Overview

overview

10

Static

static

10

c14dd4a083...28.exe

windows7-x64

10

c14dd4a083...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 13:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe

  • Size

    483KB

  • MD5

    53717dc73f61b0f9551cb62d6fca2e4a

  • SHA1

    1ca9304e86632b147852767c85c57e08bdfc8855

  • SHA256

    c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028

  • SHA512

    ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552

  • SSDEEP

    12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy

Score
10/10
avaddonransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\vncx2_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BdABBABDAE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS1RMkY1anR2TmpTdXNGay9iSTZEVWx0M3ZGZGU5VWhFWTVROGUzcFM0WWF6bW9WWk15QUVqK2tWaTVnNDZ1VnYyUUVDVHFwcTJUN3l5RVpRaHo2UGNMNkxtZ2N6aS9qblRwbEtiNURiWFFOQ1hwVGJtVHYzcDY4MHRvSHRWcHpYMHoyYmFxSmxhMUlpT1JpZ3VkcVNXOVBGQVY4bXQxOXZxTktoRlNQS2I4MXBEVGZYcGVHMFkrR3VsZ2dZajZ5QlF6dldOakdZR2lWMko5T2gvM3U0NGhCU0dWRVRLYXkwdUtjTDRzYVRqWGJZaFJjQkhJYndhSFh3N1VGVEwreXM5WVFBNDR2MEw2RWhBeEhnb1BYY3NkcFZyN1pXNkFHU2tQL0xUUGFPU0thRGVDUHJaaXBuWFFIbWlmY29zN3VuanFocmVRR3haVWZXaXZyeEhqZ3FjdEo3VkhvUlRvTUxRdXp2VUtVSENuNzZvRDExdDA2UWdTWGdpSXBMUlh0RDhwUFlFSXZhOWgwTDJLcUp2MUM5UzRaM1Z1cC9pcHJ6bytZbGM3dmRIcThEZi9Idk53dEtKRG5tRUhhSVloRTdvVWxVWDJablAxSnVRWWY1WVVRZWFqUDI3cVMrSTQxL1lPNGRiemJvelFLaTlYMEttZjdSM3dIZGtGZ2NQVDdha2J0V3pCSkxoSUdBRUppQ3luUExpMFZUanp3bXV5S3ZFZytTNit5Z0tvK29GMC9nQWRqRnJWMER6Nlc0cHFGSWtNcW9kS1doTlI5RTZGZWpadVJhT21WQVFyVHRRUlZDTDR2K1ZnUnl6Y1JPQmNZUDQzTHJFbW12ekxzcUh3VmxzcTZvU2REMFpXcFpvS0o0czNkbjlEMFZCMndnOHdiNG9aSVJmUUd0Z05RdTNPcVg4eC8rK1pvMVQ0RnZqVVROVXdqSDlBS3ZaY212Wm9nOUNaRFcwODdhZnJ0d21MVUlVWWJ4N0t2QU9BZ0c2TS9lS1NaRG80NjJldE4vZ0JSRGJjTGVya3VCZ0cxdFFEWjRzVVdqWkw2K3NzdnVmaVhteng3NWY3aC9Id28vWk9uQmVJOVJEWGduZFdCMHBVU3VqaEZEbTJQaWZ0OFVZOVdUZWtqV1JTc0RQYis0bTJ6SzFVR1JENUx0OEJMaW9seTRJVGthS2JkYmtMSUdaOHFWMGtsc1lIcjNiMXdOYm91NktveUp3emdKTFFLMGxIYXpsZHhhdGNVNE1IQ1pjWFFPbjA4M0V4Y2VyRCtWUWo1REIyZ3VzbVpwQXZ5Vlh5YWdBUEx4bE9pVjl3SjArQmFRZDFSTUhWaUxVdWJUUVRNL0FsVGkyUm1nVU5hOWNlUGwzay9XYlpxbzN4VDBiL3RIemZzNzQ2b0NzTjZObTZTVEZ4dXlzT2xzdnF4MHdOaGZlL2xNSHJkUWxwQVJxY3hrWDdHd2dWcXNJeHFsdVBibDNteFh2c1dBOXRjWEFOTGZ2YmRpZkp1bnFUOXc4eWs2SmRrYlYyOXNRUU53aC8rVTRQQ2ZRT0tBaC9pNkRzaGVaQWlsQkorODFjbmhHUE5NTytpazNQNWpNbDh4dXM4VFpKT0RkaC9yTDlwV3dFZWt5a2NuNVA2U2RLQ3QwZ3ZTY2Mrc0RBY0xXRVhxcnBBSnBqNkVnM0cvWjJKaENGZi9uZVJuZkN0MlJLVFkwY05ibS9RTXZpN3JUbEFOOGp4NHBpUGZ6Rk1wakVhYk01T3ZlcTlrVHl6VkxPbjJTUlhSZml4UXVLaksyaDNYNFZwT2JlWTFsQ3RUS2tMcStleVFkMmlQbW5FcG5vQjZZU3AyR0QyVk1qaXFIZm9JNGlOc2hQUFY0LzRXZFFDNHd3Sk1CNkhaMjg3QVNiOU9ub3RvajdVQ3paSmk2Q0dOUVcreFFkRTQ5NVc2d0phL1dMNWx3YlNoTFkwSFdVWUMvMGt2WHh5cjRBbzVnNHZLa2VoYXVFanFnWldNMEdsODUyUVBJNkgwMVQ2OFplSGZCaXoyOWI1UTN4Rng1ZjlERFdZUTg0S3Y4REdiZ2diaXRXTmxaN2ZRamZmd29yT2p4dHJmMFNCNlRST1R0TnlxWGEwbnpUbUg1MUlDY3FEYlJOaUZFVEtUb0pHc0d4d1hEaDdtU2I4a0dJZz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * V9QX2
