Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
fa889c3653f0221b49e28b04830673a1_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fa889c3653f0221b49e28b04830673a1_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fa889c3653f0221b49e28b04830673a1_JaffaCakes118.html
-
Size
8KB
-
MD5
fa889c3653f0221b49e28b04830673a1
-
SHA1
86880f0519b1220e6d8b3fe0f2b57c3180fdd7b2
-
SHA256
49393ae252a09ffdec3f66eed12cc94a9e1075597e7af2b44599c5f21fd10486
-
SHA512
49456d54a3f3db18f3e17d5e1d2d192ca963548428faf88f39c7663abf6d7e02cbc862e6f41238bd1143166d8a532861f2b168c80de5133c1c0b137388811504
-
SSDEEP
192:/pub3nLmLnsLiEiL9biEio/5vXHoF4vbJDJH5DP/v8zk:/pubXSKiEidiEio39lR/8zk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a73394e510db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433607451" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000000a5d577c9fc77278d7ccca5a808bf0a668a9c86336b9c98adeaddf00f173e514000000000e8000000002000020000000c10d0b6c43bf65f24e74649d17ef624015cf0b34ed8acb6218f635cfea21bc6020000000ce9d25b1c747af082342d427bb16d7154d335e2116d039b2d7a567f15aee12b44000000038cf28b426f67c05845bb17e99fc43e9ccd9a7d3297a1daccdb7977ba50537248457b4178aa3955d0a147ce097c830bfdd43a0a0915694d8b2d5665f070cf9d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFB63BD1-7CD8-11EF-8C85-523A95B0E536} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000f0d81070fb5a36ad6fed725abb4172881191b830b28b9da2d5d8d80fe0af9aa3000000000e8000000002000020000000b59c2bc4c195118102cd3c4c2ff72286f2bc74b630a7dfd6a9bf572884b0a59b90000000c73a098eae22f12ea3c2338e7ab26ae80b063b9508b4d090e899e0fa5c6fcc26ea6a12028c55a2b359ae1ee59d4ffeedb3433ba691c459b504ffb346a0fdaca3527c8188c89f57d49dfdabf9ae89b70321eb21a7c2259412a66f7b973e777213a1d369f5c05a77dca5d02f91c207554acaccf08a9711133a269489fce2d4342cfd764973350823a335136d22a842481540000000ae978b5b121d7fa20e90470154f82655d191badd304c1b9f0eb2cd0056cd3fc194039af5fec06e83b100b9a41f262fa325bdea37b4f7062755071d571c4a895b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2400 2384 iexplore.exe 30 PID 2384 wrote to memory of 2400 2384 iexplore.exe 30 PID 2384 wrote to memory of 2400 2384 iexplore.exe 30 PID 2384 wrote to memory of 2400 2384 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa889c3653f0221b49e28b04830673a1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55488c27beb0a2bbe4ff8a88bccb1c43a
SHA134769f72fb52d73ec93e7af09970a2cf34fdbfdb
SHA256da11b5bc3ac8fa6edfac477f2b5da93c7c7bfcc77bdb71f1b8b1b1401c627e97
SHA5127c6cae7eb65824948a4f4fc03e8daacfa795d5296093aa9bd26acecce44a76cb3d4ea8936a516f7f94cd7a40006ff13e3dcc66a09c2e3064f86e3a3d2c010916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bd8c058f426ab880aef119f75d13676
SHA1db258b9cacf5ad45d41d646837d85aed0b91eee3
SHA2569e66360bc65d757992f2029c1fbd0d7100f3b1019dadc9e8140803f585d1cbf7
