Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 19:30
Static task
static1
Behavioral task
behavioral1
Sample
5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe
Resource
win10v2004-20230915-en
General
-
Target
5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe
-
Size
5.4MB
-
MD5
3d29e9cdd2a9d76e57e8a3f9e6ed3643
-
SHA1
5ad94f5303aed57a9d4f0055f15076454840064a
-
SHA256
5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd
-
SHA512
942bbbdbaf823329d65dd5ae58a2ec6098b5b35203523aae2c4bf47875730f346e0511a38983dfa8d9673752a546a5bfb4690a145d17a7d2b03f6fe8c659403f
-
SSDEEP
98304:R4Hf6JMfWTMVWWqoMVBk+B4D79mXPepfDgsC8yVP2SuxHf846FAP01B7ZVzO:R4HFtqrVm+B4D7k94LHf8FAKc
Malware Config
Extracted
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\HOW TO RESTORE YOUR FILES.TXT
Signatures
-
Detecting the common Go functions and variables names used by Snatch ransomware 29 IoCs
resource yara_rule behavioral2/memory/4020-1-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-14-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-15-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-16-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-19-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-24-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-25-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-63-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-64-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-65-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-66-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-67-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-68-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-69-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-70-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-71-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-72-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-73-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-74-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-75-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-76-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-82-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-83-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-84-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-85-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-86-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-87-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-225-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch behavioral2/memory/4020-1310-0x0000000002E40000-0x0000000003320000-memory.dmp family_snatch -
Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
-
Renames multiple (4342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\21FFBADC-6803-4563-8A96-A9DDD149D155\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\ffjcext.zip 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\cardflipped.dat 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-125.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_sv.properties 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_wel_motionAsset.m4v 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-60_altform-lightunplated.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-200_contrast-black.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\173.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\org-openide-filesystems.jar.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Hedge.dxt 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\remixCTA_welcome.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.kdtlavbjqo 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO RESTORE YOUR FILES.TXT 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\LibWrapper.winmd 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_MouseEar.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sun.png 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3968 sc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4020 wrote to memory of 1264 4020 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe 85 PID 4020 wrote to memory of 1264 4020 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe 85 PID 1264 wrote to memory of 3968 1264 cmd.exe 87 PID 1264 wrote to memory of 3968 1264 cmd.exe 87 PID 1264 wrote to memory of 1384 1264 cmd.exe 88 PID 1264 wrote to memory of 1384 1264 cmd.exe 88 PID 4020 wrote to memory of 2344 4020 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe 89 PID 4020 wrote to memory of 2344 4020 5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe"C:\Users\Admin\AppData\Local\Temp\5950b4e27554585123d7fca44e83169375c6001201e3bf26e57d079437e70bcd.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dronbpckdsbrk.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\sc.exeSC QUERY3⤵
- Launches sc.exe
PID:3968
-
-
C:\Windows\system32\findstr.exeFINDSTR SERVICE_NAME3⤵PID:1384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icbyjydkdosmvree.bat2⤵PID:2344
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD551c08d5554f9f1f08ae6d6459418f5cf
SHA15f3b81daf238348c3d85c5558aa2d44ae1925328
SHA256032b6e54166e5621813dea997d5186db8762985a714601f19fa6ef8fdd7370a2
SHA5126300cf927c70e6757028b489cad2eba0d2a9a0de2e09ce367d584491a9a11a374bc26c630620ee409ebc39a3b6ad81f23021001763a10de810cc3d95fd6e3238
-
Filesize
43B
MD555310bb774fff38cca265dbc70ad6705
SHA1cb8d76e9fd38a0b253056e5f204dab5441fe932b
SHA2561fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d
SHA51240e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4