Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
e32f892b798446443a77a4e206da0623_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e32f892b798446443a77a4e206da0623_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
e32f892b798446443a77a4e206da0623_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
e32f892b798446443a77a4e206da0623
-
SHA1
8102e88db138c5b98772a796add4214580a3b467
-
SHA256
9560ff52f945878d130b2fb99ebd92096b16c0840b7781026d1bec2d5fe23bc1
-
SHA512
2d77e5b5a547ef576c1db574cc35bfac36e4a8ecb0882d99f32afda33692f01a57a6dd64d1b74b19542c48d663ef6c6bdbb24d898963eed8530d6e5aba9ac23c
-
SSDEEP
98304:NDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:NDqPe1Cxcxk3ZAEUadzR8yc4H
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications mssecsvc.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1" mssecsvc.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3136) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 3904 mssecsvc.exe 3304 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4732 3904 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3904 mssecsvc.exe 3904 mssecsvc.exe 3304 mssecsvc.exe 3304 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe 3904 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3904 mssecsvc.exe Token: SeDebugPrivilege 3304 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3864 3588 rundll32.exe 82 PID 3588 wrote to memory of 3864 3588 rundll32.exe 82 PID 3588 wrote to memory of 3864 3588 rundll32.exe 82 PID 3864 wrote to memory of 3904 3864 rundll32.exe 83 PID 3864 wrote to memory of 3904 3864 rundll32.exe 83 PID 3864 wrote to memory of 3904 3864 rundll32.exe 83 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 612 3904 mssecsvc.exe 5 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 664 3904 mssecsvc.exe 7 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 772 3904 mssecsvc.exe 8 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 788 3904 mssecsvc.exe 9 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 796 3904 mssecsvc.exe 10 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 908 3904 mssecsvc.exe 11 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 956 3904 mssecsvc.exe 12 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 316 3904 mssecsvc.exe 13 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 372 3904 mssecsvc.exe 14 PID 3904 wrote to memory of 728 3904 mssecsvc.exe 15 PID 3904 wrote to memory of 728 3904 mssecsvc.exe 15 PID 3904 wrote to memory of 728 3904 mssecsvc.exe 15 PID 3904 wrote to memory of 728 3904 mssecsvc.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:796
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:316
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:772
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3016
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3736
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3832
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3896
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3976
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4092
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3348
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1068
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:2388
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3732
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:372
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1028
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2996
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:2280
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1268
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2760
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1312
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1572
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1660
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1884
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1900
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:1840
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2416
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3324
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e32f892b798446443a77a4e206da0623_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e32f892b798446443a77a4e206da0623_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 14165⤵
- Program crash
PID:4732
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4284
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2052
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2092
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:676
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3904 -ip 39041⤵PID:3124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5d8d7ce357ec73af62a77b8ea4d2b162f
SHA138e7abc1404e0d3693c511d575671b7239c940bb
SHA256f2cf9dea00cecf536634936adc5c18807846673e86f3c8c87cae2bda3f98fc57
SHA5121fa7b8e0557bddeb0356f816711c3d7f9cc67dade8adafacf0c69d2975d48faf209e603c418cb9070e5131298945ebad36bb257cea9b384679f17ef9ad61218f