Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 11:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Celesty.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Celesty.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
Celesty.exe
-
Size
1.7MB
-
MD5
8966d25141f5e150ff7d02ac502cce46
-
SHA1
f882485d1ffac1b75b60794824b771e4ce33d7b7
-
SHA256
8694257c04deed3937833145954c65564627f7d40cd20f8401696933a03b7e3f
-
SHA512
caedef6e8fdc042d6586816bdc87c36b3d40c22a8e4e331d46296b669ed03f2e295f4b44ed4092f43e8d0dad8cc40766982d6938d1d638fb4e4eecaddd529df3
-
SSDEEP
49152:6PxCjaDpascfyHTtgWc79pGvFog9hlQ0xM7QYeYnUgy:mCq4sokTtlPFooQzzU/
Score
10/10
Malware Config
Extracted
Family
mercurialgrabber
C2
https://discord.com/api/webhooks/935223250571640882/ViB43kUXE9CCFxm2v1jxJfLyHYVNk3Y3-laU94OpWmJjw7id0TwbDJUP1by4-O7zvfZu
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions CELESTY BUILDER.EXE -
Looks for VMWare Tools registry key 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools CELESTY BUILDER.EXE -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CELESTY BUILDER.EXE -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation CelestyBuilder.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation CELESTY.EXE Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation CelestyBuilder.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation CELESTY.EXE Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation CelestyBuilder.exe Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation Celesty.exe -
Executes dropped EXE 7 IoCs
pid Process 1688 CelestyBuilder.exe 3052 CELESTY BUILDER.EXE 3348 CelestyBuilder.exe 868 CELESTY BUILDER.EXE 4572 CelestyBuilder.exe 1184 CELESTY BUILDER.EXE 3776 CELESTY.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 22 discord.com 25 discord.com 28 discord.com 29 discord.com 30 discord.com 14 discord.com 16 discord.com -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip4.seeip.org 9 ip-api.com 21 ip4.seeip.org 26 ip4.seeip.org 7 ip4.seeip.org -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 CELESTY BUILDER.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CELESTY BUILDER.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 CELESTY BUILDER.EXE -
Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 CELESTY BUILDER.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 CELESTY BUILDER.EXE -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1228 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3052 CELESTY BUILDER.EXE Token: SeDebugPrivilege 868 CELESTY BUILDER.EXE Token: SeDebugPrivilege 1184 CELESTY BUILDER.EXE Token: SeDebugPrivilege 1228 taskmgr.exe Token: SeSystemProfilePrivilege 1228 taskmgr.exe Token: SeCreateGlobalPrivilege 1228 taskmgr.exe Token: 33 1228 taskmgr.exe Token: SeIncBasePriorityPrivilege 1228 taskmgr.exe -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 3776 CELESTY.EXE 3776 CELESTY.EXE 3776 CELESTY.EXE 3776 CELESTY.EXE 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 3776 CELESTY.EXE 3776 CELESTY.EXE 3776 CELESTY.EXE 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe 1228 taskmgr.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1688 2092 Celesty.exe 80 PID 2092 wrote to memory of 1688 2092 Celesty.exe 80 PID 2092 wrote to memory of 1688 2092 Celesty.exe 80 PID 1688 wrote to memory of 3052 1688 CelestyBuilder.exe 81 PID 1688 wrote to memory of 3052 1688 CelestyBuilder.exe 81 PID 1688 wrote to memory of 2208 1688 CelestyBuilder.exe 83 PID 1688 wrote to memory of 2208 1688 CelestyBuilder.exe 83 PID 1688 wrote to memory of 2208 1688 CelestyBuilder.exe 83 PID 2208 wrote to memory of 3348 2208 CELESTY.EXE 84 PID 2208 wrote to memory of 3348 2208 CELESTY.EXE 84 PID 2208 wrote to memory of 3348 2208 CELESTY.EXE 84 PID 3348 wrote to memory of 868 3348 CelestyBuilder.exe 85 PID 3348 wrote to memory of 868 3348 CelestyBuilder.exe 85 PID 3348 wrote to memory of 3668 3348 CelestyBuilder.exe 87 PID 3348 wrote to memory of 3668 3348 CelestyBuilder.exe 87 PID 3348 wrote to memory of 3668 3348 CelestyBuilder.exe 87 PID 3668 wrote to memory of 4572 3668 CELESTY.EXE 88 PID 3668 wrote to memory of 4572 3668 CELESTY.EXE 88 PID 3668 wrote to memory of 4572 3668 CELESTY.EXE 88 PID 4572 wrote to memory of 1184 4572 CelestyBuilder.exe 90 PID 4572 wrote to memory of 1184 4572 CelestyBuilder.exe 90 PID 4572 wrote to memory of 3776 4572 CelestyBuilder.exe 92 PID 4572 wrote to memory of 3776 4572 CelestyBuilder.exe 92 PID 4572 wrote to memory of 3776 4572 CelestyBuilder.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celesty.exe"C:\Users\Admin\AppData\Local\Temp\Celesty.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"5⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"7⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3776
-
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
Filesize
41KB
MD54cc81e53b9037673b9014431e9be0e60
SHA162c57cbad6be321e65bea71bd87801fcb0bf7af9
SHA2561baf3f560a47aacd9a841939ff127fbade26095dd47867dfec38bc2f1fa4a9ad
SHA512dae96f885d20fe185302f689f844032797209b28d1295444a29fa730d01b520e7994121fe8bd2b55c0d21b395da372a9846d9dec5960edfecd40ac41690d36ff
-
Filesize
2.7MB
MD5c3009ee63bc661d9ea75eaeb256448ca
SHA145eb01150756df432e25eed44d976442473356de
SHA2560bb88564a22bfd6d9ad6e4d8efa9077792a7b6094c2a0f865d70c43e11507352
SHA51296f5847fbeef95df1309e97a4bc3d786a5f5c19b87e804f12d88b4473a0b50291c40407a3d95a2d5d78031f03be76da47f1846a73c7802ddae46a38ac4634e67
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
2.8MB
MD5d604d3ac515faf6ad32e8e57c170d389
SHA102069909d405b33af28da67ad232013307a198b2
SHA2565d3955502a6b63e394eea67aad6c83dfa80d08484d9f11956e77ec5b47c6f8b8
SHA512bb1d77a7430204eef2ecb3cdfb7d2b2b5f80f9f5fefee6cbff2fc69538523177e8010d9dc4b353f4adc4c6bdba2c398ceac90ce43a1302b2cdf5149dd7680817