Analysis
-
max time kernel
130s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe
Resource
win10v2004-20220901-en
General
-
Target
84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe
-
Size
226KB
-
MD5
0d13f8270761d939d0170e7c079d1f32
-
SHA1
21aa183e1de96e0d73ad7b43107be043cca172db
-
SHA256
84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828
-
SHA512
f68bf97a2cee8aceb3ac41b068a5d5e58b1621c33db2be6dcc9bece64ce83d41e3be3ae565e0b795e290a6369306d44f8f8b43f56d77d8d5418e6b4ac11bc66b
-
SSDEEP
3072:obpDCw1p3vmLvsZIaVwiwDcIbDHDCm/DER4eQyMWoe0c8TilDcq1svVuaulvCN:gDCwfG1bnxLERRh5yc8TO91XFi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hosts.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" avscan.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hosts.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe -
Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IYMUGYHL = "W_X_C.bat" WScript.exe -
Executes dropped EXE 6 IoCs
pid Process 1348 avscan.exe 3140 avscan.exe 2032 hosts.exe 1280 hosts.exe 3076 avscan.exe 4764 hosts.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run hosts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" hosts.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run avscan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe" avscan.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\windows\W_X_C.vbs 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe File created \??\c:\windows\W_X_C.bat 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe File opened for modification C:\Windows\hosts.exe 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe File opened for modification C:\Windows\hosts.exe avscan.exe File opened for modification C:\Windows\hosts.exe hosts.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe -
Modifies registry key 1 TTPs 9 IoCs
pid Process 4572 REG.exe 2176 REG.exe 3740 REG.exe 3424 REG.exe 860 REG.exe 5088 REG.exe 3252 REG.exe 676 REG.exe 4480 REG.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1348 avscan.exe 1280 hosts.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 1348 avscan.exe 3140 avscan.exe 2032 hosts.exe 1280 hosts.exe 3076 avscan.exe 4764 hosts.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2176 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 81 PID 2356 wrote to memory of 2176 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 81 PID 2356 wrote to memory of 2176 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 81 PID 2356 wrote to memory of 1348 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 83 PID 2356 wrote to memory of 1348 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 83 PID 2356 wrote to memory of 1348 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 83 PID 1348 wrote to memory of 3140 1348 avscan.exe 84 PID 1348 wrote to memory of 3140 1348 avscan.exe 84 PID 1348 wrote to memory of 3140 1348 avscan.exe 84 PID 1348 wrote to memory of 4560 1348 avscan.exe 85 PID 1348 wrote to memory of 4560 1348 avscan.exe 85 PID 1348 wrote to memory of 4560 1348 avscan.exe 85 PID 2356 wrote to memory of 3300 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 86 PID 2356 wrote to memory of 3300 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 86 PID 2356 wrote to memory of 3300 2356 84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe 86 PID 4560 wrote to memory of 2032 4560 cmd.exe 90 PID 4560 wrote to memory of 2032 4560 cmd.exe 90 PID 4560 wrote to memory of 2032 4560 cmd.exe 90 PID 3300 wrote to memory of 1280 3300 cmd.exe 89 PID 3300 wrote to memory of 1280 3300 cmd.exe 89 