Overview
overview
10Static
static
100486218577...d9.exe
windows7-x64
109bfd15145...11.exe
windows7-x64
9141d93e2d4...aa.exe
windows7-x64
1016c2807567...55.exe
windows7-x64
32f41c73046...95.exe
windows7-x64
103e275093a5...01.exe
windows7-x64
10419a809f42...89.exe
windows7-x64
34b10fd0d5e...58.exe
windows7-x64
104d78c439ed...f7.exe
windows7-x64
74f7713dcf8...63.exe
windows7-x64
7597deecbe6...4d.exe
windows7-x64
76b59edf464...e8.exe
windows7-x64
87def3cd43d...d8.exe
windows7-x64
796ba85326e...8a.exe
windows7-x64
797f1b6afb2...2e.exe
windows7-x64
59906747639...1e.exe
windows7-x64
19e1609ab7f...08.exe
windows7-x64
10b7fc91fc1f...37.exe
windows7-x64
7bf179bbd2c...25.exe
windows7-x64
3cfc68c40f4...4f.exe
windows7-x64
6e6e948a0aa...eb.exe
windows7-x64
1f02fe52119...68.exe
windows7-x64
8$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows7-x64
3secrehosted.exe
windows7-x64
3Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
27/11/2024, 09:28
Behavioral task
behavioral1
Sample
04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral3
Sample
141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral5
Sample
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral7
Sample
419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral9
Sample
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral15
Sample
97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral21
Sample
e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral25
Sample
secrehosted.exe
Resource
win7-20240903-en
windows7-x64
General
- Target f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe
- Size 6.6MB
- Sample241127-lfrx3atrgr
- SHA256 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768
- MD5 466b6ffd9a2098925c8727c60099626f
- SHA1 9b1bef96aa713e21b0946506e2fcb6cede4bfc0b
- SHA512 005b6feed62de8a274ba5f2ef7904a0263e513dee18995a04cc4b5fbb746bc094bfd06f56f4aa8ef5e89793bc958a37d1bdb0c57327dae437f1ecb36b4534307
- SSDEEP 196608:wjB8ZML/cWcIjvuK7qtigyegsZPc+3ZGe74rb8cWEDc:wjB8Z6cOv17qisRXcPWE4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
pid Process 576 secrehosted.exe - Loads dropped DLL 6 IoCs
pid Process 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\parameters.ini f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe File created C:\Windows\secrehosted.exe f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe File opened for modification C:\Windows\parameters.ini secrehosted.exe - Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2904 sc.exe 2784 sc.exe 2680 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language secrehosted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe 576 secrehosted.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 576 secrehosted.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 576 secrehosted.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2716 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 30 PID 2668 wrote to memory of 2716 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 30 PID 2668 wrote to memory of 2716 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 30 PID 2668 wrote to memory of 2716 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 30 PID 2716 wrote to memory of 2796 2716 cmd.exe 32 PID 2716 wrote to memory of 2796 2716 cmd.exe 32 PID 2716 wrote to memory of 2796 2716 cmd.exe 32 PID 2716 wrote to memory of 2796 2716 cmd.exe 32 PID 2796 wrote to memory of 2764 2796 net.exe 33 PID 2796 wrote to memory of 2764 2796 net.exe 33 PID 2796 wrote to memory of 2764 2796 net.exe 33 PID 2796 wrote to memory of 2764 2796 net.exe 33 PID 2668 wrote to memory of 2676 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 34 PID 2668 wrote to memory of 2676 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 34 PID 2668 wrote to memory of 2676 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 34 PID 2668 wrote to memory of 2676 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 34 PID 2676 wrote to memory of 2904 2676 cmd.exe 36 PID 2676 wrote to memory of 2904 2676 cmd.exe 36 PID 2676 wrote to memory of 2904 2676 cmd.exe 36 PID 2676 wrote to memory of 2904 2676 cmd.exe 36 PID 2668 wrote to memory of 1652 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 37 PID 2668 wrote to memory of 1652 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 37 PID 2668 wrote to memory of 1652 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 37 PID 2668 wrote to memory of 1652 