Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-09-2024 17:41
Static task
static1
Behavioral task
behavioral1
Sample
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
Resource
win10v2004-20240802-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
-
Size
63KB
-
MD5
a0ca7b2e74a0a3cf5a8962c1325024ae
-
SHA1
81a45727e33fe1a557069cd77c092b0d29f8aaff
-
SHA256
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43
-
SHA512
4272161dc9ea7995eee14fe4ed76534e3ab959e8a60add820924414ce30e0ba655c9d3a5ffe32eab4d4c1012bf22e7a2549d2b59eb9025d81c5277076a23fa77
-
SSDEEP
1536:DgzzUIs6n3rc/G/zCSYCXyN6IknpNcpRP6bM:DgzzUIg+LCSYCX2inpNcj64
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2736 wscript.exe -
Loads dropped DLL 1 IoCs
pid Process 1744 MsiExec.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1856 ICACLS.EXE 2268 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77b24f.msi msiexec.exe File opened for modification C:\Windows\Installer\f77b24f.msi msiexec.exe File created C:\Windows\Installer\f77b250.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB4BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\f77b250.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2652 msiexec.exe 2652 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 3040 msiexec.exe Token: SeIncreaseQuotaPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 2652 msiexec.exe Token: SeTakeOwnershipPrivilege 2652 msiexec.exe Token: SeSecurityPrivilege 2652 msiexec.exe Token: SeCreateTokenPrivilege 3040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3040 msiexec.exe Token: SeLockMemoryPrivilege 3040 msiexec.exe Token: SeIncreaseQuotaPrivilege 3040 msiexec.exe Token: SeMachineAccountPrivilege 3040 msiexec.exe Token: SeTcbPrivilege 3040 msiexec.exe Token: SeSecurityPrivilege 3040 msiexec.exe Token: SeTakeOwnershipPrivilege 3040 msiexec.exe Token: SeLoadDriverPrivilege 3040 msiexec.exe Token: SeSystemProfilePrivilege 3040 msiexec.exe Token: SeSystemtimePrivilege 3040 msiexec.exe Token: SeProfSingleProcessPrivilege 3040 msiexec.exe Token: SeIncBasePriorityPrivilege 3040 msiexec.exe Token: SeCreatePagefilePrivilege 3040 msiexec.exe Token: SeCreatePermanentPrivilege 3040 msiexec.exe Token: SeBackupPrivilege 3040 msiexec.exe Token: SeRestorePrivilege 3040 msiexec.exe Token: SeShutdownPrivilege 3040 msiexec.exe Token: SeDebugPrivilege 3040 msiexec.exe Token: SeAuditPrivilege 3040 msiexec.exe Token: SeSystemEnvironmentPrivilege 3040 msiexec.exe Token: SeChangeNotifyPrivilege 3040 msiexec.exe Token: SeRemoteShutdownPrivilege 3040 msiexec.exe Token: SeUndockPrivilege 3040 msiexec.exe Token: SeSyncAgentPrivilege 3040 msiexec.exe Token: SeEnableDelegationPrivilege 3040 msiexec.exe Token: SeManageVolumePrivilege 3040 msiexec.exe Token: SeImpersonatePrivilege 3040 msiexec.exe Token: SeCreateGlobalPrivilege 3040 msiexec.exe Token: SeBackupPrivilege 2672 vssvc.exe Token: SeRestorePrivilege 2672 vssvc.exe Token: SeAuditPrivilege 2672 vssvc.exe Token: SeBackupPrivilege 2652 msiexec.exe Token: SeRestorePrivilege 2652 msiexec.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 1096 DrvInst.exe Token: SeLoadDriverPrivilege 1096 DrvInst.exe Token: SeLoadDriverPrivilege 1096 DrvInst.exe Token: SeLoadDriverPrivilege 1096 DrvInst.exe Token: SeRestorePrivilege 2652 msiexec.exe Token: SeTakeOwnershipPrivilege 2652 msiexec.exe Token: SeRestorePrivilege 2652 msiexec.exe Token: SeTakeOwnershipPrivilege 2652 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3040 msiexec.exe 3040 msiexec.