Malware Analysis Report

2024-07-28 11:41

Sample ID 240626-1x1zmayhjm
Target 7682a4ba33589368f805dff5965978bcc627ae97e09976a331080777e8954f44.bin
SHA256 7682a4ba33589368f805dff5965978bcc627ae97e09976a331080777e8954f44
Tags
ermac hook collection credential_access discovery evasion execution infostealer persistence rat stealth trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7682a4ba33589368f805dff5965978bcc627ae97e09976a331080777e8954f44

Threat Level: Known bad

The file 7682a4ba33589368f805dff5965978bcc627ae97e09976a331080777e8954f44.bin was found to be: Known bad.

Malicious Activity Summary

ermac hook collection credential_access discovery evasion execution infostealer persistence rat stealth trojan

Ermac2 payload

Hook

Ermac family

Removes its main activity from the application launcher

Queries information about running processes on the device

Queries the phone number (MSISDN for GSM devices)

Makes use of the framework's Accessibility service

Declares services with permission to bind to the system

Requests enabling of the accessibility settings.

Declares broadcast receivers with permission to handle system events

Requests disabling of battery optimizations (often used to enable hiding in the background).

Reads information about phone network operator.

Queries information about the current Wi-Fi connection

Acquires the wake lock

Requests dangerous framework permissions

Makes use of the framework's foreground persistence service

Performs UI accessibility actions on behalf of the user

Queries the mobile country code (MCC)

Registers a broadcast receiver at runtime (usually for listening for system events)

Schedules tasks to execute at a specified time

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-26 22:02

Signatures

Ermac family

ermac

Ermac2 payload

Description Indicator Process Target
N/A N/A N/A N/A

Declares broadcast receivers with permission to handle system events

Description Indicator Process Target
Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN N/A N/A

Declares services with permission to bind to the system

Description Indicator Process Target
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE N/A N/A
Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE N/A N/A

Requests dangerous framework permissions

Description Indicator Process Target
Required to be able to access the camera device. android.permission.CAMERA N/A N/A
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS N/A N/A
Allows an application to read the user's call log. android.permission.READ_CALL_LOG N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A
Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION N/A N/A
Allows an application to read the user's contacts data. android.permission.READ_CONTACTS N/A N/A
Allows an application to write the user's contacts data. android.permission.WRITE_CONTACTS N/A N/A
Allows access to the list of accounts in the Accounts Service. android.permission.GET_ACCOUNTS N/A N/A
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 22:02

Reported

2024-06-26 22:12

Platform

android-x86-arm-20240624-en

Max time kernel

179s

Max time network

131s

Command Line

com.cikorujoyebu.ziyapa

Signatures

Hook

rat trojan infostealer hook

Removes its main activity from the application launcher

stealth trojan evasion
Description Indicator Process Target
N/A N/A N/A N/A

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.cikorujoyebu.ziyapa

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
GB 142.250.200.42:443 tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 216.58.204.78:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
GB 142.250.179.234:443 semanticlocation-pa.googleapis.com tcp

Files

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-journal

MD5 b81bf40ffcefa4be5cf9973b641a840e
SHA1 046afd874cee51c46e287d1a0ecc0db7dd443e55
SHA256 1f3d00f0083cc6a3b775f5b4bf35e662ba551296a708ce10dd5da0966bb24c83
SHA512 1729e57d8aca4cba87f2d4a115d9828571032589ae054a09e63f7dc66bb3c9a77b09ac80fbdf63b7d45dde3ec8cebbb62f27b5a9454a3e35beef9518c2259874

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 8b90c90983a75f3ab34b213334b33ed6
SHA1 f00170de161044ef2af57df864990fa8647b7cc7
SHA256 5b80d33a708aae388e2d91f6f2bfe788b28842bfe8f099708574772c020a3967
SHA512 a8e303b391ba4fbb7d8fdb32bc47fd7fcc8cb51223953f420a4f751c3b97b6eaa988267a9b1ab8ee2b264673c75fa03baf80ab4cfb7e12755178176835f7788e

