Overview
overview
7Static
static
3vlc-3.0.21...1).exe
windows11-21h2-x64
7lua/http/custom.js
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...m.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/d...w.html
windows11-21h2-x64
3lua/http/index.html
windows11-21h2-x64
3lua/http/js/common.js
windows11-21h2-x64
3lua/http/j...ers.js
windows11-21h2-x64
3lua/http/j...ree.js
windows11-21h2-x64
3lua/http/js/ui.js
windows11-21h2-x64
3lua/http/mobile.html
windows11-21h2-x64
3lua/http/m...e.html
windows11-21h2-x64
3lua/http/m...r.html
windows11-21h2-x64
3lua/http/m...w.html
windows11-21h2-x64
3lua/http/r...ME.vbs
windows11-21h2-x64
1lua/http/view.html
windows11-21h2-x64
3lua/http/vlm.html
windows11-21h2-x64
3lua/http/v...t.html
windows11-21h2-x64
3lua/playli...ube.js
windows11-21h2-x64
3npvlc.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1plugins/ac...in.dll
windows11-21h2-x64
1vlc-cache-gen.exe
windows11-21h2-x64
1vlc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-11-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.21-win64 (1).exe
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
lua/http/custom.js
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
lua/http/dialogs/batch_window.html
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
lua/http/dialogs/browse_window.html
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
lua/http/dialogs/create_stream.html
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
lua/http/dialogs/equalizer_window.html
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
lua/http/dialogs/error_window.html
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
lua/http/dialogs/mosaic_window.html
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
lua/http/dialogs/offset_window.html
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
lua/http/dialogs/stream_config_window.html
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
lua/http/dialogs/stream_window.html
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
lua/http/index.html
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
lua/http/js/common.js
Resource
win11-20241023-en
Behavioral task
behavioral14
Sample
lua/http/js/controllers.js
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
lua/http/js/jquery.jstree.js
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
lua/http/js/ui.js
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
lua/http/mobile.html
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
lua/http/mobile_browse.html
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
lua/http/mobile_equalizer.html
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
lua/http/mobile_view.html
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
lua/http/requests/README.vbs
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
lua/http/view.html
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
lua/http/vlm.html
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
lua/http/vlm_export.html
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
lua/playlist/youtube.js
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
npvlc.dll
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
plugins/access/libaccess_concat_plugin.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
plugins/access/libaccess_imem_plugin.dll
Resource
win11-20241023-en
Behavioral task
behavioral29
Sample
plugins/access/libaccess_mms_plugin.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
plugins/access/libaccess_realrtsp_plugin.dll
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
vlc-cache-gen.exe
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
vlc.exe
Resource
win11-20241007-en
General
-
Target
lua/http/dialogs/batch_window.html
-
Size
889B
-
MD5
f32ae14ca9d7673ebb23fc827d78076f
-
SHA1
ff5bff0318296a910740411201cb8a4ca206b608
-
SHA256
5189cdb57f5b2e8c3add7e6c4487f5cf8a018508c612f35c8e1305512f2176e8
-
SHA512
f5e1994188c34753cdc0dc5143dcdf66a86e56b3a040c1f4b67f01fe5d443fa52f05abfdb8717e051284e5697d4a0ac5f46d2ae36b2c518c0d5a96358f5b0f67
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3048 msedge.exe 3048 msedge.exe 412 msedge.exe 412 msedge.exe 4944 identity_helper.exe 4944 identity_helper.exe 3952 msedge.exe 3952 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe 3476 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe 412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 3348 412 msedge.exe 79 PID 412 wrote to memory of 3348 412 msedge.exe 79 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 1236 412 msedge.exe 80 PID 412 wrote to memory of 3048 412 msedge.exe 81 PID 412 wrote to memory of 3048 412 msedge.exe 81 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82 PID 412 wrote to memory of 2360 412 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\batch_window.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff982283cb8,0x7ff982283cc8,0x7ff982283cd82⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,406010524604208340,10585640489649248461,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5554d6d27186fa7d6762d95dde7a17584
SHA193ea7b20b8fae384cf0be0d65e4295097112fdca
SHA2562fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb
SHA51257d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7
-
Filesize
152B
MD5a28bb0d36049e72d00393056dce10a26
SHA1c753387b64cc15c0efc80084da393acdb4fc01d0
SHA256684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1
SHA51220940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7
-
Filesize
5KB
MD5818f78588dd0056674c88e36bbb8efa4
SHA1e3addfaab6674458766cda05ef7347badf094488
SHA2568bf4e6dbd94e43040bebeb0be9a81ba5378493eff10794a04ddebdc771bb66b5
SHA5120e9a8be256695c366ef976faf78bb22dfdddcbffe838be2c40750565e76b60d529532d7c8744245ff6d90efa48385493795b8ac8b94ad6fb08ae4b930367efbb
-
Filesize
5KB
MD5967de791329c416968169d3dcfb62ccf
SHA126fa8fd0f703ebbc446e83d526c8dc036310d427
SHA256a25003a4e8f49885fd14346eff215091ccf634f1399621f03283cb2dcc5deae4
SHA512e771f7ad3efb451404249c8f8a5f6d0d0e4c653bb983731354059ac47f55aaee0bbbfdcc051d9da27f042be098ee8958cd6c8a8503f7fd580d88981347c273f9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5dd13cff0b76e6042b231af074b73c623
SHA10b363e4324baac0c1f4e1b2601872ed269150562
SHA256192355e26a6b86a71237052fd6c1fe2da4d267ef1285383af57e07d8a200904f
SHA512e0b5ecf3651e674b90efaac01a686f21865f93d23c192e3d3255d06c4cc8ea3c7745a3dcbd540e9c647f94ed71e1a7a37a10841c145f65d4e2374584bb02e688