Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
d9b55e4cde03430c4a5fef02b996e318_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9b55e4cde03430c4a5fef02b996e318_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d9b55e4cde03430c4a5fef02b996e318_JaffaCakes118.html
-
Size
4KB
-
MD5
d9b55e4cde03430c4a5fef02b996e318
-
SHA1
cd9e747fdda24cf40dcf40af35d59d69ee142632
-
SHA256
a11a40df175e8cbc646ad12ce557392b8124b1ce65d8b9091ff71f3450d8abae
-
SHA512
5192560515201d8047bc82f3b56979b465d4a9b6848d944f8708fe12bfe29a26d9ac8a13429677a3affdaaa2da4562b6d5099dcb545b5f4306477ce95081b77b
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ofebad:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FA90451-6FFF-11EF-9319-62CAC36041A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5045d9440c04db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b1fee192165e831efec9c822b517742ca53ea7d6477a3e09d078cbb9c498d44b000000000e8000000002000020000000e696dc269c35cfa2b558e82ba5f25ee4a69dbbebccabbe0f52cbf702cb046da090000000a6d0338b775a5ff080161e3bddc5ffa200c015364249ff30110e128d9179333daa76c0271d47abaad99e12e0ed7c9870896b594ed8d8d347adfad839431284fa0abb558817a5c60d49e7f6830aeafb2e6e8d9362f82d704025b367156a7d8ea76df799f4dbbe354f48d8c226f1751c71c23dc8c882520ceed2396886aae46359d7ba562bd9899fdc5b7d5f8be1a8a2174000000097e3b254432f6dee07de170f8485bda72605d89b220c713d6aa200f0d2d17253fe23827d309f65d14d851e46393a3ef92c79fecc4f385fdb7a1bdd1e47754b47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000050d839dbaa13b7d82fb318dbebdc19ca1d4001200a436e01e0a5903e1699b932000000000e8000000002000020000000886e89df99b7849b3adc4f102140b4e4b0fd59f485f714e84c9f24849746025f20000000e84cc898e1be088e20faa01963203b0f310b8a01110cdd7dd038d07686a80a86400000002f1df77e9856f512c42d7a8d10234e59ab1a313a59ac734b30b727631b735c4af00b1e33ed5de45ce51d25923c144934bf6f8e909afab52a67d09042773fd591 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432194704" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 1392 2992 iexplore.exe 30 PID 2992 wrote to memory of 1392 2992 iexplore.exe 30 PID 2992 wrote to memory of 1392 2992 iexplore.exe 30 PID 2992 wrote to memory of 1392 2992 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d9b55e4cde03430c4a5fef02b996e318_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5430a8dad88e2d67f71f7d1bc463b1ec4
SHA1030a93a88f767a40c0e45a90152e8d9d74abaed3
SHA2565c1d99f9005712191f7dfb0f7d14a035413f203ef02a41e2399472058ebfc5bf
SHA512c5dde23385f853db833dc08201182ce7202b7f76c0f9edd610dfb158cbe107ab384249a48b2ca383518c67fb0fa6b22288baf746e169b6e1ccd202b12e8717ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbd30daef7823fb4b35b5b566ce4c66e
SHA16bf93e36efca52aa42eae3ae57a4a1b9052aee47
SHA2561553edd2840e9cc4d9bd109c0c106236e2f9a36ec8eaeb719b8efc6a12377a1a
SHA512de0214f84d8ab5455faa60966ec762f65dde4461fc30768b4099d95459eca1c864c28dfc10d30804e6568cb4f7d295df101c88d96ad12afae6297691af9b26d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545143098b56af6a5d107be611bd82cbb
SHA110976f08bc2b4940443eea2a62c95f5778de61ae
SHA256ce4846681c063342c648221e315de2418e0cb0fe2d0662e6f9772259ff904d2e
SHA512254aa29c18c99388c6439ea736f410743685491a46beb4c6c5f8240d3d74f20171e26ec7699ffc714aef431bef441a3bff5df70b16aab82ab5a6f5b901089bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5211ad81b510fccee76c8a558b5da8403
SHA1cab129f0fe8f5643894090b3acbf238b64e88d65
SHA25691cdef3fc40259dfc54e1a22d330f7247cea999f76c05f712a5b5a617de2eab0
SHA512fd87494b89c9454110981bdae2997c62fa94eb6c13a55fad4fd5dd65952dc2f71588abfd4619518eae357776d56e8f4f631769dc33511814e749123b94df79ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523a22b4ed7689bb6b39170ec6db2ba33
SHA1fa0977fb4a7416fbb10bbbfadd36843ed7c7f79e
SHA2566c15ceae8438218e8e6276634672fd11535d062c308d87675675d1d8d7a2b83e
SHA512aabfe0f4303c5f6569fb1c346a2844311e1819b131cd94a1cf074d211df155b6333bbeea6c0648a488b586ad55c76ac954e9883800ad775d67123c1637f8c478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50651a94291b857272242729af7064340
SHA17151628d9897ae0ff4f96dc0895fc41b2c884ebf
SHA256f00532cb9a1a298e2c929470ef97918946520eeaca0d685c8ac2a87e3cd4cb16
SHA512ef71db4d3d0075c854030d6ec581710a2455b94dee1a23230034c0f73e152eaae34340191b825cecf9931a12cd6fa8cd1c97e37d43bfcb487e3901d39fd83f12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bdb1aa2b8ce3f4af2ff1ddcfa73098a
