Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
f4e504e51ee324af035c1b5c1e363f18_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4e504e51ee324af035c1b5c1e363f18_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f4e504e51ee324af035c1b5c1e363f18_JaffaCakes118.html
-
Size
22KB
-
MD5
f4e504e51ee324af035c1b5c1e363f18
-
SHA1
67984d5147f4dd2adf440ae521d511dc5119bd33
-
SHA256
e8bfd61e08b9e4a42896730c1c01b249ad1cc0481f51f075d980db6c438e1c75
-
SHA512
6aa5d57ef8fbb1fc6e073800692c184438cecf8d3c9cbba95b08dacdab0877e5b13feb82bc9556dc984740c660c8dee05ea963681e9f2edc0121072afabbdaf4
-
SSDEEP
384:adYaNuA0obWZ28v5/u7ePXVvDRt6duYuCJKuY:+uebWZ2MuePXVvDRgUJCJKv
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433390312" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008fe404ec0edb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EC830B1-7ADF-11EF-9081-4A174794FC88} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000000c08b505605c09a9f1c3edca8d99a2f65abfa06a40190742203018ebcce45fe2000000000e8000000002000020000000475150514d902cb3e97813d665bb52d2bf13e12ce2f2fd9a7377c5b9f13b145a20000000326792f4df21463470c5a62d5040ea7545f094b755c4a3b502c193a43bfadffc400000008cfdd31c93a742a4c02499fcd3094454c4ad6fe0c9eda4cfe0fd55cf508ffca626545464d1d1d9c30e274a6becb107b6c5c8ef9d0537fb74897cad4fa8e2c989 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e25f7b36973cf55b722c17996e57e9c84d234128142310430063a3102489ffc7000000000e8000000002000020000000c6133829fead5c53669d5954168c744ade33d1b7168208b22af4aa1847c5615890000000dc2c00406044ecf188e3cf6c8702469be228691e50ac0dc11529bac8b5be42696d1d91783c3e0d79efec7e033f618c7e1fecb7690d0cd2814e3d9e7e1685458b9e934b2755728fcbe0e7024610960b1ea5e3631ff5d395658565519d6a5e03a243300461b57ac7270187cff25333d6968e7b1dc2100713e8dffcf61f3c22330cc82c2260609ee017b517cbf9ef8557e640000000992e26bbe340e6b8d784d674486386fa326796be71266d29597e7c055d5fafa4435dae60e83ae6f2fe1e6fe993db1780214f1c19d801d58ee27f60b49ba0ccb5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2396 2268 iexplore.exe 30 PID 2268 wrote to memory of 2396 2268 iexplore.exe 30 PID 2268 wrote to memory of 2396 2268 iexplore.exe 30 PID 2268 wrote to memory of 2396 2268 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f4e504e51ee324af035c1b5c1e363f18_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2e21af39c64aacd03688a6deff3b958
SHA1e9176cfb805dbbdd186f97eaa2b98b9f95def3d6
SHA2569f314e6671d3ce76c53ed95b935760112cccb510dcb540f47eca0cb7707262c0
SHA512d5225317ee2a160a547a2fe03ec7c01583eab1e8e35ce1c078d31b1b74eec6d2b2a801032f4de1abd58f4e6770c78027a616498d6b3562cc9a5199fb01c2d0a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52632d109d81059e63907b54351464920
SHA1925126f0a8b0d90396d79648b05c66263eb969dc
SHA25624924416574ada8b724614ef6a7844e3dc5c00363e918980da67f8bbdd5fc2e3
SHA512155abb3c033ec061c0344906d7d26bcc3aed262a37234f4acd6c46bd9269ce23313f6a2afc873fed476b1918580332046b11daf45c8e8d6c3204c44124142550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bb19f5fa81aff059f826b83e4984e5c
SHA170b6a2076df2586b9d47b25a66274bd63417ac27
SHA2569bba3610bbac1d63cf7a0623230303c8f2262f32b05e1d6161520c632b129dcb
SHA5129086d63d030136ac86d82e7e6701553b9daf19e8a1edf9cac58d0d345341896649c2ab38dd828bf3957b321c9029ccd42df50f30f047b3807e5b52509120520a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5293a048655ce516998896db44bd1b56a
SHA13418772cb49f082e5bc2d9e7f3b75ebe075a767f
SHA256926fd0982b4e57b284de07b7f4520032e0f51bc7c3d268ac37ba47f7d5f560d4
SHA51282452fbb9b130bae741166758ab7458f7f84efcb1de37652fbbdbf6f351832eb4f052f12566ba5aed4c4f6530bd4531f020d9965c34308f40a1dc3b10dc27925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a5ebbf1bbcb878d110ddf3c47664f76
SHA173d726c5a8403499b501aef91d626c9da71c91a5
SHA2560cc2622380e616eb1a03daa2e8f82cc0c590d20249e60ebb49b005e7337d1693
SHA512d180e9bf73031a63e50e873c8dfb57b09a7abbb63bf47b559ae4ffebb176d3b2bd9f00ac1d63fbdbc8cfe93886e2b05a4c4adddbea3e3b3e289265129827be8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f18715261b54ddbfa03e220a805595
SHA1e59bda46bace42b42a63ebe55cc9c75972d2eb14
SHA2560a7e39552bf4133c0329e1abc774e8e52e32ae7c987b7fae5204925b443949cd
SHA51246f1512e66a986df7433a1a12de88305b38304282f2a88f46f0ff541e72c9d74f18770e3bff7baa871a796370373bcb434d8252f7972fba22385755588b3d95f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c24082c2c867fd6c186ef6937ac84fd