SHA512d810e15be525d71e349da73fe2a7c3be8ef13a2be0811255c7ee8e5c862802046d55d8ae509e0c2ba38f4e7b44809de6898c4204fc183ea25de095d92e1ffdcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552be8dc1a4aa08e6d35c4c8bf0320d27
SHA1f49d452729082e437356a74f1910c12019bab88d
SHA2564f1071ee34688686148c32a59bedd30bf36ac6adb5b2cacebfc2b54e9b7386df
SHA51269e75cb21c3275636a34f6180a63c10c1d6c64a8d2c080d4e9a90eeb5bfd8499813daaeb6ca945021447980ad14ddf7557d8b3c2430af592bd7ec42b91aa25d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dded4d5e62e450ffa673ede1b40d0919
SHA1b2de19da39028044de39ce70a463bd13bda4d1e8
SHA2562eb27ac646b732e385950947e4ac072a2ac6b682c38e384b2cb68e4273c547a2
SHA512cc9088e2ec249ac17ec25439d139e46540881ef3e11ed5d7c1a3cfb4730a3e37b1438e21c170751cce8a3d5cae95f05e166950e7acf5cfa7158677f8c6bc61ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab8d833c30514c959605bdffc86f3bf3
SHA1387ee839b83d1f79d9d81c3f173a32761aa880d8
SHA2564bb3f09ca10ef0eb91c8cce4bb0feec74b039431934a981ebb2dfa4b26b3d705
SHA5125a549d746507c730a61f95fd0ec7b71115469ddf6b9e63a0c7c88344cc13ed280a107bc1f9774b75cb9b83f083e961326168ab104350872ed0e30c798c9fb422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51246637d4144d2fa47e520ea38a0e867
SHA1656cf6325b0796531ace840f85f5b3fe379b893f
SHA256238b23464da4d173722e684ac96d45eed79319412dd334737e2abb355d9a2570
SHA512315433993eada00790eb1187a29302196d72ec6f08e1a11551ba8bfc9e042454b2a6acbc590725880eed2e9d94639edd655e0ba73f86193042af0cda0cda05b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58121cd4d6c418e56be50776e89870b87
SHA18c86f1656580462918b669abae003e41c13da121
SHA256075f8b4b4658fc7df600010ca168a6c9af4e1a405acb34b3ae0bb1868e406c96
SHA5125c10df978ab1b85bef1942ab203c3d064dc067cea1b358fcca1f3cb4eee1b325b72a914af5ece8792c46fbdd57d8450fb8b7cc3a144f809295aec01c2e44e7c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f2cc11c8220e00ee38811c7bfa10037
SHA14e9476c4d72ac4fd633b25a8f75b209142d31bcf
SHA256cda403f890d828496796f9d9b3d9677b49fe453eb7ec76c30b8d7447dc7d0bd9
SHA512de13ffaeef626c617582d5eef09b454f2ec9459e75844748b37f0881232a1bcc071b95fa0dd2948d35b47102b86d5cbdfa76a1e62e20b11d47d0c0128d8bb8fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8173e4c7903c989c44d7f7e8bc0b0ab
SHA1bbd74f92475c9d96149be236e481e0b3dd04e15d
SHA25649c15d99897089c3a7279deaaf5d47f6789f2a9df97123caf2523a24a0ec3821
SHA51257059cefe9cf079ae4c880c00478674aeeea0661387d20c0b897eebf82f4a8c16603b6b412dcbb33aff50d3151107b0c90c2461109320b20de1494fa5c632dad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586acde19abf25f46f814c66b1321919e
SHA17efadf8f3ceb724aa2b0ebb0636b0df0f5336e84
SHA256ecc113a02180d72290f93c514fc5360f81f981112320b5e06757a908132f0f12
SHA51206dc386c3af785544cda887e903e8ffdfb6c8361d0b7d81a470ca1f68516fb46e014e1065ecf5462b628619bb5142d2ae7e176957b55c6499b2702ac31902628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51554ee54f0e803beddb6b9500c4dc80a
SHA12a637fcf1f5c32efdddedf3b968541c4987a31fc
SHA256df9699d96db6e360798dd9444d5f4e57147b42cbee8c5bcc9967765aa7144d75
