Overview
overview
4Static
static
3vlc-3.0.20-win64.exe
windows11-21h2-x64
lua/http/custom.js
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...m.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/index.html
windows11-21h2-x64
1lua/http/js/common.js
windows11-21h2-x64
1lua/http/j...ers.js
windows11-21h2-x64
1lua/http/j...ree.js
windows11-21h2-x64
1lua/http/js/ui.js
windows11-21h2-x64
1lua/http/mobile.html
windows11-21h2-x64
1lua/http/m...e.html
windows11-21h2-x64
1lua/http/m...r.html
windows11-21h2-x64
1lua/http/m...w.html
windows11-21h2-x64
1lua/http/r...ME.vbs
windows11-21h2-x64
1lua/http/view.html
windows11-21h2-x64
1lua/http/vlm.html
windows11-21h2-x64
1lua/http/v...t.html
windows11-21h2-x64
1lua/playli...ube.js
windows11-21h2-x64
1npvlc.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1vlc-cache-gen.exe
windows11-21h2-x64
1vlc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.20-win64.exe
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
lua/http/custom.js
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
lua/http/dialogs/batch_window.html
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
lua/http/dialogs/browse_window.html
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
lua/http/dialogs/create_stream.html
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
lua/http/dialogs/equalizer_window.html
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
lua/http/dialogs/error_window.html
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
lua/http/dialogs/mosaic_window.html
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
lua/http/dialogs/offset_window.html
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
lua/http/dialogs/stream_config_window.html
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
lua/http/dialogs/stream_window.html
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
lua/http/index.html
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
lua/http/js/common.js
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
lua/http/js/controllers.js
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
lua/http/js/jquery.jstree.js
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
lua/http/js/ui.js
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
lua/http/mobile.html
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
lua/http/mobile_browse.html
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
lua/http/mobile_equalizer.html
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
lua/http/mobile_view.html
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
lua/http/requests/README.vbs
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
lua/http/view.html
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
lua/http/vlm.html
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
lua/http/vlm_export.html
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
lua/playlist/youtube.js
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
npvlc.dll
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
plugins/access/libaccess_concat_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
plugins/access/libaccess_imem_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
plugins/access/libaccess_mms_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
plugins/access/libaccess_realrtsp_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
vlc-cache-gen.exe
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
vlc.exe
Resource
win11-20240221-en
General
-
Target
lua/http/vlm.html
-
Size
1KB
-
MD5
24df9442565fa3dd24c48de5dcebb856
-
SHA1
102cf8ba9ed78e407906990181a934e8d7cb1864
-
SHA256
4800ddaa370be2bc8660b8559c10d8650034d65e70adcf89dad4779aa4aad93f
-
SHA512
f69de9777e812aada0c7ab5ff96d8a1e0b6081f86aed1c0ab8952f89cc5aa439239351179b6c7039b57dabb1ed56d047d6c6f00abad32a4c1b22f9a20b7cfc1f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3108 msedge.exe 3108 msedge.exe 2848 msedge.exe 2848 msedge.exe 3732 msedge.exe 3732 msedge.exe 1392 identity_helper.exe 1392 identity_helper.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe 2368 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe 2848 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2548 2848 msedge.exe 80 PID 2848 wrote to memory of 2548 2848 msedge.exe 80 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3784 2848 msedge.exe 82 PID 2848 wrote to memory of 3108 2848 msedge.exe 81 PID 2848 wrote to memory of 3108 2848 msedge.exe 81 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83 PID 2848 wrote to memory of 1600 2848 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\vlm.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb36443cb8,0x7ffb36443cc8,0x7ffb36443cd82⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,6068843968636880074,64694215257852666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5596 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d459a8c16562fb3f4b1d7cadaca620aa
SHA17810bf83e8c362e0c69298e8c16964ed48a90d3a
SHA256fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a
SHA51235cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f
-
Filesize
152B
MD5656bb397c72d15efa159441f116440a6
SHA15b57747d6fdd99160af6d3e580114dbbd351921f
SHA256770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab
SHA5125923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c
-
Filesize
6KB
MD5adb9295e89fd2912bd430a0f5b54bd56
SHA1684f819d7c8cbdf64ca549223990c3c481f89dee
SHA256eaa05dac8d37780cdb934926c0724451216febaaa03efaff7271161daaf221bc
SHA512520abfba0163830d87bf9c408664472cfcfd88c5727f873199658aa54ff317d6bc5f46569a2b9355ecb2e0b348204822886ca8e4cde22dc9acb8e88baada8e30
-
Filesize
6KB
MD5decaa46e66500996f01be0ab4eb5ce2a
SHA1811ec07afed4fb0c9280cbbabf74b294d71423f9
SHA256f650c3a7e06734ee337bf00b268e0060ef0b7c987d701b38de0b2bf1c7560711
SHA512f04d874f487cebf4dea78add2f82751456ebd7b8776d5b82e9c65351b2a34d42ceb55b39c73efc2695dd5d8af6445ca60ad795abd4bbb7f154cb680b7b97f78e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a936d8ccb628d292ebb926163fa0b3b8
SHA1eca1ecb8ba2ad5ed6914ade1c9da9fc81a2eb936
SHA2561f9165822c8dc93da17c89727f7753acd3fbecdf88b92670bde7cc1850006728
SHA51250de98df940ae96c96bcfd934ca7a96fad7f293a8256b1f57c612112e58891c5591d8b03319840b9e3ded79c9bf060605d09dc9fa01d282a0a77bd57717bda5b