Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 07:31
Static task
static1
Behavioral task
behavioral1
Sample
11310f390d2f0f67c0fce3a325500679_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
11310f390d2f0f67c0fce3a325500679_JaffaCakes118.dll
-
Size
166KB
-
MD5
11310f390d2f0f67c0fce3a325500679
-
SHA1
0785526f7ca25a883ed0f134adaf2e70c413bafa
-
SHA256
a602fe8f53d36f4eab3123e2b0a4d75423250566ef909e0e0d0642bff5bab8d3
-
SHA512
7c29bb0f6dc9def79a88ef3e5275cf3b1f8871a45449b5c93e40b547b8b11f3fa9dfd60908e8d49589fa8f6bbd9b2f6636e499c88f60887f59c472036958d228
-
SSDEEP
1536:O5lTUKCYmCgV5bT/2d1QYebAvf/PqhXnzyP5xC1VXfbJpeU4KyQ5G0OYvVkoV:ATU56gVxj27NeUHHCRQU4S5GBWVLV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2136 regsvr32mgr.exe 2616 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 1608 regsvr32.exe 1608 regsvr32.exe 2136 regsvr32mgr.exe 2136 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/2136-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2616-35-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2616-40-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2136-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2616-567-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmprph.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoAcq.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscene_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe svchost.exe File opened for modification C:\Program Files\BlockUnlock.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfr.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\MSOERES.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2616 WaterMark.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2616 WaterMark.exe Token: SeDebugPrivilege 2104 svchost.exe Token: SeDebugPrivilege 2616 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2136 regsvr32mgr.exe 2616 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1532 wrote to memory of 1608 1532 regsvr32.exe 28 PID 1608 wrote to memory of 2136 1608 regsvr32.exe 29 PID 1608 wrote to memory of 2136 1608 regsvr32.exe 29 PID 1608 wrote to memory of 2136 1608 regsvr32.exe 29 PID 1608 wrote to memory of 2136 1608 regsvr32.exe 29 PID 2136 wrote to memory of 2616 2136 regsvr32mgr.exe 30 PID 2136 wrote to memory of 2616 2136 regsvr32mgr.exe 30 PID 2136 wrote to memory of 2616 2136 regsvr32mgr.exe 30 PID 2136 wrote to memory of 2616 2136 regsvr32mgr.exe 30 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2708 2616 WaterMark.exe 31 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2616 wrote to memory of 2104 2616 WaterMark.exe 32 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 396 2104 svchost.exe 4 PID 2104 wrote to memory of 396 2104 svchost.exe 4 PID 2104 wrote to memory of 396 2104 svchost.exe 4 PID 2104 wrote to memory of 396 2104 svchost.exe 4 PID 2104 wrote to memory of 396 2104 svchost.exe 4 PID 2104 wrote to memory of 432 2104 svchost.exe 5 PID 2104 wrote to memory of 432 2104 svchost.exe 5 PID 2104 wrote to memory of 432 2104 svchost.exe 5 PID 2104 wrote to memory of 432 2104 svchost.exe 5 PID 2104 wrote to memory of 432 2104 svchost.exe 5 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:2180
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2128
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:836
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2132
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:956
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:1020
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:348
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1052
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1976
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:3032
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\11310f390d2f0f67c0fce3a325500679_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\11310f390d2f0f67c0fce3a325500679_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2708
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize206KB
MD5c6d206239e8dbe279dbf59388cea1896
SHA1e86a5c93357a0d8f60ce3342779a19bc6e0f5d40
SHA2568435644096fb217a93a89d1c10b09e14762d2cb41775b74ea3ac4cfdc04ec085
SHA51233cb205bb88007e1848c3adb945466ff70f4cb894a450653f6021559b88c3aefaae5920792fee19b36d34a687af9edee977c6caeba0f227ff0fd5e702a40717f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize202KB
MD5795030d68f3acee71af7284ccbb2c8bf
SHA1aa13c87a9a1bb84e7742d0004f4432a79053de7a
SHA2566268f12316500416ebe22b656d01636ecca4098310434fcf17d38cdbd90e7cfa
SHA512b24501b0def500f47ab882247ca586881b52caa58c03d5da26c35de8cf1284a408015e0d056551e7a81d343b6624b64f02bfbee9dd40b9f1c1cccf9fd0417801
-
Filesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837