SHA5127a9226d882383dc41ec98b0e84b9fc218251564383d854eeb65e35db9efc5e19ed17f00024cfb119476630eb58894029dddf8ae5be163f83c0cfd207c2d02e5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a647bd75e028afa50fe07c255c1f5ea
SHA171222515fa342f94c613071d4e6199abd040ef0b
SHA256f17a5fa1f7a7161ff7aa0eb20a30b65524447a10ac2fcd3483f2383e7d40f980
SHA512b091bdc79430bf055f618b3dc630d15226b0f9843180e280f70b8622866453d38a9cfef563ebb7820cf2639c7b6e11468113a18efc972262f0c27212a55ae617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520ae7f9a9d734d52aa3bd098912f0378
SHA167dec865437d18cc112c892c6dc11d9b2f45b58c
SHA25614108ff63b0d235ce81d0e6beee5d2e9613a1c312bd32551a2d8cbeaa01bcbee
SHA5126d6dd6dcdaa762746b87578695b7aaef70ef6c58ab6441cfcd749195294b1002076337463cbe9217d6008dcac1ebce270b461e92d27763edad32a6bac70a6844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f8fa2085f437402b690e5505fb124e
SHA12744745c4ce7ba353be61753399a7b9a787ec5ce
SHA256bf477c6b2c9b3846ee0c3ce321507ff551fc2ca01689046a6d950a224908923b
SHA512b4917a8c76b2b5e87382977195c8013bb50d8bce350ea9fb8bca4cbde24bc39002af111ebed969625646cace7d3ab97d68ec1377ae705de6db8e99fd49ab7725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5549982b66a61f639a5cf2740f1999e05
SHA1de31dd33f672d41ebdcc6912cd7824fed702378d
SHA256b2bcfe65c5d0f2a4169dd9b594512cbe5a640369b1c7bc7d2f2fa3fb6b5277d8
SHA512951073f4c6dc475ffeb3ae168e19c571916f5eb843f7d93cb7c6dcae15c99dcff8440bc7d8b01bc39f5cffcdbe5895a5b40f253193f336636763d273fdcefb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5212f2d887714a9c05974facacc028453
SHA1b37fb52b3a20b4b84489f1672ddcadf3ce52f44b
SHA25667c99bdf71e82573dce3e28f84a3a699df7bafbd43176acbe81235201fdca27d
SHA512904a83c980b2c8f19b9160221cbd7c5c892e63e821f2925d05fd7abc13791afee05d18e7e6a0804f7a1ba09ab7f4029aae458b2b8913a9b8e5d5042ad9e230bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c519279cf97d54dccaa7ce8895ab1b47
SHA1fefceff3ed58785f908cff5c75b6e7526079ff2d
SHA256f0521a66f874fd260b661e7dfca65f8589ecb70220244fe1de00a4085e727aa6
SHA512555ea444c83897f71cbc977d3fe4aeee88d36538088bc3e46d9b9ae0691f249a00f2bc3cdaa30803109da5e782e7ed65b16c6dd2f3e7579b4270c8b5bab1e007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fab2f732839daa346e7ce084d0e67e06
SHA1f8957dcfa53ccc9bdc2f6777f1cb2038a7e78ad7
SHA256f28506eac6a8604d96fa8f19e213653210ab67e89e14873bd27f3faeb76cb7f9
SHA512966d6ff831480db89fec3147221c96cc83ac0e406afa3f6f282a4288a132a2033cd1c3bc83d6ca633d23f2a8c1717d633bc965b5c9b6666a7f519d5c4353748c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548a1057ecb596d505280ee68e2dc56e2
SHA17772cc42c14259dc1e003920cf73ce1a7b290fc1
SHA25601f0500742987296b6d5b577ef966beadec551161551b90d71bf6e3f6b98fb54
SHA512a5f045749da3b6d02b882297ae40cdd1a300d69a461cdca7ef490e21e50664bb487d74b086a27b7c1ceba76d6757428db5077493d97f5394b23154d4a8defb08
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b