Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5181d8b3d1488c0f58a8cf5bfc04867_JaffaCakes118.dll
Resource
win7-20240729-en
windows7-x64
23 signatures
150 seconds
General
-
Target
d5181d8b3d1488c0f58a8cf5bfc04867_JaffaCakes118.dll
-
Size
308KB
-
MD5
d5181d8b3d1488c0f58a8cf5bfc04867
-
SHA1
7b0c89d3d06c02b49f0a8a8affc7ebe2106ffd75
-
SHA256
79a92391e6dbcec703f9457d09588838dff2bd7425a2578e391b5faaecb6b031
-
SHA512
a2967c0e10c26e7912e754fe6e07f8d7eb5e984d9a5fce60e7fb15db030c522304a06215ef5172c2553aad8d56defe1e4eea2e0b9958a691eabe6fdf81df5f25
-
SSDEEP
3072:FYy0DkGJJo3Eu5pjkoxjZUcfiQ7lb3ST39tuoX2V8uCCVhHXcfYNLVzlDMy6cAF+:cHJo37xjyaiQRi79GV8ufHsfwXecA/U
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\ogteofsx\\wmlqyiyo.exe" svchost.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" orjlbhbu.exe -
Modifies security service 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" svchost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" orjlbhbu.exe -
Ramnit family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" orjlbhbu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" orjlbhbu.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmlqyiyo.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmlqyiyo.exe svchost.exe -
Executes dropped EXE 6 IoCs
pid Process 940 rvtql1X1e 1624 rvtql1X1e 880 orjlbhbu.exe 2792 orjlbhbu.exe 2360 orjlbhbu.exe 1592 orjlbhbu.exe -
Loads dropped DLL 9 IoCs
pid Process 908 rundll32.exe 908 rundll32.exe 940 rvtql1X1e 1624 rvtql1X1e 1624 rvtql1X1e 880 orjlbhbu.exe 3016 cmd.exe 3016 cmd.exe 2360 orjlbhbu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" orjlbhbu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" orjlbhbu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmlQyiyo = "C:\\Users\\Admin\\AppData\\Local\\ogteofsx\\wmlqyiyo.exe" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" orjlbhbu.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 940 set thread context of 1624 940 rvtql1X1e 31 PID 880 set thread context of 2792 880 orjlbhbu.exe 35 PID 2360 set thread context of 1592 2360 orjlbhbu.exe 39 -
resource yara_rule behavioral1/memory/1624-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-22-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1624-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/880-127-0x0000000000240000-0x0000000000270000-memory.dmp upx behavioral1/memory/2792-135-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1592-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1592-161-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtql1X1e Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language orjlbhbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language orjlbhbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtql1X1e Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language orjlbhbu.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 408 svchost.exe 408 svchost.exe 1592 orjlbhbu.exe 1592 orjlbhbu.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe 408 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 480 Process not Found -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeSecurityPrivilege 1624 rvtql1X1e Token: SeDebugPrivilege 1624 rvtql1X1e Token: SeSecurityPrivilege 2712 svchost.exe Token: SeSecurityPrivilege 408 svchost.exe Token: SeDebugPrivilege 408 svchost.exe Token: SeDebugPrivilege 408 svchost.exe Token: SeRestorePrivilege 408 svchost.exe Token: SeBackupPrivilege 408 svchost.exe Token: SeDebugPrivilege 408 svchost.exe Token: SeSecurityPrivilege 2792 orjlbhbu.exe Token: SeSecurityPrivilege 1592 orjlbhbu.exe Token: SeLoadDriverPrivilege 1592 orjlbhbu.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 940 rvtql1X1e 880 orjlbhbu.exe 2360 orjlbhbu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 2524 wrote to memory of 908 2524 rundll32.exe 29 PID 908 wrote to memory of 940 908 rundll32.exe 30 PID 908 wrote to memory of 940 908 rundll32.exe 30 PID 908 wrote to memory of 940 908 rundll32.exe 30 PID 908 wrote to memory of 940 908 rundll32.exe 30 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 940 wrote to memory of 1624 940 rvtql1X1e 31 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 2712 1624 rvtql1X1e 32 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 408 1624 rvtql1X1e 33 PID 1624 wrote to memory of 880 1624 rvtql1X1e 34 PID 1624 wrote to memory of 880 1624 rvtql1X1e 34 PID 1624 wrote to memory of 880 1624 rvtql1X1e 34 PID 1624 wrote to memory of 880 1624 rvtql1X1e 34 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 880 wrote to memory of 2792 880 orjlbhbu.exe 35 PID 2792 wrote to memory of 3016 2792 orjlbhbu.exe 36 PID 2792 wrote to memory of 3016 2792 orjlbhbu.exe 36 PID 2792 wrote to memory of 3016 2792 orjlbhbu.exe 36 PID 2792 wrote to memory of 3016 2792 orjlbhbu.exe 36 PID 3016 wrote to memory of 2360 3016 cmd.exe 38 PID 3016 wrote to memory of 2360 3016 cmd.exe 38 PID 3016 wrote to memory of 2360 3016 cmd.exe 38 PID 3016 wrote to memory of 2360 3016 cmd.exe 38 PID 2360 wrote to memory of 1592 2360 orjlbhbu.exe 39 PID 2360 wrote to memory of 1592 2360 orjlbhbu.exe 39 PID 2360 wrote to memory of 1592 2360 orjlbhbu.exe 39 PID 2360 wrote to memory of 1592 2360 orjlbhbu.exe 39 PID 2360 wrote to memory of 1592 2360 orjlbhbu.exe 39 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" orjlbhbu.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5181d8b3d1488c0f58a8cf5bfc04867_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5181d8b3d1488c0f58a8cf5bfc04867_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\rvtql1X1e"rvtql1X1e"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\rvtql1X1e"rvtql1X1e"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe"C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe" elevate5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe"C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe" elevate6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe"" admin7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe"C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe" admin8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe"C:\Users\Admin\AppData\Local\Temp\orjlbhbu.exe" admin9⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1592
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD533ace2a98e6aa56dbd6f1ae58a9af9ae
SHA167de6edab77318d997f002c9884dd08069612570
SHA2568bf10012bf59dbc3f6509bbf1dc12490779fc5962aa37fcebbcc434e2612371c
SHA512ea77d71297f7ef842f0c1c7b6f8eb53f8d6d3f223d4f5d2bb4214102601a1197f038a1339d5245ed87671947e90910b78cbe7081d05c0e5cedd55b0726e362f5