Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-02-2024 01:07
Behavioral task
behavioral1
Sample
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe
-
Size
153KB
-
MD5
7e10d07ee37ff5f33e4a17a1e2bccd4e
-
SHA1
fdb0d71ca6b9f16f74f9bc8e4125b213f5c3e708
-
SHA256
655f0d2974bf6da082463a2e1c5cf9ae87dcc873058e5e33cb47ca9490e158c2
-
SHA512
2d6824a70a0389daedfba64a5c1281218ff7d718257e615d87714149f610166559e53bf345634da3caa80ec7e434f2cb4c9e21cfad857b0b25e5534e88255305
-
SSDEEP
3072:LqJogYkcSNm9V7Dd/IKyGwmv+e5UYzjT:Lq2kc4m9tDKPwK
Malware Config
Extracted
C:\Wuxt90cxD.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
9195.tmppid Process 1120 9195.tmp -
Executes dropped EXE 1 IoCs
Processes:
9195.tmppid Process 1120 9195.tmp -
Loads dropped DLL 1 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exepid Process 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\Wuxt90cxD.bmp" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\Wuxt90cxD.bmp" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
9195.tmppid Process 1120 9195.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\WallpaperStyle = "10" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Modifies registry class 5 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon\ = "C:\\ProgramData\\Wuxt90cxD.ico" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Wuxt90cxD\ = "Wuxt90cxD" 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wuxt90cxD\DefaultIcon 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exepid Process 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
9195.tmppid Process 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp 1120 9195.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeDebugPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: 36 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeImpersonatePrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeIncBasePriorityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeIncreaseQuotaPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: 33 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeManageVolumePrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeProfSingleProcessPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeRestorePrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSystemProfilePrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeTakeOwnershipPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeShutdownPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeDebugPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeBackupPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe Token: SeSecurityPrivilege 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe9195.tmpdescription pid Process procid_target PID 1156 wrote to memory of 1120 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 30 PID 1156 wrote to memory of 1120 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 30 PID 1156 wrote to memory of 1120 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 30 PID 1156 wrote to memory of 1120 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 30 PID 1156 wrote to memory of 1120 1156 2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe 30 PID 1120 wrote to memory of 636 1120 9195.tmp 31 PID 1120 wrote to memory of 636 1120 9195.tmp 31 PID 1120 wrote to memory of 636 1120 9195.tmp 31 PID 1120 wrote to memory of 636 1120 9195.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_7e10d07ee37ff5f33e4a17a1e2bccd4e_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\ProgramData\9195.tmp"C:\ProgramData\9195.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9195.tmp >> NUL3⤵PID:636
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f800985f54f78a48fc23dce32dde5d96
SHA1f779f76a65d7a5bca2e24e3993a8f313f61eb375
SHA2569143b0e644b211d40cc754718f585c3caa885735683683306eff78c9e3005909
SHA512b88638914d146b7d0a2741301f082814af0fa408c28a13071e5a77ee955ef3c2e331d320d8ea9fed586f3c113bb09556b9711501b6fb5c3b0506637748fab61e
-
Filesize
153KB
MD58c6e4a81892298b0aefc7173015104be
SHA1f9ae04bb4e738ef1a19a2773219a0f0cb65365d3
SHA256c9e0fd614942df90b8c00bcf6e1323e6243fa1998428ef4ede75c72a8d44d15b
SHA5125d9eddb0b768d6a6897da76f1be426cf977bc1324eb32f6e450492852a9af6a5ac39cbe340760bc467eb13138bda8216a9fd8029b59c6e8cc58be0def9a834e5
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD5039bda5f7f882df350aab2922b3ee3a2
SHA172feac11363a3be8f4faef43ffff86c33f0bae71
SHA25685d69197772a2cb5f5c62494bc766436c96d9baade21ec24d70abb5c7d745af3
SHA5128c4bf6c685588884375e55bda9699ef874e47855b95a554c352f7e404d8d03b45f3aac194c53fdde5cfb90707c9d1adbbd5e5bf1e7b6fba52cbba240beac0a0c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf