Overview
overview
4Static
static
3vlc-3.0.20-win64.exe
windows11-21h2-x64
lua/http/custom.js
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...m.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/index.html
windows11-21h2-x64
1lua/http/js/common.js
windows11-21h2-x64
1lua/http/j...ers.js
windows11-21h2-x64
1lua/http/j...ree.js
windows11-21h2-x64
1lua/http/js/ui.js
windows11-21h2-x64
1lua/http/mobile.html
windows11-21h2-x64
1lua/http/m...e.html
windows11-21h2-x64
1lua/http/m...r.html
windows11-21h2-x64
1lua/http/m...w.html
windows11-21h2-x64
1lua/http/r...ME.vbs
windows11-21h2-x64
1lua/http/view.html
windows11-21h2-x64
1lua/http/vlm.html
windows11-21h2-x64
1lua/http/v...t.html
windows11-21h2-x64
1lua/playli...ube.js
windows11-21h2-x64
1npvlc.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1vlc-cache-gen.exe
windows11-21h2-x64
1vlc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.20-win64.exe
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
lua/http/custom.js
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
lua/http/dialogs/batch_window.html
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
lua/http/dialogs/browse_window.html
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
lua/http/dialogs/create_stream.html
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
lua/http/dialogs/equalizer_window.html
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
lua/http/dialogs/error_window.html
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
lua/http/dialogs/mosaic_window.html
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
lua/http/dialogs/offset_window.html
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
lua/http/dialogs/stream_config_window.html
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
lua/http/dialogs/stream_window.html
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
lua/http/index.html
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
lua/http/js/common.js
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
lua/http/js/controllers.js
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
lua/http/js/jquery.jstree.js
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
lua/http/js/ui.js
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
lua/http/mobile.html
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
lua/http/mobile_browse.html
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
lua/http/mobile_equalizer.html
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
lua/http/mobile_view.html
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
lua/http/requests/README.vbs
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
lua/http/view.html
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
lua/http/vlm.html
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
lua/http/vlm_export.html
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
lua/playlist/youtube.js
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
npvlc.dll
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
plugins/access/libaccess_concat_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
plugins/access/libaccess_imem_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
plugins/access/libaccess_mms_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
plugins/access/libaccess_realrtsp_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
vlc-cache-gen.exe
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
vlc.exe
Resource
win11-20240221-en
General
-
Target
lua/http/vlm_export.html
-
Size
308B
-
MD5
40671579947f74d8826d641c94814b23
-
SHA1
127e2b856c1e4cd0eb3a541e627962cd570295c5
-
SHA256
09bd722b8c4cd442d56c7c730c2a363cf9bdfcb6a8971f00be002c90c40215b9
-
SHA512
8cec6d4b727d9c1cd86841f4407cc2777ade072bb6bc1f7229aed0f730068225c58db6a063de1b15418c2c9341369480043398f2f60bb9038423923199e5f760
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3152 msedge.exe 3152 msedge.exe 2164 msedge.exe 2164 msedge.exe 3524 identity_helper.exe 3524 identity_helper.exe 3952 msedge.exe 3952 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 3732 2164 msedge.exe 81 PID 2164 wrote to memory of 3732 2164 msedge.exe 81 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 2224 2164 msedge.exe 82 PID 2164 wrote to memory of 3152 2164 msedge.exe 83 PID 2164 wrote to memory of 3152 2164 msedge.exe 83 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84 PID 2164 wrote to memory of 3756 2164 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\vlm_export.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda5053cb8,0x7ffda5053cc8,0x7ffda5053cd82⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,10393218209195053793,2737017347756785385,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3652
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53b1e59e67b947d63336fe9c8a1a5cebc
SHA15dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA2567fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
SHA5122d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
-
Filesize
152B
MD50e10a8550dceecf34b33a98b85d5fa0b
SHA1357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA2565694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
SHA512fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
-
Filesize
6KB
MD594f5b5227d35b597d9996f2a82feee10
SHA1866a9083a8445e958f311005539a42cd259ec85a
SHA2567b686178ff460e47bb4b8cd693b6bb85350990a4905844c965de6ef435d070d8
SHA512b5ee8cf904d7667fe13c50211ed093d1fc22e4284c337c7f6d626fbf63cc14f76ddae8500f08130bff3db21c92a76f641d124a6c471df57d9ca635d950460f20
-
Filesize
6KB
MD577ec8c9c0d732f4ef540a3122d00e924
SHA15542a4e0064cfb8ae049e3ff28fd298fbaacbc43
SHA256f89f2c996ced3ec92549c8f4169164e1617c841b3ea132c67b0d049ea7d95b7e
SHA512e1a90a98e95c33e802f8aa32e1e614b7a3d60ed910fc5312a5ae0d9a6daa51f5e80ad86346a5993248bb8b4ba0c4aceeaf5a98442177fd0b8b468dca18da9761
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53e3f81a3090c04aea062a7c3a8b74054
SHA197bd8431765912b08ff97852cf520a5f13a368a3
SHA25606c2592fdc8402dfad7668daedb73122cd9c3d999d3318e09b6a40c97efb433c
SHA512934020b268122768e27bdd5e5fd1b6eec59dea32a6c965396733b6056de8757c22a213585fc4fac48fb27cb38cf31233b194754fb3cb37211d28947e7a1e9263