Malware Analysis Report

2025-01-22 13:34

Sample ID 210424-jhcatltz52
Target asdkqw9uekmkvncmniudsheq.exe
SHA256 1a62aee18b370678c1f2548f9df718ed7d1116be318069f322fa938722f0b15c
Tags
osiris banker botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1a62aee18b370678c1f2548f9df718ed7d1116be318069f322fa938722f0b15c

Threat Level: Known bad

The file asdkqw9uekmkvncmniudsheq.exe was found to be: Known bad.

Malicious Activity Summary

osiris banker botnet

Osiris

Executes dropped EXE

Checks BIOS information in registry

Looks up external IP address via web service

Uses Tor communications

Suspicious use of SetThreadContext

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies registry class

NTFS ADS

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-04-24 04:48

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-04-24 04:48

Reported

2021-04-24 04:59

Platform

win10v20210410

Max time kernel

600s

Max time network

587s

Command Line

"C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe"

Signatures

Osiris

banker botnet osiris

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Uses Tor communications

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2116 set thread context of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ = "Bitmap Image" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\MiscStatus C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgID\ = "PBrush" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Ole1Class C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538} C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\ProgID C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\TreatAs\ = "{D3E34B21-9D75-101A-8C3D-00AA001A1652}" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable\Main C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Conversion\Readable\Main\ = "8" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\MiscStatus\ = "512" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\Ole1Class\ = "PBrush" C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F81F339A-9723-F9F3-8105-47DFFBB7B538}\TreatAs C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData\TEMP:AC6CA6CF C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
File opened for modification C:\ProgramData\TEMP:AC6CA6CF C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 2116 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe
PID 3424 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
PID 3424 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

Processes

C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe

"C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe"

C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe

"C:\Users\Admin\AppData\Local\Temp\asdkqw9uekmkvncmniudsheq.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 900

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"

Network

Country Destination Domain Proto
N/A 131.188.40.189:80 131.188.40.189 tcp
N/A 8.8.8.8:53 api.ipify.org udp
N/A 54.225.169.203:443 api.ipify.org tcp
N/A 5.2.75.222:80 5.2.75.222 tcp
N/A 172.107.92.18:443 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 129.6.15.28:13 time-a.nist.gov tcp
N/A 185.191.124.152:443 185.191.124.152 tcp
N/A 109.70.100.8:80 109.70.100.8 tcp
N/A 80.127.152.4:80 80.127.152.4 tcp
N/A 188.214.104.146:80 188.214.104.146 tcp
N/A 51.75.22.125:80 51.75.22.125 tcp
N/A 93.115.241.194:80 93.115.241.194 tcp
N/A 149.56.94.217:80 149.56.94.217 tcp
N/A 192.42.116.16:80 192.42.116.16 tcp
N/A 45.66.35.35:80 45.66.35.35 tcp
N/A 172.106.17.226:443 tcp
N/A 209.141.53.10:80 209.141.53.10 tcp
N/A 188.138.75.101:80 188.138.75.101 tcp
N/A 171.25.193.77:80 171.25.193.77 tcp
N/A 185.213.20.106:443 tcp
N/A 199.249.230.151:80 199.249.230.151 tcp
N/A 89.238.75.64:80 89.238.75.64 tcp
N/A 91.132.147.168:80 91.132.147.168 tcp
N/A 92.38.184.131:443 tcp
N/A 23.129.64.243:80 23.129.64.243 tcp
N/A 46.227.68.106:80 46.227.68.106 tcp
N/A 23.129.64.209:80 23.129.64.209 tcp
N/A 50.7.178.146:443 tcp
N/A 23.154.177.68:80 23.154.177.68 tcp
N/A 198.98.60.90:80 198.98.60.90 tcp
N/A 93.115.86.4:80 93.115.86.4 tcp
N/A 51.158.147.26:443 tcp
N/A 209.141.41.225:80 209.141.41.225 tcp
N/A 138.201.19.5:80 138.201.19.5 tcp
N/A 8.8.8.8:53 time-a.nist.gov udp
N/A 95.156.95.8:80 95.156.95.8 tcp
N/A 62.210.86.15:443 tcp
N/A 45.156.21.249:80 45.156.21.249 tcp
N/A 85.235.250.88:80 85.235.250.88 tcp
N/A 185.86.148.90:80 185.86.148.90 tcp
N/A 188.114.140.233:443 tcp
N/A 66.206.0.138:80 66.206.0.138 tcp
N/A 104.244.73.205:80 104.244.73.205 tcp
N/A 185.220.102.249:80 185.220.102.249 tcp
N/A 172.105.48.111:443 tcp
N/A 185.112.147.53:80 185.112.147.53 tcp
N/A 104.244.76.184:80 104.244.76.184 tcp
N/A 51.68.205.181:80 51.68.205.181 tcp
N/A 54.36.120.156:443 tcp
N/A 199.249.230.118:80 199.249.230.118 tcp
N/A 199.249.230.64:80 199.249.230.64 tcp
N/A 45.76.115.159:80 45.76.115.159 tcp
N/A 79.133.36.67:443 tcp
N/A 40.113.109.14:80 40.113.109.14 tcp
N/A 178.254.22.21:80 178.254.22.21 tcp
N/A 91.143.81.27:80 91.143.81.27 tcp
N/A 185.205.187.69:443 tcp
N/A 85.159.237.210:80 85.159.237.210 tcp
N/A 45.90.59.61:80 45.90.59.61 tcp

Files

memory/2116-118-0x0000000000400000-0x0000000000655000-memory.dmp

memory/3424-120-0x0000000000401698-mapping.dmp

memory/3424-119-0x0000000000400000-0x0000000000456000-memory.dmp

memory/3424-121-0x0000000000400000-0x0000000000456000-memory.dmp

memory/3424-122-0x00000000006A0000-0x000000000073F000-memory.dmp

memory/2348-123-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

MD5 b4cd27f2b37665f51eb9fe685ec1d373
SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

C:\Users\Admin\AppData\Local\Temp\x64btit.txt

MD5 7d64442a03a2e9f258748a012ad23e2a
SHA1 6714195b3718c09842d7063c6bd126bc11c51dd1
SHA256 b1a445660b1f62c0e0ad902ea2a8b22eee874cc6e37e8d919d481b64ba0e14a3
SHA512 d7c18f59e389a80a63331697c44f5d07a42c9f4dd2cb2fd160276bc32da24d259d1ed088c41f47651a9ba2133a6d28c5a1e05af7ed042c64eb070f5779ab0b5d