Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html
-
Size
69KB
-
MD5
df17b0d4839cef1b810da94f0efddc5f
-
SHA1
b06b63f2e975eb0f63aeedee04330ded8cf2e8b4
-
SHA256
e92135b3b88e50f095aece5ac97f6568142de367bff5a9db313842e20b4bf13d
-
SHA512
5f2e77565d03b8c6b60c185e1e589999f032dbf410951f2454e72fb83065d24fc868c3c83b7eb667b56e94bc5a019938a93c0fafbd76abd6f83d15f247b5d348
-
SSDEEP
768:Ji7gcMiR3sI2PDDnX0g6smn6solMlboTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J3SQaWTzNen0tbrga94hcuNnQC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000006ee7a10c449405e23e215b34cc93ed54603964eb6209778f95c65efaa1c1dd30000000000e8000000002000020000000df2480ab475fae0e7cd8c223cbbf7490b1b3149773a80ad6b8736a9dfef3d91920000000a249585ff2e4fb8a00f4cca2c0860a515c46f3c5d8383d1be30eb9f5dc40fc6b400000008895f42c124f6b6cd60b4199e86092ad26952e276f445d869db4c75bca7efcb952b319db10f5ba88d5d9ee134b394cd01a7cefb726291ff4307f5d37d0efc62f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432432096" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bc31fe3406db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2988BC61-7228-11EF-8E54-C2CBA339777F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000009422eb2b7e9501dd4d87b4c6c0e75c68e70127fe26830940cfcc88a754c52a7e000000000e80000000020000200000008f54090b91131a9bbb734f4b945427e73a77437bf59090d3cd8431bd1fe3783b9000000025944a161356dba6c2d0e3c51cba8cc58dfc33450e96fed79db8e86fe0ab03a0ff4f53ba8978428c15e7e491de004c0cee2eba2807fd8b8e63716cbcd70b354c94640c57a07e81c88309e8305c9ebe7d6e61a9b59a0b0b622acc67bf2ee5614c3525860088a1091eef0eaeec63c158553ae6e2944fd5e458caaba20bc644a6ee147bfa3010e73c218c5b958bb261ae3240000000979c58cad51be440f8f32f995e8a6444bc44298f7bd3a3db19c269ec4a2e0bde0e179309c1a74ea7a62e88a5de1d903cf7fe46bacacccca6c4dec5970797e5dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2660 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2660 iexplore.exe 2660 iexplore.exe 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE 2788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2788 2660 iexplore.exe 30 PID 2660 wrote to memory of 2788 2660 iexplore.exe 30 PID 2660 wrote to memory of 2788 2660 iexplore.exe 30 PID 2660 wrote to memory of 2788 2660 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fe31982f3b067e9641f0e917e8cfd92
SHA1e8b33e55c564b024ece3efe33f8cf44c15f976cd
SHA256550470586c9006ef7725ef2c6edb6bd27d50deff5c78c01131c7b36ea0461428
SHA512581091b4c06b561ff0a2422d37eea40f4e24c50a56c6175635ba5df87f4ca71bb8a5d2b06de2e64fd06146325c07d388085a0d71962ba440b7514364607c1ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bdbed0f754d3f8a3ab4d3e8d46c5687
SHA19b670c1e6ad32a66365835137db84fa84de5cf4a
SHA256e4d99f304ee353128a3c146e71962568fee7c287d80a9c6296b76174f69e8465
SHA512558a0d0fd573050622aec88d870233269ea1894155087f25fd626388b64016e5e56698c3befce438967281ffb6ef9e54088af42a0fc64b6209556152fb4c09a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9ee25f4b241bbe002e976867423ae7c
SHA1d89f93fe1548800aa511cedb67ad850bcf311e4a
SHA256b3a9e6e36a5cf7422304448dfc54afcb625144a3ed5e37e9ca4c643d451c3fdb
SHA5129df3d898d70318cb516897cbd7b0ab9334e4fc1631648a08706181781f7f37ced64d39ea801ad794122a2d47e288908cc1c6de519f1489fbd176362078bb4aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50957f47371072f5701c9d4ec21ee16c6
SHA13d82ca1654ff8317cb58209229107bad370d48c6
SHA256086abb7f5951f8f008683eacc0940a8b7e841a83c20c6684b753dacab103ddcb
SHA5120cd83013dee78ba970db09e0dbcac64beab2a1ea258c3a77b20c7290f2b06d1f9b0fb1ec2728817475df24f63a2250585671a3aa55bbde574457ba8a5d322605
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b00db50079c950e515ee4765228ee15c
SHA1e7a75acefc904c49c61d9c2eff9946d9cd7d084f
SHA256a248447f4c8f6dc1cb2d0cba6cb54eecaf6ad5e2c6b486ebf4387cde3a423da8
SHA512453c180b5e8ad296f333e2e68ed9aa3a0aee88389a1db8fb19c98b533de518160faf2c0f97046bb010d04de458fa9442fa18053d77f84590fd2596f28e46ef8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565ae4bce45191bac33de3eadfa08e5a8
SHA1fd4bb851b5225ff12c90312d0a83b51feeb1cb0f
SHA25633a38a75872462f3f9f09124dc44796d4d65201d0cf920eb90129345406294a6
SHA5120faf74a642e5e4f8e447ea7aeb4edf41635fac91858921c067593af314991000c9138991ddee58c62138ff20419d68d4ff095e15c759fab516ae0f78b9a77de0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fe12191f5164038873b380e6fdb632d