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 f15c5b72418a05ae7d0c059678c99337
SHA1 67dd1ec823305866de968054636e5b71f8ca72cd
SHA256 ac0ccfe656d89d56c2b3ba382a449b4bdf5bd2e6f8604bdb3083530a6ceabdfe
SHA512 18a215c2c863748e82ef4eb5497c9998f7d8cb50f50289556c3bd3223dc08c448b72e3c466f81afa19fa7f5ee3188241965a00750175dfe8d389fc8fdc88e494

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 9d36d964ac74e45128cf5b8766ba1538
SHA1 9bc425b77faadbc2c913defb604e689ef04a7099
SHA256 b16df89eb15c82a05a16de8271e95219c689d6ab224a61a4b6abeffae84fa723
SHA512 66c74fe68a8b295af909a3e0d60e77c613b5e9c6130378337067992ea9bc7938b1b2ad8a4eec99c30a17bc47fb6894358142f49872676364856d66eb5d718183

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 22:02

Reported

2024-06-26 22:12

Platform

android-x64-20240624-en

Max time kernel

179s

Max time network

135s

Command Line

com.cikorujoyebu.ziyapa

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Registers a broadcast receiver at runtime (usually for listening for system events)

persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.registerReceiver N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.cikorujoyebu.ziyapa

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 216.58.212.232:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.179.238:443 tcp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.204.78:443 android.apis.google.com tcp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
GB 142.250.180.10:443 semanticlocation-pa.googleapis.com tcp
GB 216.58.201.106:443 semanticlocation-pa.googleapis.com tcp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-journal

MD5 c16f3419fee32bde71e7f8701872249e
SHA1 297376f8848ca7fd65746f29117dfced69073c9a
SHA256 c315300b16cf62be05bf86c863589e0dd3a0c6633ff07845b8238b67df551742
SHA512 9dbad8fa18aeb994f0011e40a571442060c52c0c4c5dee6666b4f89d6ab54e9756549b3b85133fe32aab9040b44f24d06eb695c979e78ea846d8e1c26356ecad

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb

MD5 f2b4b0190b9f384ca885f0c8c9b14700
SHA1 934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA256 0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512 ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 852c8c54c2689e5926493a83a51c8efd
SHA1 f4062688472c9086bc2029b11ce927a3b4d18ebc
SHA256 495fe40321889017f9092f3a057a4dcd652a0086c911824f64a87be265921d92
SHA512 3ec062820aa800abdc31da5d9ccf8260643d582d859d959ee4fe6fd54eea6450a71d7a900cb102d6c46c0a91707b875ecf99716ba028a8a1a3d7b153c49673f9

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 edf97183fd94abeb879f58bee0820745
SHA1 f8dc4523f3a3d1898237d2aa3eca74fa6131c625
SHA256 753452fd738b2dbacbba68d8142dd22efcf6fc06687899f3727c1a728bf93cf0
SHA512 29b2a3c8d269617736bfb76b98b036316f30eaa68f067459a6649f35dba9fc88e3805dd79aec7c6757772a44bbeb393a3c2ac01901853613c5f0c14f97ce1cd1

/data/data/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 70cb0097cc3198dd51652248bd5f384a
SHA1 d365c6884dfa7a953eb2fd14b20ae44e152169cc
SHA256 a4f27f836426d887fd0152267b82e3a3879440368256f8bfdfa72c01c42ca0e1
SHA512 7d5436ca1d631b2bd9e2a72bdcd181daac39eba3c8bd2bc5ae805cdcb7c8ebf101b33b69d9dba61549d13c4ce12d65cfd0eae9c012f80ff427cfc35a32280ee8

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-26 22:02

Reported

2024-06-26 22:12

Platform

android-x64-arm64-20240624-en

Max time kernel

179s

Max time network

132s

Command Line

com.cikorujoyebu.ziyapa

Signatures

Hook

rat trojan infostealer hook

Makes use of the framework's Accessibility service

collection evasion credential_access
Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByText N/A N/A
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfosByViewId N/A N/A

Queries information about running processes on the device

discovery
Description Indicator Process Target
Framework service call android.app.IActivityManager.getRunningAppProcesses N/A N/A

