Analysis
-
max time kernel
181s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.716a71520fa639d55468d6f922470670.exe
Resource
win7-20230831-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.716a71520fa639d55468d6f922470670.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
NEAS.716a71520fa639d55468d6f922470670.exe
-
Size
42KB
-
MD5
716a71520fa639d55468d6f922470670
-
SHA1
06eef4f37e7e6f441b39b3dfc4538ec880b33163
-
SHA256
9a9609eb913e831f14279a1565d22efaa5ead119a3b49703651c459b97908e40
-
SHA512
5c59c9f367277eca6358e0a7dfc229cd6dceca33ca58bfe300ad80002bd003daa15a186441d6618f20ae8b8154be14a89df87712e9cdbff62aeadbd8a8c079ec
-
SSDEEP
768:C/+8ldkxYXO5lsvhBznbcuyD7UTy3wy3BEywe00:6+8ldkxOO5Sv/znouy8Tuzuw
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" NEAS.716a71520fa639d55468d6f922470670.exe -
Sets file execution options in registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\WINDOWS\\Fonts.exe" NEAS.716a71520fa639d55468d6f922470670.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dxdiag.exe NEAS.716a71520fa639d55468d6f922470670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dxdiag.exe\Debugger = "C:\\WINDOWS\\Fonts.exe" NEAS.716a71520fa639d55468d6f922470670.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe NEAS.716a71520fa639d55468d6f922470670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\WINDOWS\\Fonts.exe" NEAS.716a71520fa639d55468d6f922470670.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe NEAS.716a71520fa639d55468d6f922470670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Fonts.exe" NEAS.716a71520fa639d55468d6f922470670.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe NEAS.716a71520fa639d55468d6f922470670.exe -
Drops file in Program Files directory 44 IoCs
description ioc Process File created C:\Program Files\Thumbs.db NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Media Player NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Photo Viewer NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Common Files NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Internet Explorer.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\ModifiableWindowsApps NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\VideoLAN NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Mail.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Google NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Internet Explorer NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Microsoft Office.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\MSBuild.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\MSBuild NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows NT NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Photo Viewer.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Common Files.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Google.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Java.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Reference Assemblies.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Multimedia Platform NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Security.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Microsoft Office NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Mozilla Firefox NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\VideoLAN.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Mail NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows NT.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Portable Devices NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Security NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\WindowsPowerShell NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\7-Zip NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Microsoft Office 15.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\ModifiableWindowsApps.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Defender.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Portable Devices.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Thumbs.db NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Mozilla Firefox.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Media Player.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Multimedia Platform.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\7-Zip.exe NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Java NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Microsoft Office 15 NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Reference Assemblies NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\Windows Defender NEAS.716a71520fa639d55468d6f922470670.exe File opened for modification C:\Program Files\WindowsPowerShell.exe NEAS.716a71520fa639d55468d6f922470670.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\Fonts.exe NEAS.716a71520fa639d55468d6f922470670.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe -
Modifies registry class 38 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005457219112004170704461746100400009000400efbe54572191565753a52e00000086e10100000001000000000000000000000000000000733edc004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000005457c29310004c6f63616c003c0009000400efbe54572191565753a52e00000099e1010000000100000000000000000000000000000043dba6004c006f00630061006c00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 9600310000000000565752a512004e4541537e312e37313600007c0009000400efbe565752a5565752a52e000000222e0200000007000000000000000000000000000000f43e02004e004500410053002e003700310036006100370031003500320030006600610036003300390064003500350034003600380064003600660039003200320034003700300036003700300000001a000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000054579a9e100041646d696e003c0009000400efbe5457219156574da52e0000007be101000000010000000000000000000000000000009826f000410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000565752a5100054656d7000003a0009000400efbe54572191565753a52e0000009ae10100000001000000000000000000000000000000f43e0200540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000545721911100557365727300640009000400efbe874f774856574da52e000000c70500000000010000000000000000003a00000000007ab3f10055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2888 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2888 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4364 NEAS.716a71520fa639d55468d6f922470670.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4364 NEAS.716a71520fa639d55468d6f922470670.exe 2888 explorer.exe 2888 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4364 wrote to memory of 3132 4364 NEAS.716a71520fa639d55468d6f922470670.exe 87 PID 4364 wrote to memory of 3132 4364 NEAS.716a71520fa639d55468d6f922470670.exe 87 PID 4364 wrote to memory of 3132 4364 NEAS.716a71520fa639d55468d6f922470670.exe 87 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" NEAS.716a71520fa639d55468d6f922470670.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NEAS.716a71520fa639d55468d6f922470670.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.716a71520fa639d55468d6f922470670.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.716a71520fa639d55468d6f922470670.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Sets file execution options in registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4364 -
C:\Windows\SysWOW64\Explorer.exeExplorer C:\Users\Admin\AppData\Local\Temp\NEAS.716a71520fa639d55468d6f9224706702⤵PID:3132
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD54f5b5e300d291ba424bef7501e8cb8c3
SHA1cdbfd961d34facd16411114b03201dd7214d3229
SHA2564bf868fb0e7f5b616bc4699fe2df93b51f6f5cc44fe8e6adeac3f42b75e3c9cc
SHA512ecdab352fb5e8bcbbed2863fc5b00714fde849bc9e29f0c693ae9620808bd56aff165900a645834d47749005ecccb08cb6edab528c11b9ed46f450baccf74756
-
Filesize
13B
MD53579c8da7f1e0ad94656e76c886e5125
SHA183eb531bfd10f917770441c7f548dcd841e70fdd
SHA256b08022d315cf1eb12d2665bded0e6af40653c0a0be975232fb49bcbd021cfc36
SHA5123493fa6334931c1e41e0e9d0621949c8bfd33c72811b3407e47c17fb55864a0710ae094bb0d547f19ec23d7626f04fe620ed478ada1d88e6647794063036388d
-
Filesize
22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
Filesize
25KB
MD5e52a7eae444d1b53e9cbf40a2e1bb49b
SHA16ba897d52af5014375656237089bfae3fc0a612d
SHA2565f3dc464f5058cd1f08c9960674d80e06523743c882d51d3a0f6c0073bed4202
SHA5126b11dc22736d149b13f6a1cfaeb8505513ec32292fd8d03dda1a97af57898b6bc8bf28c337b503c46a2c888c554d53fd967615666fccab9fbadca7884f5ed1dc