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Documents\vncx2_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BdABBABDAE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS1RMkY1anR2TmpTdXNGay9iSTZEVWx0M3ZGZGU5VWhFWTVROGUzcFM0WWF6bW9WWk15QUVqK2tWaTVnNDZ1VnYyUUVDVHFwcTJUN3l5RVpRaHo2UGNMNkxtZ2N6aS9qblRwbEtiNURiWFFOQ1hwVGJtVHYzcDY4MHRvSHRWcHpYMHoyYmFxSmxhMUlpT1JpZ3VkcVNXOVBGQVY4bXQxOXZxTktoRlNQS2I4MXBEVGZYcGVHMFkrR3VsZ2dZajZ5QlF6dldOakdZR2lWMko5T2gvM3U0NGhCU0dWRVRLYXkwdUtjTDRzYVRqWGJZaFJjQkhJYndhSFh3N1VGVEwreXM5WVFBNDR2MEw2RWhBeEhnb1BYY3NkcFZyN1pXNkFHU2tQL0xUUGFPU0thRGVDUHJaaXBuWFFIbWlmY29zN3VuanFocmVRR3haVWZXaXZyeEhqZ3FjdEo3VkhvUlRvTUxRdXp2VUtVSENuNzZvRDExdDA2UWdTWGdpSXBMUlh0RDhwUFlFSXZhOWgwTDJLcUp2MUM5UzRaM1Z1cC9pcHJ6bytZbGM3dmRIcThEZi9Idk53dEtKRG5tRUhhSVloRTdvVWxVWDJablAxSnVRWWY1WVVRZWFqUDI3cVMrSTQxL1lPNGRiemJvelFLaTlYMEttZjdSM3dIZGtGZ2NQVDdha2J0V3pCSkxoSUdBRUppQ3luUExpMFZUanp3bXV5S3ZFZytTNit5Z0tvK29GMC9nQWRqRnJWMER6Nlc0cHFGSWtNcW9kS1doTlI5RTZGZWpadVJhT21WQVFyVHRRUlZDTDR2K1ZnUnl6Y1JPQmNZUDQzTHJFbW12ekxzcUh3VmxzcTZvU2REMFpXcFpvS0o0czNkbjlEMFZCMndnOHdiNG9aSVJmUUd0Z05RdTNPcVg4eC8rK1pvMVQ0RnZqVVROVXdqSDlBS3ZaY212Wm9nOUNaRFcwODdhZnJ0d21MVUlVWWJ4N0t2QU9BZ0c2TS9lS1NaRG80NjJldE4vZ0JSRGJjTGVya3VCZ0cxdFFEWjRzVVdqWkw2K3NzdnVmaVhteng3NWY3aC9Id28vWk9uQmVJOVJEWGduZFdCMHBVU3VqaEZEbTJQaWZ0OFVZOVdUZWtqV1JTc0RQYis0bTJ6SzFVR1JENUx0OEJMaW9seTRJVGthS2JkYmtMSUdaOHFWMGtsc1lIcjNiMXdOYm91NktveUp3emdKTFFLMGxIYXpsZHhhdGNVNE1IQ1pjWFFPbjA4M0V4Y2VyRCtWUWo1REIyZ3VzbVpwQXZ5Vlh5YWdBUEx4bE9pVjl3SjArQmFRZDFSTUhWaUxVdWJUUVRNL0FsVGkyUm1nVU5hOWNlUGwzay9XYlpxbzN4VDBiL3RIemZzNzQ2b0NzTjZObTZTVEZ4dXlzT2xzdnF4MHdOaGZlL2xNSHJkUWxwQVJxY3hrWDdHd2dWcXNJeHFsdVBibDNteFh2c1dBOXRjWEFOTGZ2YmRpZkp1bnFUOXc4eWs2SmRrYlYyOXNRUU53aC8rVTRQQ2ZRT0tBaC9pNkRzaGVaQWlsQkorODFjbmhHUE5NTytpazNQNWpNbDh4dXM4VFpKT0RkaC9yTDlwV3dFZWt5a2NuNVA2U2RLQ3QwZ3ZTY2Mrc0RBY0xXRVhxcnBBSnBqNkVnM0cvWjJKaENGZi9uZVJuZkN0MlJLVFkwY05ibS9RTXZpN3JUbEFOOGp4NHBpUGZ6Rk1wakVhYk01T3ZlcTlrVHl6VkxPbjJTUlhSZml4UXVLaksyaDNYNFZwT2JlWTFsQ3RUS2tMcStleVFkMmlQbW5FcG5vQjZZU3AyR0QyVk1qaXFIZm9JNGlOc2hQUFY0LzRXZFFDNHd3Sk1CNkhaMjg3QVNiOU9ub3RvajdVQ3paSmk2Q0dOUVcreFFkRTQ5NVc2d0phL1dMNWx3YlNoTFkwSFdVWUMvMGt2WHh5cjRBbzVnNHZLa2VoYXVFanFnWldNMEdsODUyUVBJNkgwMVQ2OFplSGZCaXoyOWI1UTN4Rng1ZjlERFdZUTg0S3Y4REdiZ2diaXRXTmxaN2ZRamZmd29yT2p4dHJmMFNCNlRST1R0TnlxWGEwbnpUbUg1MUlDY3FEYlJOaUZFVEtUb0pHc0d4d1hEaDdtU2I4a0dJZz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * LIXtroCI