SHA10151f8b0c1cb29dc74e833db00bc31c9f4565184
SHA2563b5a4c0eaeb1b30874fbf935db56407f55591440c25845077749ca5375bd4e0f
SHA5123049add90791b0d091745841416d4b8d39a9945b60580ec61fdc854edc9bcb11d25ac5e2da68c9141d2f413b48bbf2b3222ba2aa2e8e26a51ff92b31d1d6eac4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb55bd36008408350224bb0da4133657
SHA10e16b00c187d3c1ad999a46c3cd22e6db892b80a
SHA256e439ade093a8cb6e28a381b2a63270650d55954be672ef80a0509a8b7a0aea24
SHA512104ad12f8400daa17962d9864c6065663c21927b107f6fb7c85712e2f1cc26dddc654585b36708dda3ac70d6c5bbc6d6edbba12747589bec40b8c570bc85ba71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564b8d5193a261dc837532436ad7b5ddf
SHA197d664df6c2a8e10b39d210f927c0fde941a4ebb
SHA256685dd18e8dc7661d8a117e641f4b75ad39d7aa2ff49f2d6af9203fc276e0e503
SHA5126e3cbf2d771c6324ee9c3a8eecbce2edb107728f18df9d55e534f7d070b40ac07d4a66eaf9cc71429f2e14cf5013bb34cd4202bd5ad2d2b043a45d552a5d7da7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d1a5c962ccad0bffa6d39b140c7bfea
SHA150033505bf105a3ddfa1ed9a1a160d69f32af7b9
SHA256a230ff54a391cbe0a460f2bb745af13fcf4c57f0d5f1a1cdbe42a468fe2deb70
SHA5129e9d846688e00e0d621a6022bbe00b3f11a39242fd7ef2c1c207fea0c20f6eef991b60ef9afed63d4525570bcafd9e5bd64f6d7429fc12d8cb5868ee57916330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5880722ccf562121476eef2fbb1528b88
SHA1dbe2fa4d453277024e277a3ae276afe3163b1a2b
SHA25658bfac6ad2473633e96803c41d2dee51f38778472bb0177c014162b62551e71c
SHA512c430e34ca79bd064666cba27c09217530e496ce889de21aa14596a7db29668e052c1524d1d30015221059b54cac8c37bdd4bcb9ff7be2d6a4afc81a310bb2ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa7a1669bd22da14778d464756fc483a
SHA10da89139e6f032c23fb5a4e4f50d72a8c9180bcd
SHA2561a811d1736bd3a498d8f0349cec4dfa5f2967c7b8d976e467870d5d957d4127f
SHA5126f7dcfd192700eb4c554552b537f803cf3aacabd7da2d285d8b60232ad47b707e1726f8db8a59f6a9bb7ffeabd032864c908ab157350669bb4876f718d64d934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55970076eb075b6f9671fd92bc7905f02
SHA121fc6b96c3da870157f3eb1f8b6dcd0dace8facd
SHA2569ab15984788b3bfe306a23c7ee4be960f53e1ac74579e1867360b1201930c05f
SHA512bb900fbe6485a8c5dff168b71677eac025fcec926602dfc25b9169a5fc9c5d4ac0079fe4e5ab4a9732dbc3759f542e8cf1311043740eb1648cf8ed1e348d2369
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ed4eae09f139e10ee2c45f5218bb9a7
SHA1e10cbf875a75ffaa00e5d535b4b73ceb10413654
SHA25628b11466dfd34b56759ea25a989948b2675cb181409ac622ce71b7b8903d9383
SHA512906af70c8262cb189ed061d1ea3eedebb550c19e06f34a9690e7c711e0c9570eaecc4befc2e13ded13a8d963a5b4b95aca1ff1497579786fe81e5c70ace5fafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e71535fe5c1481f7245cdbd3eef07db6
SHA100317c81c9bf53099062708f6dc0f6da1cf6803b
SHA256d6379914a7727bbc1d031ccfd8a422864b5a8736d4bf18eff3b373756a002065
SHA51202a910e9b517981143ce2d3561adf437e98d25ee7ef30321095750066ef8d114cd693ea6c83e31a0ae85409f091edb04e03d3ce0ffc83d09a1cf922919079079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587998f0f41103124aec2eb342285fb49
SHA1457a639150d8b0c3589ff3a23f011097fd7a5d29
SHA2560924f1e1535db45455bbad498b7e96d05fc26fc89680581622a8f47357f9d559
SHA5120ea8af07c71ed8e5e726e4a862e3a04622168304e2980a024089f6b014d49c96caa83b650c0fecac538e25ea231181ecb137bf5f6be528f3bb89fb745bc56c4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568f3e30ed8c637b69720ffe6db641763
SHA10b4a3fc769a5f375cfff054f1fb86f9fe5841661
SHA256517fc446c0083e4cd806ee19ee9b47c12f8fc8619f88c8e1c4d464ef7913ed00
SHA512c1bd28fb2babdd54af702449239525b15b43fa628c6cc7485fda46b889c5b80646ecadefdf390e3e4a7befebb766b02bb60dc645ad48495fc7d175e6333855b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589439df49691a4fe4e474d014e726743
SHA117c56413074cc2b3662af990e0c8a0f3ffa9d19c
SHA25621c17b66f5651967bfbf37f0ab71fbcb95c1829c41a12e5ab37ebcae7e3cbeba
SHA5122544545955d8730fdef6ae2815f76b4df3a377d27c65ba9c5a23c0ccd6a40437865747f0eebc6b2cb6399bd96faad9558ed6ec05379d76a5f5d0530f63116ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da04122a192039b439441d14fb91e4c9
SHA14f569dabbb0f37d5734124795eb449fcf52d3c9b
SHA256e45402dc5f832d8aa27780f3b89f8da7cd3158f004ea04415a921239b7047ce9
SHA512042202a68d33f6943e764686bda180533c3f592fd925781a568376a7953b361358b0cecc67279eabd383319285c1c701a393177ca6685aca274b196a2d615caa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b