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3040 2736 wscript.exe 30 PID 2736 wrote to memory of 3040 2736 wscript.exe 30 PID 2736 wrote to memory of 3040 2736 wscript.exe 30 PID 2736 wrote to memory of 3040 2736 wscript.exe 30 PID 2736 wrote to memory of 3040 2736 wscript.exe 30 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 2652 wrote to memory of 1744 2652 msiexec.exe 35 PID 1744 wrote to memory of 1856 1744 MsiExec.exe 36 PID 1744 wrote to memory of 1856 1744 MsiExec.exe 36 PID 1744 wrote to memory of 1856 1744 MsiExec.exe 36 PID 1744 wrote to memory of 1856 1744 MsiExec.exe 36 PID 1744 wrote to memory of 2088 1744 MsiExec.exe 38 PID 1744 wrote to memory of 2088 1744 MsiExec.exe 38 PID 1744 wrote to memory of 2088 1744 MsiExec.exe 38 PID 1744 wrote to memory of 2088 1744 MsiExec.exe 38 PID 1744 wrote to memory of 2772 1744 MsiExec.exe 40 PID 1744 wrote to memory of 2772 1744 MsiExec.exe 40 PID 1744 wrote to memory of 2772 1744 MsiExec.exe 40 PID 1744 wrote to memory of 2772 1744 MsiExec.exe 40 PID 1744 wrote to memory of 1724 1744 MsiExec.exe 42 PID 1744 wrote to memory of 1724 1744 MsiExec.exe 42 PID 1744 wrote to memory of 1724 1744 MsiExec.exe 42 PID 1744 wrote to memory of 1724 1744 MsiExec.exe 42 PID 1744 wrote to memory of 2268 1744 MsiExec.exe 44 PID 1744 wrote to memory of 2268 1744 MsiExec.exe 44 PID 1744 wrote to memory of 2268 1744 MsiExec.exe 44 PID 1744 wrote to memory of 2268 1744 MsiExec.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3040
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3305A76C322753B1C29156B5DDD9FCCF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-cbf5df55-34ce-408f-b89f-5323c6676fc0\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1856
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf3⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-cbf5df55-34ce-408f-b89f-5323c6676fc0\files"3⤵
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-cbf5df55-34ce-408f-b89f-5323c6676fc0\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2268
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "00000000000003E0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5645763c0faf86b715dee6d1e6d50fd82
SHA1a6b466d5a71e3326d295ee7a2a2fc8c5bb79fd23
SHA25612e6b630509b37f2948ffb0f5719dd00dd5934e19aa8d9301247025c1c6d7a43
SHA512b98b9d1f43b8c011b54095756fb865b4781d1890b8842370ff26dcc992d8ac340ed97057011a165be9eea0620e68ca1d0960394ab51316f81721de5370ceb9d3
-
Filesize
1KB
MD5a534fb2a5ad4d169e481c0a01504439c
SHA1ff549ee90bc59eeabb8fc0244007e78ee43e396e
SHA256d9baeeab36bbf6ec836c767939e0825aba5d5c3346d1720c3d0ca69972f2942a
SHA512610884a6c806be1ddca497620b1f9c02faeb395361b6d065424dfd090e98d86e4e7cd61d605bb054a65ae976fa7d93740565c25173d68ad794a848566089f8c9
-
Filesize
1KB
MD5acab3839eba87b6455b759f0022bbc2f
SHA1c771c982978ceb025b73e7bcdf512be88f312090
SHA2565ff36317662e9b2bf519bc24ab537711fa52d009e330ac631c58aed422af64e5
SHA512c4d9e010b33938b53db2ca61337baa8e3b4fbc6d3509e7c7845203b303a1eb8de11421fdd38b1fed9307d47f86e3eb0b440c92a02c4783d2750fb0d99a49640c
-
Filesize
2.0MB
MD59bc2607944098921c27665592491abb8
SHA10721d8d7d6e667e291d71be03106c8087fa38d8f
SHA25639619645275a452099434559fc0663b26d10516c25e7a8c57e1311cdc26c8c80
SHA51236b7e281f96e71f401d2ab2ce80f808947889c18bd5585a3bf00db98c384d6c9da882db96d36b75eb2238b1edf8ea04323858758d7d721618d5f01252f465038
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108