Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2025, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe
-
Size
657KB
-
MD5
f774046c437ddfc3303975bcf232f9a3
-
SHA1
5c1b01bf30d110f3387e876400ec64d6c085b3e9
-
SHA256
6ad26871f986e69a828a9c3d4e48a5062cb637c5d7df837f783679978d94090d
-
SHA512
bcf41deb4b2ff66022ded1c2f2a898b6df7510eb2e6193b6150c03b1d86f3a48d9b717bf0665e42426c034e5b5ccb759c49a5f68b48cae42fc1f21a0bce5c1d8
-
SSDEEP
12288:PuBVvG50dw/syOSDqm4chRAix2gpeTi4O+F5eogumEFMZKSJurX:PoNdw/sdSONchRAypu4og8MZKyurX
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 15 IoCs
resource yara_rule behavioral2/memory/2552-28-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-34-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-40-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-41-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-43-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-45-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-46-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-48-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-49-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-50-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-52-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-53-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-54-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-57-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades behavioral2/memory/2552-58-0x0000000000400000-0x0000000000479000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe = "C:\\Users\\Admin\\AppData\\Roaming\\IG8QG958JT.exe:*:Enabled:Windows Messanger" reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 41 2876 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe -
Executes dropped EXE 2 IoCs
pid Process 3716 svchost.exe 2552 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3032 set thread context of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3716 set thread context of 2552 3716 svchost.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4108 MicrosoftEdgeUpdate.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000_Classes\Local Settings JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2976 reg.exe 3956 reg.exe 4624 reg.exe 3088 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3716 svchost.exe Token: 1 2552 svchost.exe Token: SeCreateTokenPrivilege 2552 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2552 svchost.exe Token: SeLockMemoryPrivilege 2552 svchost.exe Token: SeIncreaseQuotaPrivilege 2552 svchost.exe Token: SeMachineAccountPrivilege 2552 svchost.exe Token: SeTcbPrivilege 2552 svchost.exe Token: SeSecurityPrivilege 2552 svchost.exe Token: SeTakeOwnershipPrivilege 2552 svchost.exe Token: SeLoadDriverPrivilege 2552 svchost.exe Token: SeSystemProfilePrivilege 2552 svchost.exe Token: SeSystemtimePrivilege 2552 svchost.exe Token: SeProfSingleProcessPrivilege 2552 svchost.exe Token: SeIncBasePriorityPrivilege 2552 svchost.exe Token: SeCreatePagefilePrivilege 2552 svchost.exe Token: SeCreatePermanentPrivilege 2552 svchost.exe Token: SeBackupPrivilege 2552 svchost.exe Token: SeRestorePrivilege 2552 svchost.exe Token: SeShutdownPrivilege 2552 svchost.exe Token: SeDebugPrivilege 2552 svchost.exe Token: SeAuditPrivilege 2552 svchost.exe Token: SeSystemEnvironmentPrivilege 2552 svchost.exe Token: SeChangeNotifyPrivilege 2552 svchost.exe Token: SeRemoteShutdownPrivilege 2552 svchost.exe Token: SeUndockPrivilege 2552 svchost.exe Token: SeSyncAgentPrivilege 2552 svchost.exe Token: SeEnableDelegationPrivilege 2552 svchost.exe Token: SeManageVolumePrivilege 2552 svchost.exe Token: SeImpersonatePrivilege 2552 svchost.exe Token: SeCreateGlobalPrivilege 2552 svchost.exe Token: 31 2552 svchost.exe Token: 32 2552 svchost.exe Token: 33 2552 svchost.exe Token: 34 2552 svchost.exe Token: 35 2552 svchost.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 3716 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 92 PID 3032 wrote to memory of 2756 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 93 PID 3032 wrote to memory of 2756 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 93 PID 3032 wrote to memory of 2756 3032 JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe 93 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 3716 wrote to memory of 2552 3716 svchost.exe 95 PID 2552 wrote to memory of 4448 2552 svchost.exe 96 PID 2552 wrote to memory of 4448 2552 svchost.exe 96 PID 2552 wrote to memory of 4448 2552 svchost.exe 96 PID 2552 wrote to memory of 3096 2552 svchost.exe 97 PID 2552 wrote to memory of 3096 2552 svchost.exe 97 PID 2552 wrote to memory of 3096 2552 svchost.exe 97 PID 2552 wrote to memory of 2264 2552 svchost.exe 98 PID 2552 wrote to memory of 2264 2552 svchost.exe 98 PID 2552 wrote to memory of 2264 2552 svchost.exe 98 PID 2552 wrote to memory of 4348 2552 svchost.exe 99 PID 2552 wrote to memory of 4348 2552 svchost.exe 99 PID 2552 wrote to memory of 4348 2552 svchost.exe 99 PID 3096 wrote to memory of 2976 3096 cmd.exe 104 PID 3096 wrote to memory of 2976 3096 cmd.exe 104 PID 3096 wrote to memory of 2976 3096 cmd.exe 104 PID 4448 wrote to memory of 3956 4448 cmd.exe 105 PID 4448 wrote to memory of 3956 4448 cmd.exe 105 PID 4448 wrote to memory of 3956 4448 cmd.exe 105 PID 4348 wrote to memory of 3088 4348 cmd.exe 106 PID 4348 wrote to memory of 3088 4348 cmd.exe 106 PID 4348 wrote to memory of 3088 4348 cmd.exe 106 PID 2264 wrote to memory of 4624 2264 cmd.exe 107 PID 2264 wrote to memory of 4624 2264 cmd.exe 107 PID 2264 wrote to memory of 4624 2264 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f774046c437ddfc3303975bcf232f9a3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\svchost.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\IG8QG958JT.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3088
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:2756
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkI5MzEzMkQtQTUzRC00NDAyLTk1OTgtNTYyMEE5QTlDMTQyfSIgdXNlcmlkPSJ7Qzc1NjQwRjgtMjdBMS00QzZDLTg4MzQtNTBCQTVBNzFBRkJDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEMyOTIzNUItRjRGNi00RUVDLUJEQ0QtRTM1M0NCQTZEQTc2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTExOTY3MjQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4108
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
383B
MD502da68b12950ba95f97ad8f00303bb2c
SHA11f3c15784f429d108210569adb0e2275af00cad0
SHA256059040f9892d5229df02f54b42d31ba7f4818bf5e964fb016be9fa441193afcd
SHA512d67791e0c158ba6762b9d74b291c21762bda27eedbc7652bb8f3639b283b8847b65faacaa334258a1d5a6c7fd4ed6d1efb3261cfb424572f87ab2f24502fed9a
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0