Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
General
-
Target
f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe
-
Size
5.7MB
-
MD5
f9ebb626e7cb5645d28d3afdd60f15a0
-
SHA1
fcbb902aba8354d948a6b956a6af8af9bcadb604
-
SHA256
bd71d73f17ee2d2c8e8344a1ee79af3d0d8df501edc46704bfdd9bc674e0e3a0
-
SHA512
1fab663d58817042f3de93191b1751e1aa212c7928618a10e13cd5a1a8fa08a299cec2ae9639201033e127cb1e2d0b6ec3c68f6b9a3503d5e9b37ffb01d9c434
-
SSDEEP
12288:DN/ihOYTMXypyrfSN3guZfR7nGHOKZmPLnvLn73m8L/yrfimxItJGkg7SDuw0YoS:R6hN4XypEfogGTtaLSywpYDvERFR3mnm
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Drivers\\sys.exe" f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Drivers\\sys.exe,C:\\Windows\\system32\\Drivers\\sys.exe" sys.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe -
Drops file in Drivers directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\sys.exe sys.exe File opened for modification C:\Windows\SysWOW64\Drivers\sys.exe sys.exe File opened for modification C:\Windows\SysWOW64\Drivers\ sys.exe File created C:\Windows\SysWOW64\Drivers\sys.exe f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Drivers\sys.exe f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Drivers\ f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate sys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 1656 sys.exe 2180 sys.exe -
Loads dropped DLL 3 IoCs
pid Process 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 1656 sys.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Windows\\system32\\Drivers\\sys.exe" f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\sys = "C:\\Windows\\system32\\Drivers\\sys.exe" sys.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2100 set thread context of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 1656 set thread context of 2180 1656 sys.exe 33 PID 2180 set thread context of 2716 2180 sys.exe 34 PID 2716 set thread context of 2824 2716 explorer.exe 35 -
resource yara_rule behavioral1/memory/1688-2-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-3-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-4-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-5-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-6-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-7-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-9-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-8-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/1688-20-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2180-29-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2180-30-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2180-31-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2180-40-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-44-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-45-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-46-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-48-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-49-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral1/memory/2824-47-0x0000000000400000-0x00000000004CD000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier sys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sys.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sys.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier sys.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeSecurityPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeSystemtimePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeBackupPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeRestorePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeShutdownPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeDebugPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeUndockPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeManageVolumePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeImpersonatePrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: 33 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: 34 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: 35 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2180 sys.exe Token: SeSecurityPrivilege 2180 sys.exe Token: SeTakeOwnershipPrivilege 2180 sys.exe Token: SeLoadDriverPrivilege 2180 sys.exe Token: SeSystemProfilePrivilege 2180 sys.exe Token: SeSystemtimePrivilege 2180 sys.exe Token: SeProfSingleProcessPrivilege 2180 sys.exe Token: SeIncBasePriorityPrivilege 2180 sys.exe Token: SeCreatePagefilePrivilege 2180 sys.exe Token: SeBackupPrivilege 2180 sys.exe Token: SeRestorePrivilege 2180 sys.exe Token: SeShutdownPrivilege 2180 sys.exe Token: SeDebugPrivilege 2180 sys.exe Token: SeSystemEnvironmentPrivilege 2180 sys.exe Token: SeChangeNotifyPrivilege 2180 sys.exe Token: SeRemoteShutdownPrivilege 2180 sys.exe Token: SeUndockPrivilege 2180 sys.exe Token: SeManageVolumePrivilege 2180 sys.exe Token: SeImpersonatePrivilege 2180 sys.exe Token: SeCreateGlobalPrivilege 2180 sys.exe Token: 33 2180 sys.exe Token: 34 2180 sys.exe Token: 35 2180 sys.exe Token: SeIncreaseQuotaPrivilege 2824 explorer.exe Token: SeSecurityPrivilege 2824 explorer.exe Token: SeTakeOwnershipPrivilege 2824 explorer.exe Token: SeLoadDriverPrivilege 2824 explorer.exe Token: SeSystemProfilePrivilege 2824 explorer.exe Token: SeSystemtimePrivilege 2824 explorer.exe Token: SeProfSingleProcessPrivilege 2824 explorer.exe Token: SeIncBasePriorityPrivilege 2824 explorer.exe Token: SeCreatePagefilePrivilege 2824 explorer.exe Token: SeBackupPrivilege 2824 explorer.exe Token: SeRestorePrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeDebugPrivilege 2824 explorer.exe Token: SeSystemEnvironmentPrivilege 2824 explorer.exe Token: SeChangeNotifyPrivilege 2824 explorer.exe Token: SeRemoteShutdownPrivilege 2824 explorer.exe Token: SeUndockPrivilege 2824 explorer.exe Token: SeManageVolumePrivilege 2824 explorer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 1656 sys.exe 2716 explorer.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 2100 wrote to memory of 1688 2100 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 30 PID 1688 wrote to memory of 2508 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 31 PID 1688 wrote to memory of 2508 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 31 PID 1688 wrote to memory of 2508 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 31 PID 1688 wrote to memory of 2508 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 31 PID 1688 wrote to memory of 1656 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 32 PID 1688 wrote to memory of 1656 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 32 PID 1688 wrote to memory of 1656 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 32 PID 1688 wrote to memory of 1656 1688 f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe 32 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 1656 wrote to memory of 2180 1656 sys.exe 33 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2180 wrote to memory of 2716 2180 sys.exe 34 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35 PID 2716 wrote to memory of 2824 2716 explorer.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9ebb626e7cb5645d28d3afdd60f15a0_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:2508
-
-
C:\Windows\SysWOW64\Drivers\sys.exe"C:\Windows\system32\Drivers\sys.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\Drivers\sys.exe"C:\Windows\SysWOW64\Drivers\sys.exe"4⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"6⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5f9ebb626e7cb5645d28d3afdd60f15a0
SHA1fcbb902aba8354d948a6b956a6af8af9bcadb604
SHA256bd71d73f17ee2d2c8e8344a1ee79af3d0d8df501edc46704bfdd9bc674e0e3a0
SHA5121fab663d58817042f3de93191b1751e1aa212c7928618a10e13cd5a1a8fa08a299cec2ae9639201033e127cb1e2d0b6ec3c68f6b9a3503d5e9b37ffb01d9c434