Analysis
-
max time kernel
161s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 10:08
Behavioral task
behavioral1
Sample
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe
Resource
win10v2004-20240226-en
General
-
Target
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe
-
Size
1.1MB
-
MD5
6c660f960daac148be75427c712d0134
-
SHA1
b3c597060abc20d3b3291f8b5252a3834d49b92f
-
SHA256
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6
-
SHA512
48806df9787497cbf55a85a523c8e703aec1bb262c60a019ab45f420a87d016054a97dc428484bd5c2f7ba1c3f57a37d807fc4e1de487dbef1c76dc38fbf8fe0
-
SSDEEP
24576:du13Ii3FoHjrdVIxpxJbpvR+h8O+DB8lll7IbbbbpcMs:du3IDHjrdVIxpxhe8O68Ll7IbbbbpcM
Malware Config
Extracted
C:\Users\Admin\Desktop\128380-readme.html
avaddon
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe family_avaddon -
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Renames multiple (145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exepid process 3216 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process File opened (read-only) \??\L: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\U: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\V: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\A: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\G: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\J: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\K: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\X: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\E: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\H: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\N: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\O: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\Z: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\B: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\P: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\S: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\Y: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\T: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\W: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\I: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\M: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\Q: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe File opened (read-only) \??\R: fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.myip.com 28 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exepid process 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 408 wmic.exe Token: SeSecurityPrivilege 408 wmic.exe Token: SeTakeOwnershipPrivilege 408 wmic.exe Token: SeLoadDriverPrivilege 408 wmic.exe Token: SeSystemProfilePrivilege 408 wmic.exe Token: SeSystemtimePrivilege 408 wmic.exe Token: SeProfSingleProcessPrivilege 408 wmic.exe Token: SeIncBasePriorityPrivilege 408 wmic.exe Token: SeCreatePagefilePrivilege 408 wmic.exe Token: SeBackupPrivilege 408 wmic.exe Token: SeRestorePrivilege 408 wmic.exe Token: SeShutdownPrivilege 408 wmic.exe Token: SeDebugPrivilege 408 wmic.exe Token: SeSystemEnvironmentPrivilege 408 wmic.exe Token: SeRemoteShutdownPrivilege 408 wmic.exe Token: SeUndockPrivilege 408 wmic.exe Token: SeManageVolumePrivilege 408 wmic.exe Token: 33 408 wmic.exe Token: 34 408 wmic.exe Token: 35 408 wmic.exe Token: 36 408 wmic.exe Token: SeIncreaseQuotaPrivilege 880 wmic.exe Token: SeSecurityPrivilege 880 wmic.exe Token: SeTakeOwnershipPrivilege 880 wmic.exe Token: SeLoadDriverPrivilege 880 wmic.exe Token: SeSystemProfilePrivilege 880 wmic.exe Token: SeSystemtimePrivilege 880 wmic.exe Token: SeProfSingleProcessPrivilege 880 wmic.exe Token: SeIncBasePriorityPrivilege 880 wmic.exe Token: SeCreatePagefilePrivilege 880 wmic.exe Token: SeBackupPrivilege 880 wmic.exe Token: SeRestorePrivilege 880 wmic.exe Token: SeShutdownPrivilege 880 wmic.exe Token: SeDebugPrivilege 880 wmic.exe Token: SeSystemEnvironmentPrivilege 880 wmic.exe Token: SeRemoteShutdownPrivilege 880 wmic.exe Token: SeUndockPrivilege 880 wmic.exe Token: SeManageVolumePrivilege 880 wmic.exe Token: 33 880 wmic.exe Token: 34 880 wmic.exe Token: 35 880 wmic.exe Token: 36 880 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription pid process target process PID 2296 wrote to memory of 408 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 408 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 408 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 880 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 880 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 880 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 1448 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 1448 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe PID 2296 wrote to memory of 1448 2296 fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe wmic.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe"C:\Users\Admin\AppData\Local\Temp\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exeC:\Users\Admin\AppData\Roaming\Microsoft\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6.exeFilesize
1.1MB
MD56c660f960daac148be75427c712d0134
SHA1b3c597060abc20d3b3291f8b5252a3834d49b92f
SHA256fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6
SHA51248806df9787497cbf55a85a523c8e703aec1bb262c60a019ab45f420a87d016054a97dc428484bd5c2f7ba1c3f57a37d807fc4e1de487dbef1c76dc38fbf8fe0
-
C:\Users\Admin\Desktop\128380-readme.htmlFilesize
50KB
MD5ccb77336b0e11c90238dc19c5caa3e80
SHA1d2996ff696335b14df9a047c7fbfd02b570dfaaa
SHA2569fccab71b553260ec0a0e96363acd12b60f68c209dcc80775784a670a927745c
SHA5122df6d5c9361e3df8ddfa14181ef7056a3e8a0df210e51bb4ca92be8810353a950a8d24e137f1fd52595a9b7fc178ff260a5c72aa9c86d386276585ccf00fd0ec