8365bac0eb7d371d9e310a3e50a43449286515af4335717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53484005f3ea1b3e6d48e9c2a88679808
SHA18215b8f7ca8204bca67cf15ca72b517b4d1c6ad8
SHA256e4f72a388284e4179c3d18d16ff8469e1a28c69012908d4ba006f51ae63ef828
SHA5128dc2a6a22b673d18b361bd316312b1b2374a50315af08a3efad05095bb407bca1a9017d0e9232f4f07e1f6435c775949f9574a82805a84a038a5161105b6fe24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbd98adc5146bcb9bf611baf6affca2c
SHA108972a429fa08f28ded5a2009a465b4ed22faf83
SHA256318dffa2aa26c1b45387feabe17b985ff94da671e0e1db267f78bdcc3e68c24a
SHA5125f7fb80f9cf403ad5446bd643c139baf3cb012e67d876d19b7fa072d57185279e71c6ab48fb5499b96f47987d9d5569924c85da644466635373a90a911eb1e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cb1c5bee202c0d9f377411437e8af55
SHA1d3762ac827216b099a56c9c447836eb0478fbfc4
SHA256d68dc9488ee532a014e9b55568d833dc03c1254559bd9b2ee2cd0afa9ab09f67
SHA5128b8506580a16cfad261bea4d6b18bc25d2000b9665c9e386e7a7b524692ff5d41d7695a260a2007f7fbc80ae951833fa11e2a5dfd148fa3764842697e7cc7d11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502a40efcbb61e7eaa93980959ab946f5
SHA1fc42a443584c7ecae18046510d9e5b5070dab195
SHA25663ffaeea8ad794c3b1f1114e44c76893dea4a784fdf2f7a0034d25a04015456f
SHA512f5440e036f4db28ab114efee05ae100affe8784a1f221cfc05ad88f18cc7566dd39e3cf102854393d6116d9e69cebb6d83b6febc9fd117e628af492681a9ba2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db83d066981428d9c0af8f1bc810dfd5
SHA13f990ee7c488b4aef8fe7b6280cfcc9b0a36e74a
SHA2562137afa7cd691ecf57b1414cc7c85c14542e8ee925ed7d390023a3748479aa48
SHA51201c9ed489eb32580f5ccc96a27d08e881e66883e16ab100a44143fc5ad327090956d6c940a64ce1071d243c5ccdab6060f9df611799cffc3ba1c1bc1d06a9b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5366aeb2b8b0adadc86b500a43693f2c9
SHA1055c98f064c65ada285cddaca4b453cea6f5b604
SHA256aef3955097211288b395b2ff0f950efda67db4c6991a91e2d19f8383a6ab5686
SHA5126368fe6f2c9a3598da94337ff053a8563593d3f3c3a764fe9818e0072821e4cc312bd3f751e64e1af894034ae14c626cee2bc6804809b1498e703957c4118549
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512f6393e4bfe308cb38013a06907cecc
SHA159c7d43338ca19c283f4dd46647c3e2e18ab2fb6
SHA256c6543afd597e229e3c8a55afb9068a572cfdbd0fbdf8e57a8e2cc8afd7859568
SHA512e511bc72dd6e2863094c94f5753e264cc658ac75bf45116c76bfc0b39c57a17a2ce5666b151ffd43a3a1ce6bb9934360a110badaa55713a5e3419fdb6bf1e5ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a656d9668c1ed4dd95af951bcf0579b
SHA174595ec83907991252cbfc2fd525ec429e75df92
SHA2563214e2a5ba7d60f18b354027a88005617ff7304cddcf3e16ec3f3a5978353183
SHA512a5baa0f3afc417344e8f8b0f4e57166471d67fa598e0ee141e6f46e4e56e66e97416f99baa6bda3b53553703240aa45c6654cc81d202ca49ae707c007ccc87e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6ff4f05bb463f227504760207476246
SHA1e3416a81b75b1d0449679bfdc15ba0da4d162851
SHA256d17fa008f8c47c13dda7c54dc6471e9d7e289928fde9769cf39904db57cf7cb3
SHA5123208e274127ba1f3272884b56bb6d08cd0337cbff524fe64b4f3cd7ee18dea66dbf9432104e3ce81289ae9cb91c54b3af39dfd6408eb94f5f348e05c8e7325cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d613155fef744e0e2de18b8d1c4872da
SHA1a271a8b2da694dd18eac22d214216a9bc5c43cb3
SHA256d7b7bc4a50f6b1fda3f22aef15f18e0bccde8a955909f980e323289558d08c9c
SHA5123a267b916bba1742d87ff1c78448c5a14386e269dca18e6c52c88f7b6d37efdb6138ead368b0c9ce340214ef46a61113ab735d3fe6ac1c5f88dc33cc3beb70f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be70c7e7430ebfab648991f3326825cc
SHA188836f673d60b93ac1553f7246b37ff43d82e7d9
SHA256bba49584c3dbccea7a7156b9095d9190f16c2819b9e72f7c42ed43618d205389
SHA512e9e694bdbdb0376d138648d6267592f4757250bab929f2b74a9c134a6d534272f9ab17ea1a3c12547b1c965b90dfbb5cb56ad96c923f56b100ce93e4d067db24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c7190e54f6efee2e17146240b60954b
SHA18a5be801d892de766e9c9479634694305fda777b
SHA2560eb0c74c2073a3a93423ac458b1dc0229059a60a7744e3f5f79beadf2248c6d3
SHA512dfcb3027b3f2a1cd0c57db42a3f9c155f679056550827572907af8c788789268511d6eaed125e7e74267463865d90db436bcbe75633fe7688a3a7115b0984e7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb4c0c32814a09bb96cd5ed42ff275f8
SHA1ccc53270fbce9eecc2754d59fe0b0a555a10db84
SHA25640512423f4f720598d93cb06e13e816c9a8a9e8120dd9ebd8ac113ce4fb69b39
SHA512a9b03344340f6f25fb5206ccd7cad083ad817ff5d7b456d8e52d3a3df91842d3dc400784f67a78eb9bf277d4c769a9f607cf9d6956f8b3c0f2de5816b67e2078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e5260884eec1e22d0631a2025aaeea5
SHA1551e49c0048b93039f9921b837b6cc0b277a6f4c
SHA2566e5e1e867faf9aeaedc563515222d87b5f8d8079c21161e2d2330fb6ff693dbb
SHA512a508597d38ec9be23ef4e47491b5e789449e41da2f1461184797fc3a3541cad1cd925501869f6b2b7d31651b3cace2bf14440461dd6bbbd51d6f755238b8741f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574b2382331603c965b88853398b628fc
SHA151d83a98afab88345f2414b16a10fea697b3eaf6
SHA2561a65e9d80fa4e526ba52fa342fada6fed8fe0ab2b57fb29279608259a5b6c74c
SHA512e9d48f261eb78b40937adeb4f4a80af634c799aedf19ba736847a75ba619afaed2c63572de235ff5f89432175e5e0cde399f38e36230ec1d56e645e484e6728e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5146c22d234df2806fc8d9f5d4209eb89
SHA1f8e38f809c28fa7c65d8a865bfd50fba1f7d450e
SHA25662afe329203f256f75889025774b8e64caa99197421ae74796d44b652f43b6c4
SHA5126f8cbc0a141a19d314b4555d166a3405f9a64a27e6d5f5e5483a640c30eae1fc4223f8345db98ee42ada98911aab78b43202d01d2a02d45485b62978881274c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\script[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b