Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
aec2d49eb06a8dd0df471b15fbab97e0
-
SHA1
e846344e2455023cca62c449a8f9ab682ad156f2
-
SHA256
fce1a25fa617d0367944a2c8e9b5b9c359c12ae12f0a00694086a48a05476707
-
SHA512
d52e7d2b3f72f26406f8860b03c9cf45e5ad5f36778227f9f63bab11b0510773184c596161cd8f0b8697a618b73991aee88ecd6fadb20ba8da4f64a8b9616043
-
SSDEEP
49152:4nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAZ0vZ6GIk:oDqPoBhz1aRxcSUDk36SAc0B6GIk
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
mssecsvc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1" mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications mssecsvc.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2668) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 1 IoCs
Processes:
mssecsvc.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS mssecsvc.exe -
Executes dropped EXE 2 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 920 mssecsvc.exe 2348 mssecsvc.exe -
Drops file in Windows directory 2 IoCs
Processes:
rundll32.exemssecsvc.exedescription ioc process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4480 920 WerFault.exe mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
mssecsvc.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
mssecsvc.exemssecsvc.exepid process 920 mssecsvc.exe 920 mssecsvc.exe 2348 mssecsvc.exe 2348 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
mssecsvc.exepid process 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe 920 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
mssecsvc.exemssecsvc.exedescription pid process Token: SeDebugPrivilege 920 mssecsvc.exe Token: SeDebugPrivilege 2348 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exemssecsvc.exedescription pid process target process PID 5008 wrote to memory of 4528 5008 rundll32.exe rundll32.exe PID 5008 wrote to memory of 4528 5008 rundll32.exe rundll32.exe PID 5008 wrote to memory of 4528 5008 rundll32.exe rundll32.exe PID 4528 wrote to memory of 920 4528 rundll32.exe mssecsvc.exe PID 4528 wrote to memory of 920 4528 rundll32.exe mssecsvc.exe PID 4528 wrote to memory of 920 4528 rundll32.exe mssecsvc.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 612 920 mssecsvc.exe winlogon.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 668 920 mssecsvc.exe lsass.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 756 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 764 920 mssecsvc.exe fontdrvhost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 792 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 892 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 948 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 64 920 mssecsvc.exe dwm.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 528 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 680 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 680 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 680 920 mssecsvc.exe svchost.exe PID 920 wrote to memory of 680 920 mssecsvc.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:64
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2788
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3888
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3980
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4044
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:1356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3592
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4512
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2988
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:528
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:944
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1088
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2768
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1232
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1308
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1488
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1600
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1648
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1888
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2044
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2120
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2216
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2792
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2804
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3468
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3576
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aec2d49eb06a8dd0df471b15fbab97e0_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 13405⤵
- Program crash
PID:4480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3292
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1292
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3100
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 920 -ip 9201⤵PID:3848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD56d3372dd43153473617ab7c373c44920
SHA1fc35e58c8cd08611a2c71723af32e0ec55eaddad
SHA256b9df76897340af196874f7ec7e43592909c82046068bc84bf76bd3cad2c2f602
SHA512ae3687c50f3ce1d581f40ac3bc8ac8597284dd2630bc030d83183561d5a224417d07247b6995699c8584372e254ab99ecb6652205b4216518fa90ca2201c74ff