Overview
overview
3Static
static
3asset/admin/ads.html
windows7-x64
3asset/admin/ads.html
windows10-2004-x64
3asset/admi...n.html
windows7-x64
3asset/admi...n.html
windows10-2004-x64
3asset/admin/foot.html
windows7-x64
3asset/admin/foot.html
windows10-2004-x64
3asset/admi...o.html
windows7-x64
3asset/admi...o.html
windows10-2004-x64
3asset/admin/head.html
windows7-x64
3asset/admin/head.html
windows10-2004-x64
3asset/admi...n.html
windows7-x64
3asset/admi...n.html
windows10-2004-x64
3asset/admin/qita.html
windows7-x64
3asset/admin/qita.html
windows10-2004-x64
3asset/admi...e.html
windows7-x64
3asset/admi...e.html
windows10-2004-x64
3asset/admi...e.html
windows7-x64
3asset/admi...e.html
windows10-2004-x64
3asset/admi...n.html
windows7-x64
3asset/admi...n.html
windows10-2004-x64
3asset/admi...s.html
windows7-x64
3asset/admi...s.html
windows10-2004-x64
3asset/admi...s.html
windows7-x64
3asset/admi...s.html
windows10-2004-x64
3asset/admi...s.html
windows7-x64
3asset/admi...s.html
windows10-2004-x64
3asset/admi...s.html
windows7-x64
3asset/admi...s.html
windows10-2004-x64
3asset/admi...s.html
windows7-x64
3asset/admi...s.html
windows10-2004-x64
3asset/js/conch.set.js
windows7-x64
3asset/js/conch.set.js
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 15:40
Behavioral task
behavioral1
Sample
asset/admin/ads.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
asset/admin/ads.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
asset/admin/caidan.html
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
asset/admin/caidan.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
asset/admin/foot.html
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
asset/admin/foot.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
asset/admin/hailuo.html
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
asset/admin/hailuo.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
asset/admin/head.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
asset/admin/head.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
asset/admin/jiben.html
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
asset/admin/jiben.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
asset/admin/qita.html
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
asset/admin/qita.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
asset/admin/shouye.html
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
asset/admin/shouye.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
asset/admin/theme.html
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
asset/admin/theme.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
asset/admin/yemian.html
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
asset/admin/yemian.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
asset/admin/yemian/actors.html
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
asset/admin/yemian/actors.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
asset/admin/yemian/arts.html
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
asset/admin/yemian/arts.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
asset/admin/yemian/customs.html
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
asset/admin/yemian/customs.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
asset/admin/yemian/topics.html
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
asset/admin/yemian/topics.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
asset/admin/yemian/vods.html
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
asset/admin/yemian/vods.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
asset/js/conch.set.js
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
asset/js/conch.set.js
Resource
win10v2004-20241007-en
General
-
Target
asset/admin/head.html
-
Size
2KB
-
MD5
40e0c5193ee1acde2a5d5411fe97b79e
-
SHA1
08c057156851de916d42a5b73430bae0a954bd69
-
SHA256
126847d7e5b2e683718c478e11edb12f85875add86896ab77459a9cbe97ee265
-
SHA512
6580d22a852c5c9bb7f4763ac6d92e2b1b968245364fc46c0c8ecbc945738ce3785188e956b51c5b8cc49be9db9f38cde5f590e7eeb579a035c029335cac8328
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2440 msedge.exe 2440 msedge.exe 4944 msedge.exe 4944 msedge.exe 4960 identity_helper.exe 4960 identity_helper.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe 4944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2040 4944 msedge.exe 84 PID 4944 wrote to memory of 2040 4944 msedge.exe 84 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 3212 4944 msedge.exe 85 PID 4944 wrote to memory of 2440 4944 msedge.exe 86 PID 4944 wrote to memory of 2440 4944 msedge.exe 86 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87 PID 4944 wrote to memory of 1944 4944 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\asset\admin\head.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa804846f8,0x7ffa80484708,0x7ffa804847182⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3602782236846111023,526932873673765802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1120
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
5KB
MD59eeb222251ecb606a5872d7e65235b0f
SHA1774427a66f0b75001757eaab37722a0a66419b67
SHA25679c7458ac1f075a4b3152418a50f1a8350d8d6433f4faee53a530fb39ff4d842
SHA51206060d3e0825a8288ede53fe3137819132814931a53aa4aa8b100ba677835f0080bf501d4de8d921d716875f8b087d5971019a2097c08afb4c272d9d00a0ab89
-
Filesize
6KB
MD5556380223a2ca0a7f1122bb7c15d7d10
SHA1c10b784877669cc0765b9a15db1caaeea843e89b
SHA2564f3452607bec0b2bbcbbe22c7ddd1123b33fc83913e5a6d96ecd7280efa02ef8
SHA512b5769e0b33bd3b21e831b2ddb75fd881b5f475d02bfc372df17499cf8cf1472769ae80137e9f083047e89b9efa5342b9ddb061d93e08e19e66fae9b4d07add35
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56f78571df6897420c20088923f57f2cf
SHA1cbcb1834b1bb41ed31b8dcfa2d00952b70aa4f68
SHA256d248f8d4b373739e7684e77b349e92b0aaf99761633607e773b6187454bcd965
SHA5122ab4095158e46a137f77c429dd20508ad782b2cd0d7740871a884977688c7ac8e8c98af80b97d981f8e17480b5a50e2449a1277de5bea2986752ad3e68561f0a