Queries the phone number (MSISDN for GSM devices)

discovery

Acquires the wake lock

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Makes use of the framework's foreground persistence service

evasion persistence
Description Indicator Process Target
Framework service call android.app.IActivityManager.setServiceForeground N/A N/A

Performs UI accessibility actions on behalf of the user

evasion
Description Indicator Process Target
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A
N/A android.accessibilityservice.IAccessibilityServiceConnection.performGlobalAction N/A N/A

Queries information about the current Wi-Fi connection

discovery
Description Indicator Process Target
Framework service call android.net.wifi.IWifiManager.getConnectionInfo N/A N/A

Queries the mobile country code (MCC)

discovery
Description Indicator Process Target
Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone N/A N/A

Reads information about phone network operator.

discovery

Requests enabling of the accessibility settings.

Description Indicator Process Target
Intent action android.settings.ACCESSIBILITY_SETTINGS N/A N/A

Schedules tasks to execute at a specified time

execution persistence
Description Indicator Process Target
Framework service call android.app.job.IJobScheduler.schedule N/A N/A

Processes

com.cikorujoyebu.ziyapa

Network

Country Destination Domain Proto
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
GB 142.250.180.14:443 tcp
N/A 224.0.0.251:5353 udp
GB 216.58.213.10:443 tcp
GB 216.58.213.10:443 tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
GB 142.250.180.8:443 ssl.google-analytics.com tcp
US 1.1.1.1:53 null udp
GB 142.250.200.36:443 tcp
GB 142.250.200.36:443 tcp

Files

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-journal

MD5 41940d0c2e1e36ccb20913fb5e3f0465
SHA1 3e1b2b30ebac4d0546cff166a4508374b7056068
SHA256 4cb190d4f2c47ba38b6cea89de53d9057acf44eb42a245342ac8d8bc9c36f86f
SHA512 0226c750d5793105de1f92bd454d12278b01e91ace81119b753671598004af695375d3e2ded6c3ae7e4abe964b45998300d929ece5ccf3ee26e0a6b2ece3dc79

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb

MD5 7e858c4054eb00fcddc653a04e5cd1c6
SHA1 2e056bf31a8d78df136f02a62afeeca77f4faccf
SHA256 9010186c5c083155a45673017d1e31c2a178e63cc15a57bbffde4d1956a23dad
SHA512 d0c7a120940c8e637d5566ef179d01eff88a2c2650afda69ad2a46aad76533eaace192028bba3d60407b4e34a950e7560f95d9f9b8eebe361ef62897d88b30cb

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-shm

MD5 bb7df04e1b0a2570657527a7e108ae23
SHA1 5188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256 c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512 768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 ec3101af6c9438c93025ce0077a7bba3
SHA1 fe121742b50d49f77925e584a2477c120e885b28
SHA256 8e13d80ec63a5f9399696472b96762636bcb452b6f7524bfe15e9ee72022c28b
SHA512 849c379433e0fa680aefaaa0326c83f3bed48c06f4f4114e9b43072b5c7da55d822d9ebe80b9a004b4a7b67cf2d241f887ee8e755a2eccac16864f10fb72c94d

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 0557db21d01b6722e12d70fbe91421b2
SHA1 08ec81f2dc796460424243989c9f0fa1673edd05
SHA256 beebb4c3ba30cfaa166ab9bec766ce43c332bd5628b059230c5cea73a562e9cb
SHA512 c8b5201268cb4f57c380a84c3fdaf66ed2256602ee873bbf6e7804c639a0d100f8156a2216b71568fee14555aff8d845afa5ebb79aeb5b431f159e977dda083a

/data/user/0/com.cikorujoyebu.ziyapa/no_backup/androidx.work.workdb-wal

MD5 d884f666784311831a91838ceaf9bb05
SHA1 5ed1f8f18b475be451e8bbd117fd9a648c490bfb
SHA256 ce141a0eaa6d2114dab620987d05bb8d5f2a6a7dce4a91f825aea06bc0498f8e
SHA512 92b633878108c3a9156871de7a4e99d1d97b9f90c2160eacd0d69b5bbc5f405df7850c2fb100ca48b96fbcb006b836d687190bde486042956a2104098e8ebd08