Analysis
-
max time kernel
228s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe
Resource
win7-20221111-en
windows7-x64
21 signatures
150 seconds
General
-
Target
dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe
-
Size
1.5MB
-
MD5
0f6e0c6f05c337592a113d9d86bfe774
-
SHA1
989df4383d42ad26fe7de744157d93756f89f6cf
-
SHA256
dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80
-
SHA512
13d1d2ae655dcc7b8b6558ec842326749afa15275bed4b01fadcdb89eadd1d8779c11d421b425f6fb1bcdf210881912ce3af54b934e1c6171fba16bf5cd0cf4c
-
SSDEEP
24576:atb20pkaCqT5TBWgNQ7aABEC6AbZKrzm5bFxz5q8gZNR8:HVg5tQ7aAd58zm5hN5q1ZL8
Malware Config
Extracted
Family
darkcomet
Botnet
By-02
C2
perimetronew.ddns.net:5588
Mutex
DC_MUTEX-58GZCKN
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Rm9Mj5Grbvs3
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
JavaUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
pid Process 1544 msdcsc.exe 988 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1556 attrib.exe 1448 attrib.exe -
Deletes itself 1 IoCs
pid Process 896 notepad.exe -
Loads dropped DLL 1 IoCs
pid Process 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000a0000000122f4-69.dat autoit_exe behavioral1/files/0x000a0000000122f4-71.dat autoit_exe behavioral1/files/0x000a0000000122f4-73.dat autoit_exe behavioral1/files/0x000a0000000122f4-78.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1324 set thread context of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1544 set thread context of 988 1544 msdcsc.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeSecurityPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeTakeOwnershipPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeLoadDriverPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeSystemProfilePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeSystemtimePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeProfSingleProcessPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeIncBasePriorityPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeCreatePagefilePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeBackupPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeRestorePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeShutdownPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeDebugPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeSystemEnvironmentPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeChangeNotifyPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeRemoteShutdownPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeUndockPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeManageVolumePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeImpersonatePrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeCreateGlobalPrivilege 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: 33 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: 34 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: 35 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe Token: SeIncreaseQuotaPrivilege 988 msdcsc.exe Token: SeSecurityPrivilege 988 msdcsc.exe Token: SeTakeOwnershipPrivilege 988 msdcsc.exe Token: SeLoadDriverPrivilege 988 msdcsc.exe Token: SeSystemProfilePrivilege 988 msdcsc.exe Token: SeSystemtimePrivilege 988 msdcsc.exe Token: SeProfSingleProcessPrivilege 988 msdcsc.exe Token: SeIncBasePriorityPrivilege 988 msdcsc.exe Token: SeCreatePagefilePrivilege 988 msdcsc.exe Token: SeBackupPrivilege 988 msdcsc.exe Token: SeRestorePrivilege 988 msdcsc.exe Token: SeShutdownPrivilege 988 msdcsc.exe Token: SeDebugPrivilege 988 msdcsc.exe Token: SeSystemEnvironmentPrivilege 988 msdcsc.exe Token: SeChangeNotifyPrivilege 988 msdcsc.exe Token: SeRemoteShutdownPrivilege 988 msdcsc.exe Token: SeUndockPrivilege 988 msdcsc.exe Token: SeManageVolumePrivilege 988 msdcsc.exe Token: SeImpersonatePrivilege 988 msdcsc.exe Token: SeCreateGlobalPrivilege 988 msdcsc.exe Token: 33 988 msdcsc.exe Token: 34 988 msdcsc.exe Token: 35 988 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 988 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1324 wrote to memory of 1044 1324 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 28 PID 1044 wrote to memory of 1352 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 29 PID 1044 wrote to memory of 1352 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 29 PID 1044 wrote to memory of 1352 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 29 PID 1044 wrote to memory of 1352 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 29 PID 1044 wrote to memory of 792 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 33 PID 1044 wrote to memory of 792 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 33 PID 1044 wrote to memory of 792 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 33 PID 1044 wrote to memory of 792 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 33 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1044 wrote to memory of 896 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 32 PID 1352 wrote to memory of 1556 1352 cmd.exe 34 PID 1352 wrote to memory of 1556 1352 cmd.exe 34 PID 1352 wrote to memory of 1556 1352 cmd.exe 34 PID 1352 wrote to memory of 1556 1352 cmd.exe 34 PID 792 wrote to memory of 1448 792 cmd.exe 35 PID 792 wrote to memory of 1448 792 cmd.exe 35 PID 792 wrote to memory of 1448 792 cmd.exe 35 PID 792 wrote to memory of 1448 792 cmd.exe 35 PID 1044 wrote to memory of 1544 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 36 PID 1044 wrote to memory of 1544 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 36 PID 1044 wrote to memory of 1544 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 36 PID 1044 wrote to memory of 1544 1044 dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe 36 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 1544 wrote to memory of 988 1544 msdcsc.exe 37 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 PID 988 wrote to memory of 812 988 msdcsc.exe 38 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1556 attrib.exe 1448 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe"C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe"C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1556
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
PID:896
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1448
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:988 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:812
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD50f6e0c6f05c337592a113d9d86bfe774
SHA1989df4383d42ad26fe7de744157d93756f89f6cf
SHA256dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80
SHA51213d1d2ae655dcc7b8b6558ec842326749afa15275bed4b01fadcdb89eadd1d8779c11d421b425f6fb1bcdf210881912ce3af54b934e1c6171fba16bf5cd0cf4c
-
Filesize
1.5MB
MD50f6e0c6f05c337592a113d9d86bfe774
SHA1989df4383d42ad26fe7de744157d93756f89f6cf
SHA256dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80
SHA51213d1d2ae655dcc7b8b6558ec842326749afa15275bed4b01fadcdb89eadd1d8779c11d421b425f6fb1bcdf210881912ce3af54b934e1c6171fba16bf5cd0cf4c
-
Filesize
1.5MB
MD50f6e0c6f05c337592a113d9d86bfe774
SHA1989df4383d42ad26fe7de744157d93756f89f6cf
SHA256dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80
SHA51213d1d2ae655dcc7b8b6558ec842326749afa15275bed4b01fadcdb89eadd1d8779c11d421b425f6fb1bcdf210881912ce3af54b934e1c6171fba16bf5cd0cf4c
-
Filesize
1.5MB
MD50f6e0c6f05c337592a113d9d86bfe774
SHA1989df4383d42ad26fe7de744157d93756f89f6cf
SHA256dac995a764d23188fce47f1108c9a1c5d9e4dcabc53ade2aeaaba850d8348f80
SHA51213d1d2ae655dcc7b8b6558ec842326749afa15275bed4b01fadcdb89eadd1d8779c11d421b425f6fb1bcdf210881912ce3af54b934e1c6171fba16bf5cd0cf4c