Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/installer.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/installer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
General
-
Target
7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe
-
Size
254KB
-
MD5
7e509afa2b8425b8c9618ccf20ca1f67
-
SHA1
1668fa3e73cbc91b3ccdf5d8977e16ca201d3ce2
-
SHA256
cad72d1d5aec829038a3206a3e5d55f33d2238d65541e7e660597be0c047d1cc
-
SHA512
ce5d596f194f306ff34ffb410e0676b1fc235b3f77d70ee60fe96603b95720275e9ce29915d5dfe741ccbd4ac7dd4b73147c799c481947a1db4f3094c458f311
-
SSDEEP
6144:FsaocyLCXr2QxeUPpbNdV0g74E/hJQAjDUfK9uX/:FtobcygeMp/OuLPQwQLv
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3032 installer.exe 2424 ins.exe -
Loads dropped DLL 3 IoCs
pid Process 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 installer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 ins.exe 2424 ins.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1740 wrote to memory of 3032 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 28 PID 1740 wrote to memory of 3032 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 28 PID 1740 wrote to memory of 3032 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 28 PID 1740 wrote to memory of 3032 1740 7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe 28 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30 PID 3032 wrote to memory of 2424 3032 installer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7e509afa2b8425b8c9618ccf20ca1f67_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\installer.exeC:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\installer.exe ins.exe /dT201305141625 /e5106646 /aSCANIA /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\ins.exe"C:\Users\Admin\AppData\Local\Temp\nsdB87.tmp\ins.exe" /dT201305141625 /e5106646 /aSCANIA /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD573c91338ca3968d94fa15ec72f5ad251
SHA1106c43de5262e43c3fc2f1585d53e51a1cbb6ba2
SHA256e62b5df07c0a54845940cf6105745077411cdd6e308553ac2dedb0006c521453
SHA512d6dd958ced6dfab683cf9a7e1875a3f614b2328d5281825ee5ef188483001b6f9365cdabc42c81b36d78bba0609d2223e2906d5f7c4505f4b1599137d12e8027
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F39B5CFACECFDE48DB25BCA2231FAC6_D73FEE3C4E574541538B35CF985ADB66
Filesize5B
MD54842e206e4cfff2954901467ad54169e
SHA180c9820ff2efe8aa3d361df7011ae6eee35ec4f0
SHA2562acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e
SHA512ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba
-
Filesize
604B
MD55a1ab1871c1dd0bbe715482943c74be6
SHA1da4ce17e39abb581883120980f00a91cb029127c
SHA2565fab31aa7540eaebb07d0315e540564b06d612b4b4eb3f2a645fd86a59e6b37c
SHA51288d80e7ffc33aadb7e28363aad82f51e78bc09ef3ef193a7acb867c825bf633b04bb623796e699262c2f1b40f339bc5277b5520f17d87b2d1f6724288330545d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12236C41CDDF9E40BA5606CDF086B821
Filesize202B
MD5cbb5f2387f8591efeee721d84236f5c2
SHA17f9e7d9f8488e420b3cfeacf03ec3318c12b7757
SHA256a71327e4768e0d99b9bdf88fbe9a554c3a61b1916e71b8d07dfd971d197be2d9
SHA5129d37c62a36eeac496ea3c840296d2cc324961f04664f18eb9f4d90b474467b33eee8d684910c7f461795d36e011daff04d649129f1929253a333c38d3695230c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_D73FEE3C4E574541538B35CF985ADB66
Filesize490B
MD5a69f4a23faaa2e6cd0c54d3e6e2e956f
SHA19d218b384655f51502714ce90c9596423de079dd
SHA256fa71f456dc2c4f3e2f26189795f3ca625e10d5c81b3f5ef2a7b8e105f52121f0
SHA512bc55659501491194c30e4b89c0fb388e7b74d98d541e24e2dc85cb651cf00203d1f8d5e2bb6fdf70d981ecad7d71760d1512b80ab2e19cb9420f64cbaf7265e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30
Filesize412B
MD5c513192d789240a37700c9a94568ca1b
SHA1c7f1934b3b21eb0bb259d9f9e80a03a54dd388d7
SHA256c7b907cae8881b8521eca38ee43f83bc154c99326db3f4cbf87e133f940c45b5
SHA51254745f74dc3ee2b3169a770b14f318ea3d974df9db13c49658e3d1d575f86a9073a621725abd78472c8026c5e0ad8480f30293d9ae8986a7a0f83e14d644ab3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B
Filesize188B
MD5aae5b8795a58c03a5424cb9b57c7dec8
SHA1e254620478fa3ae59861dd32e670c7b642bebc05
SHA256f01993a421bb2f706a55888530ea535f082ebaa9ec7d9feb0e0338b58089b718
SHA512f1534900d2e37f4946385d0aad3941d71e99be2e615a627b519d47ac855dcf4e084800dedd582b9289df886ecb1fe30117b45b8d3c68ec5768ff08fdb9beb1c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57f272ab52da68e528a08e26a5a1cd917
SHA12681c366df68cd2b3e2e9dc3ec567638cfd48cd0
SHA25622de4d63475522dcdda89b92303c70776ee3e6cbf31242b49767950b4a89fa6d
SHA512c89d885f66b6c0e88ffd61228d1fbc663b84a9769d5b4d444c80c6bdf76dcae09cf4cea66682572860124063a193ece3ae80acf8578b321e03b4b3151392ee2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9
Filesize404B
MD53985c0a7ee80a9e55e25df67cac0cf76
SHA1b28f3538867709d3b9321897637bda0fc4eaa386
SHA2569c85e0ed7519843a90889a350b9144502a6e223488f0946171e66bf87ec15aca
SHA512b7e58dd8dfdf6106899585b9e13eb3b7dfe3a859ae6a7a23989afc03c64f213cf28b205934ff1356f2de68b011a0b7898c013771554d177a61e26d7588f9d7ac
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
155KB
MD5150c2ea75d37ed3111f503adc5b6edb8
SHA187b2e37738818ddea292699ae26b2ac291ff1e7f
SHA256cdaff7706a3c4d46ae4afdfd675fce9b06bcdbe616073b92dc28fbf58c0b6adf
SHA512bcf0e1401d2f31b9bbd93bd3005716419c832c467fb76c21e40195ab38847022db387de49b4c7494780f04c511138631e2d8e1ac0e241bb835771bec72b815db
-
Filesize
198KB
MD57950260db65cd017c5cf1b925d2fcd83
SHA16695ec132f781e2cabf880fe25068cbe0a75a761
SHA2562b18da136c09287e5a8e29821b1301e11bfd0a8c7d5633b63a115681adbc9edc
SHA512ed98e20dc18c4fcb249d8a057cf0856d3cd48012218e95053672e8113c310e8f524b33139a6064e5593551e69b5db04a958bbda1a9aeca4b850b34a31e9f5356
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7