Overview
overview
7Static
static
7Geometry D...go.apk
android-9-x86
1SecretSheet-hd.xml
windows7-x64
1SecretSheet-hd.xml
windows10-2004-x64
1SecretSheet.xml
windows7-x64
1SecretSheet.xml
windows10-2004-x64
1Skull_w_01.xml
windows7-x64
1Skull_w_01.xml
windows10-2004-x64
1Skull_w_02.xml
windows7-x64
1Skull_w_02.xml
windows10-2004-x64
1Skull_w_03.xml
windows7-x64
1Skull_w_03.xml
windows10-2004-x64
1WorldSheet-hd.xml
windows7-x64
1WorldSheet-hd.xml
windows10-2004-x64
1WorldSheet.xml
windows7-x64
1WorldSheet.xml
windows10-2004-x64
1boost_01_effect.xml
windows7-x64
1boost_01_effect.xml
windows10-2004-x64
1boost_02_effect.xml
windows7-x64
1boost_02_effect.xml
windows10-2004-x64
1boost_03_effect.xml
windows7-x64
1boost_03_effect.xml
windows10-2004-x64
1boost_04_effect.xml
windows7-x64
1boost_04_effect.xml
windows10-2004-x64
1bubbleEffect.xml
windows7-x64
1bubbleEffect.xml
windows10-2004-x64
1bumpEffect.xml
windows7-x64
1bumpEffect.xml
windows10-2004-x64
1burstEffect.xml
windows7-x64
1burstEffect.xml
windows10-2004-x64
1burstEffect2.xml
windows7-x64
1burstEffect2.xml
windows10-2004-x64
1chestOpen.xml
windows7-x64
1Analysis
-
max time kernel
101s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11-06-2023 06:17
Static task
static1
Behavioral task
behavioral1
Sample
Geometry Dash 2.11 Todo Desbloqueado by Rodrigo.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
SecretSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
SecretSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
SecretSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
SecretSheet.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Skull_w_01.xml
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
Skull_w_01.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
Skull_w_02.xml
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Skull_w_02.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Skull_w_03.xml
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Skull_w_03.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
WorldSheet-hd.xml
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
WorldSheet-hd.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
WorldSheet.xml
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
WorldSheet.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
boost_01_effect.xml
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
boost_01_effect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
boost_02_effect.xml
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
boost_02_effect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
boost_03_effect.xml
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
boost_03_effect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
boost_04_effect.xml
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
boost_04_effect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
bubbleEffect.xml
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
bubbleEffect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
bumpEffect.xml
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
bumpEffect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
burstEffect.xml
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
burstEffect.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
burstEffect2.xml
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
burstEffect2.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral32
Sample
chestOpen.xml
Resource
win7-20230220-en
General
-
Target
burstEffect2.xml
-
Size
2KB
-
MD5
43e81d36b064243dd085168592c9b0e4
-
SHA1
44316bec489ca9e0110d99df1e3936ed227a7261
-
SHA256
8090214e66df1b0e3b1af44dfb417a599a178c86e8ac8fc4e509b42097d68be3
-
SHA512
7bf2a2b19d8ad927d89310f3310addfc6a7d18333f721fc40fbdead1b010bfbae7694417582aff999b5ad2df0fbbfe2b0c3996f4fe9009d5a7e2a32dbe21f8ab