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Music\vncx2_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BdABBABDAE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS1RMkY1anR2TmpTdXNGay9iSTZEVWx0M3ZGZGU5VWhFWTVROGUzcFM0WWF6bW9WWk15QUVqK2tWaTVnNDZ1VnYyUUVDVHFwcTJUN3l5RVpRaHo2UGNMNkxtZ2N6aS9qblRwbEtiNURiWFFOQ1hwVGJtVHYzcDY4MHRvSHRWcHpYMHoyYmFxSmxhMUlpT1JpZ3VkcVNXOVBGQVY4bXQxOXZxTktoRlNQS2I4MXBEVGZYcGVHMFkrR3VsZ2dZajZ5QlF6dldOakdZR2lWMko5T2gvM3U0NGhCU0dWRVRLYXkwdUtjTDRzYVRqWGJZaFJjQkhJYndhSFh3N1VGVEwreXM5WVFBNDR2MEw2RWhBeEhnb1BYY3NkcFZyN1pXNkFHU2tQL0xUUGFPU0thRGVDUHJaaXBuWFFIbWlmY29zN3VuanFocmVRR3haVWZXaXZyeEhqZ3FjdEo3VkhvUlRvTUxRdXp2VUtVSENuNzZvRDExdDA2UWdTWGdpSXBMUlh0RDhwUFlFSXZhOWgwTDJLcUp2MUM5UzRaM1Z1cC9pcHJ6bytZbGM3dmRIcThEZi9Idk53dEtKRG5tRUhhSVloRTdvVWxVWDJablAxSnVRWWY1WVVRZWFqUDI3cVMrSTQxL1lPNGRiemJvelFLaTlYMEttZjdSM3dIZGtGZ2NQVDdha2J0V3pCSkxoSUdBRUppQ3luUExpMFZUanp3bXV5S3ZFZytTNit5Z0tvK29GMC9nQWRqRnJWMER6Nlc0cHFGSWtNcW9kS1doTlI5RTZGZWpadVJhT21WQVFyVHRRUlZDTDR2K1ZnUnl6Y1JPQmNZUDQzTHJFbW12ekxzcUh3VmxzcTZvU2REMFpXcFpvS0o0czNkbjlEMFZCMndnOHdiNG9aSVJmUUd0Z05RdTNPcVg4eC8rK1pvMVQ0RnZqVVROVXdqSDlBS3ZaY212Wm9nOUNaRFcwODdhZnJ0d21MVUlVWWJ4N0t2QU9BZ0c2TS9lS1NaRG80NjJldE4vZ0JSRGJjTGVya3VCZ0cxdFFEWjRzVVdqWkw2K3NzdnVmaVhteng3NWY3aC9Id28vWk9uQmVJOVJEWGduZFdCMHBVU3VqaEZEbTJQaWZ0OFVZOVdUZWtqV1JTc0RQYis0bTJ6SzFVR1JENUx0OEJMaW9seTRJVGthS2JkYmtMSUdaOHFWMGtsc1lIcjNiMXdOYm91NktveUp3emdKTFFLMGxIYXpsZHhhdGNVNE1IQ1pjWFFPbjA4M0V4Y2VyRCtWUWo1REIyZ3VzbVpwQXZ5Vlh5YWdBUEx4bE9pVjl3SjArQmFRZDFSTUhWaUxVdWJUUVRNL0FsVGkyUm1nVU5hOWNlUGwzay9XYlpxbzN4VDBiL3RIemZzNzQ2b0NzTjZObTZTVEZ4dXlzT2xzdnF4MHdOaGZlL2xNSHJkUWxwQVJxY3hrWDdHd2dWcXNJeHFsdVBibDNteFh2c1dBOXRjWEFOTGZ2YmRpZkp1bnFUOXc4eWs2SmRrYlYyOXNRUU53aC8rVTRQQ2ZRT0tBaC9pNkRzaGVaQWlsQkorODFjbmhHUE5NTytpazNQNWpNbDh4dXM4VFpKT0RkaC9yTDlwV3dFZWt5a2NuNVA2U2RLQ3QwZ3ZTY2Mrc0RBY0xXRVhxcnBBSnBqNkVnM0cvWjJKaENGZi9uZVJuZkN0MlJLVFkwY05ibS9RTXZpN3JUbEFOOGp4NHBpUGZ6Rk1wakVhYk01T3ZlcTlrVHl6VkxPbjJTUlhSZml4UXVLaksyaDNYNFZwT2JlWTFsQ3RUS2tMcStleVFkMmlQbW5FcG5vQjZZU3AyR0QyVk1qaXFIZm9JNGlOc2hQUFY0LzRXZFFDNHd3Sk1CNkhaMjg3QVNiOU9ub3RvajdVQ3paSmk2Q0dOUVcreFFkRTQ5NVc2d0phL1dMNWx3YlNoTFkwSFdVWUMvMGt2WHh5cjRBbzVnNHZLa2VoYXVFanFnWldNMEdsODUyUVBJNkgwMVQ2OFplSGZCaXoyOWI1UTN4Rng1ZjlERFdZUTg0S3Y4REdiZ2diaXRXTmxaN2ZRamZmd29yT2p4dHJmMFNCNlRST1R0TnlxWGEwbnpUbUg1MUlDY3FEYlJOaUZFVEtUb0pHc0d4d1hEaDdtU2I4a0dJZz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * hu9GBVU51aZ
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

  • Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (151) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
    "C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4500
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4720
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic SHADOWCOPY DELETE /nointeractive
      2⤵
        PID:2696
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\vncx2_readme_.txt
      Filesize

      3KB

      MD5

      e54250386feb8fb152d6a8b2838de523

      SHA1

      3c4bcf37d4c5e3f024ac219197f9184def22bc57

      SHA256

      caef737557a5d2d0b2916d9d82c43d17c62c10ee290d7d2ed272d6c110545306

      SHA512

      9ef08860a2aebbacf8f1770168b8a7d369f1b911aaecae87437d91489e544dd3cc892f44f2b69b92aba16068017164d29c46bbb1c1a29c0a95cf48b45120ebfc

      Download Submit

    • C:\Users\Admin\Documents\vncx2_readme_.txt
      Filesize

      3KB

      MD5

      ecbfc0f3b8ba962d1125891f17996360

      SHA1

      fe77ff83bac64f0457aed8cfe5c47bd161099dea

      SHA256

      d9a27f30396c9a524345c64f811d12610fcb0e9ee4f9836175eaee5d376fd263

      SHA512

      52218b27f12796141a7c5f10ab1e1e4f5dd06e90c56ce1a8960c2e691deaad837335901a8d3b8169981a03e47c4e45229e8aeeae7691bdeef2e3a5cc7859dd53

      Download Submit

    • C:\Users\Admin\Music\vncx2_readme_.txt
      Filesize

      3KB

      MD5

      c4159f63e6823cb82bd1bf32614c45fa

      SHA1

      c0697e477643ca970e935668fd98481cf0017ac4

      SHA256

      18201f76eb71479040536b9317e8f75576696a0d6f6d27f3787f82106045caf6

      SHA512

      a657c4f6dd8460c4503097a1c7d556b5bd7ed6fac931806c2646081afa972ee4dcde5cc60683b915ee02472709e568892cd419fbe35a9ccc55bb6a9ae227033c

      Download Submit