Overview
overview
4Static
static
3vlc-3.0.20-win64.exe
windows11-21h2-x64
lua/http/custom.js
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...m.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/d...w.html
windows11-21h2-x64
1lua/http/index.html
windows11-21h2-x64
1lua/http/js/common.js
windows11-21h2-x64
1lua/http/j...ers.js
windows11-21h2-x64
1lua/http/j...ree.js
windows11-21h2-x64
1lua/http/js/ui.js
windows11-21h2-x64
1lua/http/mobile.html
windows11-21h2-x64
1lua/http/m...e.html
windows11-21h2-x64
1lua/http/m...r.html
windows11-21h2-x64
1lua/http/m...w.html
windows11-21h2-x64
1lua/http/r...ME.vbs
windows11-21h2-x64
1lua/http/view.html
windows11-21h2-x64
1lua/http/vlm.html
windows11-21h2-x64
1lua/http/v...t.html
windows11-21h2-x64
1lua/playli...ube.js
windows11-21h2-x64
1npvlc.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1vlc-cache-gen.exe
windows11-21h2-x64
1vlc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/02/2024, 21:46
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.20-win64.exe
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
lua/http/custom.js
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
lua/http/dialogs/batch_window.html
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
lua/http/dialogs/browse_window.html
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
lua/http/dialogs/create_stream.html
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
lua/http/dialogs/equalizer_window.html
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
lua/http/dialogs/error_window.html
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
lua/http/dialogs/mosaic_window.html
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
lua/http/dialogs/offset_window.html
Resource
win11-20240221-en
Behavioral task
behavioral10
Sample
lua/http/dialogs/stream_config_window.html
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
lua/http/dialogs/stream_window.html
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
lua/http/index.html
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
lua/http/js/common.js
Resource
win11-20240221-en
Behavioral task
behavioral14
Sample
lua/http/js/controllers.js
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
lua/http/js/jquery.jstree.js
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
lua/http/js/ui.js
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
lua/http/mobile.html
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
lua/http/mobile_browse.html
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
lua/http/mobile_equalizer.html
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
lua/http/mobile_view.html
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
lua/http/requests/README.vbs
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
lua/http/view.html
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
lua/http/vlm.html
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
lua/http/vlm_export.html
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
lua/playlist/youtube.js
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
npvlc.dll
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
plugins/access/libaccess_concat_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
plugins/access/libaccess_imem_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral29
Sample
plugins/access/libaccess_mms_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
plugins/access/libaccess_realrtsp_plugin.dll
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
vlc-cache-gen.exe
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
vlc.exe
Resource
win11-20240221-en
General
-
Target
lua/http/dialogs/batch_window.html
-
Size
889B
-
MD5
f32ae14ca9d7673ebb23fc827d78076f
-
SHA1
ff5bff0318296a910740411201cb8a4ca206b608
-
SHA256
5189cdb57f5b2e8c3add7e6c4487f5cf8a018508c612f35c8e1305512f2176e8
-
SHA512
f5e1994188c34753cdc0dc5143dcdf66a86e56b3a040c1f4b67f01fe5d443fa52f05abfdb8717e051284e5697d4a0ac5f46d2ae36b2c518c0d5a96358f5b0f67
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 5108 msedge.exe 5108 msedge.exe 2452 msedge.exe 2452 msedge.exe 4500 identity_helper.exe 4500 identity_helper.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe 3344 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe 5108 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 1464 5108 msedge.exe 81 PID 5108 wrote to memory of 1464 5108 msedge.exe 81 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 2608 5108 msedge.exe 82 PID 5108 wrote to memory of 3312 5108 msedge.exe 83 PID 5108 wrote to memory of 3312 5108 msedge.exe 83 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84 PID 5108 wrote to memory of 1948 5108 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\batch_window.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff83acb3cb8,0x7ff83acb3cc8,0x7ff83acb3cd82⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7022883547216032337,4814925260442982096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3988 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3344
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD596899614360333c9904499393c6e3d75
SHA1bbfa17cf8df01c266323965735f00f0e9e04cd34
SHA256486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c
SHA512974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7
-
Filesize
152B
MD519a8bcb40a17253313345edd2a0da1e7
SHA186fac74b5bbc59e910248caebd1176a48a46d72e
SHA256b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e
SHA5129f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0
-
Filesize
6KB
MD59073b2131c92472311b9b5621e8b329b
SHA1f28337b1a51dc89cf62b71a83568fc6fc29bbc45
SHA2565c14a9115a5c195a2d7e97799d4cd7853838bc7ad3c33507535c423a8070dfa8
SHA51208e1fc717581b3b9da22aaeff0f144121bb825d3ab1d9e87a07cc7cd2e6e95e756dfbea1cdd2b0ab84fb2eab25d3a5cd3ee545579bc87490c9bf649cb4719ba2
-
Filesize
6KB
MD5dd5875168b8bb228624cd4e8a07d6f6d
SHA15d9063cbc7f4a7163d315106b825db6b2f430424
SHA25666c2f275e88f78675f193ff0162c843169dbc143708d54b8940baddacf50db7e
SHA512848c68d354aedabd8257dc7b14c7ca4d86852165b41268c5246a5eb5e1b5fae060494e4b657a2d214e8176d96d1881822f7a17109584d030f307c6dcc9de88de
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e0e6cb0645cec6d765c762f70b6cb13c
SHA1c6bfa3a889ca0aecaf0d79b79ff28856fe99631b
SHA2560b5a5f29e7f863dc851ea3d3e4a53f61f34ea0bfdbe6b3214013b29989f143a3
SHA512c15d825e3c6093148e6f822341b6b5dad98948e3158633ca027a8299c82f285a409294e8abfc46b9991ff6e6fa1489402aae6ab7c821cdb8d9d04330966cd0c7