PID 3300 wrote to memory of 1280 3300 cmd.exe 89 PID 1280 wrote to memory of 3076 1280 hosts.exe 91 PID 1280 wrote to memory of 3076 1280 hosts.exe 91 PID 1280 wrote to memory of 3076 1280 hosts.exe 91 PID 1280 wrote to memory of 2376 1280 hosts.exe 93 PID 1280 wrote to memory of 2376 1280 hosts.exe 93 PID 1280 wrote to memory of 2376 1280 hosts.exe 93 PID 4560 wrote to memory of 516 4560 cmd.exe 94 PID 4560 wrote to memory of 516 4560 cmd.exe 94 PID 4560 wrote to memory of 516 4560 cmd.exe 94 PID 3300 wrote to memory of 2572 3300 cmd.exe 96 PID 3300 wrote to memory of 2572 3300 cmd.exe 96 PID 3300 wrote to memory of 2572 3300 cmd.exe 96 PID 2376 wrote to memory of 4764 2376 cmd.exe 97 PID 2376 wrote to memory of 4764 2376 cmd.exe 97 PID 2376 wrote to memory of 4764 2376 cmd.exe 97 PID 2376 wrote to memory of 3132 2376 cmd.exe 98 PID 2376 wrote to memory of 3132 2376 cmd.exe 98 PID 2376 wrote to memory of 3132 2376 cmd.exe 98 PID 1348 wrote to memory of 3740 1348 avscan.exe 106 PID 1348 wrote to memory of 3740 1348 avscan.exe 106 PID 1348 wrote to memory of 3740 1348 avscan.exe 106 PID 1280 wrote to memory of 3424 1280 hosts.exe 108 PID 1280 wrote to memory of 3424 1280 hosts.exe 108 PID 1280 wrote to memory of 3424 1280 hosts.exe 108 PID 1348 wrote to memory of 3252 1348 avscan.exe 110 PID 1348 wrote to memory of 3252 1348 avscan.exe 110 PID 1348 wrote to memory of 3252 1348 avscan.exe 110 PID 1280 wrote to memory of 676 1280 hosts.exe 112 PID 1280 wrote to memory of 676 1280 hosts.exe 112 PID 1280 wrote to memory of 676 1280 hosts.exe 112 PID 1348 wrote to memory of 4480 1348 avscan.exe 114 PID 1348 wrote to memory of 4480 1348 avscan.exe 114 PID 1348 wrote to memory of 4480 1348 avscan.exe 114 PID 1280 wrote to memory of 860 1280 hosts.exe 116 PID 1280 wrote to memory of 860 1280 hosts.exe 116 PID 1280 wrote to memory of 860 1280 hosts.exe 116 PID 1348 wrote to memory of 5088 1348 avscan.exe 118 PID 1348 wrote to memory of 5088 1348 avscan.exe 118 PID 1348 wrote to memory of 5088 1348 avscan.exe 118 PID 1280 wrote to memory of 4572 1280 hosts.exe 121 PID 1280 wrote to memory of 4572 1280 hosts.exe 121 PID 1280 wrote to memory of 4572 1280 hosts.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe"C:\Users\Admin\AppData\Local\Temp\84f9e3fe3e45d1ec2809a510ac1bd2a813cd3464bb9a8dee1857a5ff306b2828.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f2⤵
- Modifies registry key
PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\hosts.exeC:\windows\hosts.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"4⤵
- Adds policy Run key to start application
PID:516
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3740
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:3252
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:4480
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f3⤵
- Modifies registry key
PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\hosts.exeC:\windows\hosts.exe3⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\avscan.exeC:\Users\Admin\AppData\Local\Temp\avscan.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\hosts.exeC:\windows\hosts.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4764
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"5⤵
- Adds policy Run key to start application
PID:3132
-
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- Modifies registry key
PID:3424
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- Modifies registry key
PID:676
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- Modifies registry key
PID:860
-
-