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 37 PID 1652 wrote to memory of 2784 1652 cmd.exe 39 PID 1652 wrote to memory of 2784 1652 cmd.exe 39 PID 1652 wrote to memory of 2784 1652 cmd.exe 39 PID 1652 wrote to memory of 2784 1652 cmd.exe 39 PID 2668 wrote to memory of 2588 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 40 PID 2668 wrote to memory of 2588 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 40 PID 2668 wrote to memory of 2588 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 40 PID 2668 wrote to memory of 2588 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 40 PID 2588 wrote to memory of 2680 2588 cmd.exe 42 PID 2588 wrote to memory of 2680 2588 cmd.exe 42 PID 2588 wrote to memory of 2680 2588 cmd.exe 42 PID 2588 wrote to memory of 2680 2588 cmd.exe 42 PID 2668 wrote to memory of 2816 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 43 PID 2668 wrote to memory of 2816 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 43 PID 2668 wrote to memory of 2816 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 43 PID 2668 wrote to memory of 2816 2668 f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe 43 PID 2816 wrote to memory of 2572 2816 cmd.exe 45 PID 2816 wrote to memory of 2572 2816 cmd.exe 45 PID 2816 wrote to memory of 2572 2816 cmd.exe 45 PID 2816 wrote to memory of 2572 2816 cmd.exe 45 PID 2572 wrote to memory of 1924 2572 net.exe 46 PID 2572 wrote to memory of 1924 2572 net.exe 46 PID 2572 wrote to memory of 1924 2572 net.exe 46 PID 2572 wrote to memory of 1924 2572 net.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe"C:\Users\Admin\AppData\Local\Temp\f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C net stop CompxtsService2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\net.exenet stop CompxtsService3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CompxtsService4⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C Sc delete CompxtsService2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\sc.exeSc delete CompxtsService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C Sc create CompxtsService binpath= C:\Windows\secrehosted.exe start= auto DisplayName= DrveService2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\sc.exeSc create CompxtsService binpath= C:\Windows\secrehosted.exe start= auto DisplayName= DrveService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc description CompxtsService ServiceManagerForDrivers2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\sc.exesc description CompxtsService ServiceManagerForDrivers3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C net start CompxtsService2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\net.exenet start CompxtsService3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start CompxtsService4⤵
- System Location Discovery: System Language Discovery
PID:1924
-
-
-
-
C:\Windows\secrehosted.exeC:\Windows\secrehosted.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\parameters.ini
- Size 220B
- SHA256 fc8636f6c23d345622992fa37650e24efef646987fef2150e42391c03d061589
- MD5 80e46e47466d7b829d70df82858072cc
- SHA1 f48a69048de7184e200cc7023aed44234bdb6c8f
- SHA512 7d9ec20fcfdce3f57cc4535192de96a0dd546c81b380d5aa7e5bac1d91f199168d94384e7b1f3adb06ee33dfe999a7d8eea09c7f6966ea0cac80935fb244e914
- MD5 SHA1 SHA512
- Path C:\Windows\parameters.ini
- Size 266B
- SHA256 893a2c40352e5b3b690d7f90924760a890999046c542669b5d769b802c9e4f0e
- MD5 4b7747473dda99b841582267d3ccc82f
- SHA1 0da919fda8dadd8c9e99528013597c17dfc8c10f
- SHA512 5f49914f0f4e73db6d78d48dca6dcb1d0516fc0ca7ecd9f4772839b7020f219da90b59cc707dfb286a489afabf88adb7bc85579d318b24992ed86d33cfa04a85
- MD5 SHA1 SHA512
- Path C:\Windows\secrehosted.exe
- Size 6.7MB
- SHA256 0cedeb6633fdc8079cde76d2cc72bf98f0496c0dd644a7f215e59014b3dc5f4b
- MD5 c1b7d5a866e2c21c7bc6222328638cfc
- SHA1 3c09adc17b23ec529951d467481afd495d227cdc
- SHA512 7e47ea282cb82f003c92565ff9dc9d1cfcdbeeecd8668565eaecd4ef99e609083b3a0192bf01e8e13b467b53e266157cb61cc13c77f1ad169cec1cd141a28814
- SSDEEP 196608:3YvW2URVICtO4SS2khNmunJI036/n+WWYBB:qWDkC8kTHKPQYP
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst5CA2.tmp\nsExec.dll
- Size 6KB
- SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- MD5 b5a1f9dc73e2944a388a61411bdd8c70
- SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nst5CA2.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512