SHA123226a1b44aeb8fd6f9c9bf30d7f86bf46a04705
SHA256da8c49216613275b49045da809aa34338c263d3a74542585cac6c5109c50214c
SHA512fdc2dd66ce5680cdb7ee2ad62552349638bfad83420a7552ea3b3cbc1988a01e8a083b6b0c6aae560357345ddff4984ee9a601f50a3c1f9f78a578eab0251aa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff03a16e78d3f5abbfeba85de0140ad9
SHA155b99b27e83350c7649e64b1f2b69f3b9130c443
SHA2560d23113562e09706367fa173aab391a5c67f18079a8ecdacc9f766dade83c91b
SHA5126e85604337fab1eafea4a2eecda99787a0109a84fcb3983e8d397ae25be8f61269a984f44f61e58328cf8e40dedbbeeebb2730d0a9bb01d5503c677d083740ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e515b226edd1da282d589df4dd9c47f
SHA109281f63276be0368b4b30659dbe92f7d7c7d481
SHA256d261caf15d05a6a89f1e107fead180fc27f2ddbad951831ccaf0c16ab1ba3388
SHA51287bcc09abc399c9b40a814587c3d3a112aeaf83600cc01948387a62fef92a56cecb00626eb3740f5221a5924e556caac9d5e2804db5ed4b1a8c1b5c168602f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acab46771a09b7532225ea92891413a6
SHA1cce48a5a5c6c29f95c43931522315a196054ab7e
SHA256c2eb32517e5be79ab4f0e0cec97c9d6550797e9adcc96bf463d2986e8c6672f9
SHA51289a63b475001b9f355a71c84423ecb91ad9ac205c9c5a1abddb37b339dc497e44a5d3b5a6ae644c6cf1b55d15bf30992137ad54ca546ab415443d5ddb3292231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513e6e89a6f7231240ae4d6ebdd69a36f
SHA18607ba27df8ec0df008bbdc6ee24e3b3e5c1e1a7
SHA256f7724f5e259254b72815d472595b216ee9596525adfab6ac2e458682a1c7612b
SHA5127a9bd45e1dc5f6523ef72c02f5d904c75074956105ad2934dc0d6aa1494f178124ac864701f1dcd93731b244b06f2064867ae60a2d9c04fb6dde44d596d3cb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f611144bf7698a340ef5e82fc5887a7
SHA1bd0c69dad4cb0c01f570331ddc3f41644368d61b
SHA2567d839c04bea1241b497eec2bc4520cf9fde38752b7313a23d689db982559abef
SHA512d371c0f357feb9ef20d7349deb77e78caf12ef3e863f99f181f4043a769bd40e7022fc8aec07928d24c227cf02c40741cc166137bbfd80672d3addce2331dc36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ac46fab07284426b82622c9c2626601
SHA13d1f8796b71a5e67109d3dff7e0426eed4243bc9
SHA2567dbbe8357840a86d32da78b66fe784c7997653f0942f840852dbeec8c2454591
SHA512e715bc890fcea525926975251c2fa30859991533fc551056ce4acb6b12e7a5bb3341f895999ab607bed79cd3432ec6c3b347dd5f9d455b04576f8d0c901199d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b9e576b5a611415a09fbb27c207661d
SHA18cfcc52ca2bac7ed7b729297d808476e84f72d4c
SHA256d4095f5e288057d891154281ef480c414adafe4352fe367c0ee1a63995110328
SHA512219fced2f7d77ffaad357be2157c39a4bd7250b0e48b06936477f9bfa6b264ee7b17eab7a942a90140a39293b528caa7ef4e1302974838050971596f7ee8b79b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f46bf9383750cc43964ea1c9b22c3fc
SHA1a149b6c545b4dc210cbc0619ccdde9f1af5e1470
SHA2560f80e71fc8549e95be00b12bc422ebbb4e1b37847306f92de69a4c8191594813
SHA5124fc23ae3ea92b2d45d2f012844d2b674f5044eb95065e7cced7762ec55d785d9653c9aed8cd2bb812ee6e474d15629de1d971f2e2c71c62d254b690c2c93c84a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c2431de15811179670b4f8bb487aa69
SHA139c678f62e577264628849ea352c34100138ce2d
SHA25635c1c5c97312e5f69cf762e5f73f0924ec3fc87d55bb936375e74138398a76ab
SHA512166bfc0739e866a9034a258f11f5652a8b14e4ac99ac039a5caeef5e05ef9546614e010e9d7befd72280d0b29e2fded2e94e33a1a688dfc6bb97fcd754597ad5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cc4f7109eeaf6ac1dbcc04d0aa6afe1
SHA188aa961caea5edc0b05d84ff31ec5adaf7f5b3fe
SHA256776254b40d66fdd92e2142d404c7c5895a32248ed02d2b8bd6443d3e6272341c
SHA51221763f8d127d4f9e6852c12601e60f8d938e4efca26dcf59ae52d9e331ee6e878e15f706b2b628d2083da3fe9cb7e2ca402ec6f8dc2f0db2659535ae173ea5e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e4a418e0e2bf6f5a166dc76621d172f
SHA151fb09c5755a2186c137658ae346fc7ec7914ba8
SHA2567855aa4b30c0058475c4a57a81518112e1989c3594200dc504a64db64a2475df
SHA5121f9f39bfa1a3c1c15d292987ce80de61657c3106aebd7c929c92cf8885bc9e370d097df596edb9b82b748859fde4b200e123db0796d323bcf3223a08d98d66a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6b618adfa0f0f14502e82945196b1f2
SHA1c40a5d8237d6c09c99b2039a558a027d318c229c
SHA25684a5702609b23535a58d0f4aed4df1ef6c59365bbb0e9a181a2cbcc9d367ea3f
SHA5126261dca978c22aa4e3b31654426698d675d974d6d5139dc2994848b4eb4de793621f67b9ea627dd75945c93d03d510792bda576cfc15efb27e8bd831c23a3d13
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b