C:\Windows\SysWOW64\REG.exeREG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f4⤵
- Modifies registry key
PID:4572
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"3⤵
- Adds policy Run key to start application
PID:2572
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD56a80d904e699b4b77152e28f8509878c
SHA1f44ebc5b007493372b96524487b48fcec65e5020
SHA256a2777bc53285dcf15296aec112bf697d2856ade26667e03501a38edc9957ed80
SHA5129a3acdebd3ae28a144cc3485efa733ef523c404699bac4947975c7e4cd4c8280be75d790931f5a6fe473707f39d822df0867c36e974fc484b0f416ee6c72ecdd
-
Filesize
226KB
MD56a80d904e699b4b77152e28f8509878c
SHA1f44ebc5b007493372b96524487b48fcec65e5020
SHA256a2777bc53285dcf15296aec112bf697d2856ade26667e03501a38edc9957ed80
SHA5129a3acdebd3ae28a144cc3485efa733ef523c404699bac4947975c7e4cd4c8280be75d790931f5a6fe473707f39d822df0867c36e974fc484b0f416ee6c72ecdd
-
Filesize
226KB
MD56a80d904e699b4b77152e28f8509878c
SHA1f44ebc5b007493372b96524487b48fcec65e5020
SHA256a2777bc53285dcf15296aec112bf697d2856ade26667e03501a38edc9957ed80
SHA5129a3acdebd3ae28a144cc3485efa733ef523c404699bac4947975c7e4cd4c8280be75d790931f5a6fe473707f39d822df0867c36e974fc484b0f416ee6c72ecdd
-
Filesize
226KB
MD56a80d904e699b4b77152e28f8509878c
SHA1f44ebc5b007493372b96524487b48fcec65e5020
SHA256a2777bc53285dcf15296aec112bf697d2856ade26667e03501a38edc9957ed80
SHA5129a3acdebd3ae28a144cc3485efa733ef523c404699bac4947975c7e4cd4c8280be75d790931f5a6fe473707f39d822df0867c36e974fc484b0f416ee6c72ecdd
-
Filesize
195B
MD50e0483d4802632100b6bfe8bc2e5d661
SHA1767e0deb7dcaa7676004e6053957c36cecfeeefa
SHA25681bbebb8d0e77ffffbc7b7d24afdcdce4089f4b04d1a12284eda861c25e03f9f
SHA5128279b0559ca30a0adc6c8614870c3e445866c20f0617a7153cab41982b451dfe9ea44478f37b884465235714623ef26a56f5ea3d1cb81767487c494d3703ab29
-
Filesize
226KB
MD596079c82cb2b799c208a4ef0d90581a9
SHA1bff7b19a889096d4eaaf971053ca09aba594c375
SHA25612565d37a4bffa0eacf3068e50b8e81c39f0f484117aba987cc6ea041a20517d
SHA51286bee8c1851f1cda7eb80ddbfb5dd313ab9b0ba66134b944053decd036e1414ed625f99cc827a08d4a695ac2ead1a05799ab21cd4728e85b623b7c78f7f0fc07
-
Filesize
226KB
MD596079c82cb2b799c208a4ef0d90581a9
SHA1bff7b19a889096d4eaaf971053ca09aba594c375
SHA25612565d37a4bffa0eacf3068e50b8e81c39f0f484117aba987cc6ea041a20517d
SHA51286bee8c1851f1cda7eb80ddbfb5dd313ab9b0ba66134b944053decd036e1414ed625f99cc827a08d4a695ac2ead1a05799ab21cd4728e85b623b7c78f7f0fc07
-
Filesize
226KB
MD596079c82cb2b799c208a4ef0d90581a9
SHA1bff7b19a889096d4eaaf971053ca09aba594c375
SHA25612565d37a4bffa0eacf3068e50b8e81c39f0f484117aba987cc6ea041a20517d
SHA51286bee8c1851f1cda7eb80ddbfb5dd313ab9b0ba66134b944053decd036e1414ed625f99cc827a08d4a695ac2ead1a05799ab21cd4728e85b623b7c78f7f0fc07
-
Filesize
226KB
MD596079c82cb2b799c208a4ef0d90581a9
SHA1bff7b19a889096d4eaaf971053ca09aba594c375
SHA25612565d37a4bffa0eacf3068e50b8e81c39f0f484117aba987cc6ea041a20517d
SHA51286bee8c1851f1cda7eb80ddbfb5dd313ab9b0ba66134b944053decd036e1414ed625f99cc827a08d4a695ac2ead1a05799ab21cd4728e85b623b7c78f7f0fc07
-
Filesize
226KB
MD596079c82cb2b799c208a4ef0d90581a9
SHA1bff7b19a889096d4eaaf971053ca09aba594c375
SHA25612565d37a4bffa0eacf3068e50b8e81c39f0f484117aba987cc6ea041a20517d
SHA51286bee8c1851f1cda7eb80ddbfb5dd313ab9b0ba66134b944053decd036e1414ed625f99cc827a08d4a695ac2ead1a05799ab21cd4728e85b623b7c78f7f0fc07
-
Filesize
336B
MD54db9f8b6175722b62ececeeeba1ce307
SHA13b3ba8414706e72a6fa19e884a97b87609e11e47
SHA256d2150b9e5a4ce55e140f0ca91c4e300715d42095c8fddf58c77037cdd2cfaf78
SHA5121d6dc274cf7a3dd704f840e6a5ad57ab4c4e35d5f09489aeff520bb797e1c825bac53fc335156fe41e767a46520d031855fe42fe7b175409ebe5e9e986fb9b8b