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393229296" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060a103781cedcf4da47224cf550042a300000000020000000000106600000001000020000000a8d646d61c974fbc2eb736c07a9711f58cba186248de6f2f6cd902bb5de340f3000000000e8000000002000020000000bddfa5984201358d71e12def5d7fe4ff08566ec3d8893fae58eae7d83d01db1020000000e8ce07dce7019f07f4703d3a8b3dda85c101e7d47a5a0bb3d12110a8324a2f4c400000003d53bb0f73fa9dfdbad8623f03cc469656cf62cd7d41a4c0b0b8f955194192dfb361e2c02838d62ab208180c414649b724b0a0757010b08461fe4f42e7de9f6b IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900beda52c9cd901 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF7A8E61-081F-11EE-9DD1-6E0AA2656971} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000060a103781cedcf4da47224cf550042a3000000000200000000001066000000010000200000001947bc7dbc01b13e5fe38f556d3584eb3656a93aecddfc25cab02a00072a990d000000000e80000000020000200000003eb9c7c5a0b88c88bf7509cf3fc525c85aa4834c3dde8f455bfad2ce2a0b59ba90000000e3c8b7187c070ea9ab6691b9a08515b1187b7c0b5edb4d79a9e93e1fe534f8722d6b1e6c761117de1bf715a8ebe5e180399a09ce0881bbbceeed39042daa645223a71482745995fee86b05752064569e857720244b7dad1af8668d20dc9f6ca99db0e71665363f5674ac6d02529b67b7c8647a22b5eea2f11c221de59baddc8f7f9c5432666f6f1cbad07b125264a98740000000ebe7edb8e9e3570dd930243d24f28c413174b136d9edf2d3c351c679bba92bf82ed5a00689f8704e50f443b9ce7b205d747783e523eacb78231faf3846c105a2 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 736 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 736 IEXPLORE.EXE 736 IEXPLORE.EXE 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE 1368 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1648 wrote to memory of 560 1648 MSOXMLED.EXE iexplore.exe PID 1648 wrote to memory of 560 1648 MSOXMLED.EXE iexplore.exe PID 1648 wrote to memory of 560 1648 MSOXMLED.EXE iexplore.exe PID 1648 wrote to memory of 560 1648 MSOXMLED.EXE iexplore.exe PID 560 wrote to memory of 736 560 iexplore.exe IEXPLORE.EXE PID 560 wrote to memory of 736 560 iexplore.exe IEXPLORE.EXE PID 560 wrote to memory of 736 560 iexplore.exe IEXPLORE.EXE PID 560 wrote to memory of 736 560 iexplore.exe IEXPLORE.EXE PID 736 wrote to memory of 1368 736 IEXPLORE.EXE IEXPLORE.EXE PID 736 wrote to memory of 1368 736 IEXPLORE.EXE IEXPLORE.EXE PID 736 wrote to memory of 1368 736 IEXPLORE.EXE IEXPLORE.EXE PID 736 wrote to memory of 1368 736 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\burstEffect2.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5549f46444a91f8625aff468966203096
SHA18f5cd354508b4dce859caa96571c69ce6ce5f0fe
SHA25631a3e9345998d55f6cc863278af92a80f0d474c0df2ac9f5c83e92597f088072
SHA5124833a4933a7ed3a1704fa4256e1f8483b90058177beab8191108144c832f749280c6db8cb489b7a713330bf855bd05e4a9579337f24edcbf3e6fe5fd8d72f48e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d42d4f08dc812a8f162df19e22b18ec0
SHA138c09983c27fab1d0cc9c0f2a96231967e139208
SHA256b59eff61d535c0132165f264897d8b1f7988d1c2a88cf52c0258438ff42887ad
SHA51263520234fb76cb13f96920ac3f42381d1f1d81a173b95b645e7d781c13dae2804e69c9207955a757f6a31790a70f7ff466c0121aa735b84cccb455da752feac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a3b0dedb963915102ef12b989e9472af
SHA166c32a2948710618075024d72760403638a1fafd
SHA25668e0e9265c9b894bbda2cbf957cb6d76d0f0fbebe2cf44540d35eb7ea6c18d28
SHA512f71aaa2892582488b087844537f11807f8602b49342dfd8959355096f625ff357c73620b1b313fe9db958c476371b83be8cdf84206953595646f89b0a472c0d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5841870efbddf8e51e63bcab0a939a5b1
SHA18bbbb6d815f364d303a6daa50e2c51e7de90ca2c
SHA2565c4bec367d4acdc70efbc9f48ba6264e5718160a52523b70c87cf21a1210fbb9
SHA51228d13524973e4d3de8f1da3aef46b7522375b8709d7ed7ab95dc41f230876e6ddbb7d0629f49d28201f7a78639e86822695d1a56f382234bc2a13c2204bc01a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5115b1f01e89867e163bc98340d1dc808
SHA19244f76ddad05b662d114ef8ec79555e74bb0189
SHA25622e016366e31e33d03fb41f3f43bc8b8d62697f9e475f07bd3005d7fca926148
SHA5125bd6b3ea70dad2eb66136e0887528193bdb40bb5c27ab99e456903fe09adc088104e301d1ccb17abed33b6b12c3e2b608a421d0d84b0b497a83f17f6acfea1b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD57f58323b50a5952ae29409f8deae975b
SHA1a0847f86c1922296cc8cd6f54991e201cdbdfba1
SHA2566307f5fc1724370c9d74eb49b9e19d4f715decef23c730efa2a77f4dada400b8
SHA512423d4a817eb8613acf016f36bc40797b59ac5a1eb43a8e60d41e2e0cb6fb69975af7086cc42d35a2a8181ea02359de6fc9868829122145213d220d8a6b5513c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NZTPJYNO\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\CabB1B6.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\TarB363.tmpFilesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0ZIT2R67.txtFilesize
608B
MD5895842988639d2163618f56645861d6c
SHA11eee47be85e330c6742c08e3d343bd2ae5ea6fcd
SHA256d09fd2fea1f6b344582722e0596f465fe363c0417f167ef9d57e51020742b779
SHA5128450159f156c08d4c819753a5060234b420e39c8a5b0b82cc60c2b6696d75eed290a32e77697fbcd894f4a2f1b0c6e3c0f2155ef119c770fbfd254985a1957ef