SHA192e18ab80dd510200e9e71790de3dc75097d34a5
SHA256c068cdc813df74c544996d739c2118d0b44e39b4fff5de36c2a31c82c3dc7966
SHA512616e33ab38900bfcd995a881bbc26e58fadc755568de59487262237cfe4c7c546ebd326f1e09470d4f62237d432bc0450b82b71f966655f23d5bf95541d097a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ec1e3bcae31546716c6a49c719f0306
SHA1ea3a7161b26be3f413de48c94cd66c2f203840e7
SHA2565c9962fc98741946558fa141ffa10315bc4e64858fb3ceb0524d3b7408519c7d
SHA51207ae911c041db42fbccb56566739efbcd0425d281921ce5993ca3ade6b9643eced0ac1850cbc56fc21a570b99d7ae73b10428f745efca1c7c2b17c9e0e83ab42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a077981a71cebc06534d146273b8ddc6
SHA1ce7ac66508bb97f88dd38e09fa30846929c1ddf2
SHA2568afca054a4235e33d4ac7f4e9c8bcf25112ba0bb62fc8f9ddb23601b324722b6
SHA5123139a9da7e13512751b825cb3b3864ecbff333f39b4e8fe8734eda8fcdb9317442ed5cd044fb8e7b4f7513ea99cdd6ee6663da34e6ac67fb8117c38546b1c530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d596cc6890801c0165e5efba9fabe88
SHA1206c24170ceefe257d21c3f4cf8db55b89179c53
SHA2561dcee1d4b2975b0a9d6273be82a8fc94f304d9bd7821da57c8fc8db4d6237d12
SHA5124c4fbda64be023fa75ac480a70018c65657361c8124f59a7e012dca9cc443f01fd56f9a20ecb9ba384008c2b2c255718aafd25d1b1ea81387a2fc0337610f726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd6ef05ddf122ca98337ba05b51a61c9
SHA113bfcb6ffbff657ddddd625f04599a4bf9ad763b
SHA2562116616bbeb0eac2fb7a897f8619922fb30c4c361ecf6eb5fd2f2699b5a791d1
SHA51260bdde72c4ce0cc4a5e262b4ff12a3aac85a99af592a6b820519f5f3474c8f2e2f18a12ed0524260726bc3439ed4dbe570e3adcc5df410843af058e7bc35827a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513f237c3989c49130647f248c0a3a8e7
SHA1aaa886165325328c85b19beb052385faa392b965
SHA25637749f3bc51acc53b5bf29dd488d800b49d79793aa1bb070641cfdc3419e8e97
SHA51257417b5995f38f3285360234dcaf53f476883e9155bb5a3f397c4fbbbe7d4cb32cafc9740706c137d9eef9ee1b03933ebc8bb1b8f2edf85b72e06326d30814a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5911718b97cabfbf240859b0d5a41cf54
SHA1dfa17f70e0faffd5800989020da578f8563b69d3
SHA256f1240750752170a258ba276bad05c2f49ec0bfad81018753854381481e4862ad
SHA512950308b2b0e44f72c16bf38346c546946322e3433080169d94e7b314d8bcd1bf4a2d3cc0e8f6a7956d69da17e09c9c466600b86cc9b52ec0b4a15e7e8108ccfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e86348c4845338597c76016febabb85
SHA11044ac907f9c8520d5313e954901249d6d04bbd2
SHA25663dd9084667b100b94695892d54acde79eb26514f8f143a527ac4ede45d5a47d
SHA512d853828fedc43e9da364b4d0c246436058740180edb09f1bfb0fc7b2a6c29b12765a11dcaf201db332fc563dc68d41f6b405aecbc0bbb4558f0252c9085d3226
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a2360b171060f1139d9cd5b1b314bd3
SHA1c159988b5eef9cbf449ec42428a9952d5c836022
SHA2564046bb5088b128d6b6c6923b93299720277c84c4b93a9a419f59fc5fdaec3ebb
SHA512268d3f5650d527ee4047dfa28f2dd22b90d3069e20964920976941a16775c8754219cbf3ff5ad02990be4d4e4c846688b834037d052f4ee76925f55321f42182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545b078d7d8bf546da00bb3dca399eddf
SHA1f018bfda72619dfec142cc161f0cf634655206cb
SHA2564ae3e97c91a12a7dbe2ff91f94445829885a72d2a59764284f4c62fe9b236139
SHA51233bcaf2fb6d9f8d1e7242419c6602d500b420187ee17978547fb964c260855d378688eba03697f30c9a6e469137bba6b42b2b55af9095de7f22e7aeed2fb2a3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565f61f4e337243bdc080c4f420167417
SHA167b2ffc5393930bd07c697082b7cf98e97b5543f
SHA2563d04f893a23d7531cb691aa4cb23251f726c3ec1c19cff160f619449818875b0
SHA512f5a5c256aba7edfdf580b7256456137987efa16b8e6bc771699674eec30cd7d088af7df02871bdf9bc1865cbad53dd549e24e4fc3bb046108e4afb83b7415a82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536244c1166b0b78fbb156b5dd91b06c8
SHA14b146004a94eb2403eb8a669c31e9792cee9004d
SHA25604e08b3786403ba0097615d1a7ec5f437ed590100a3a821d706938e898772c32
SHA51283bc1ab2cf6273d405ff320933ec5dca89e0de0c58eff0564d0df216588f917789e1991e473c882e7f07862af05475d049cb1c4791edfbaed308bf96abda9bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9396679ed064a3f25577a39da268b9d
SHA13baa257c1388399794e2f1c65b2078e38aec99df
SHA25639a9477b473a4075a56815a9fea40064b8c7ac2931ef89226e619154f8402b31
SHA512ffea2eb1aa6ecb7d9c4cc5f2f2f2555bb6370abd07b1167505587b87a82e04864b92d645f506c470c3fe964a54732079bc21db23e0ebc78b27997138b81c8017
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b