Overview
overview
7Static
static
1MEMZ.bat
windows10-1703-x64
7MEMZ.bat
windows7-x64
7MEMZ.bat
windows10-2004-x64
7MEMZ.bat
windows11-21h2-x64
7MEMZ.bat
android-10-x64
MEMZ.bat
android-11-x64
MEMZ.bat
android-13-x64
MEMZ.bat
android-9-x86
MEMZ.bat
macos-10.15-amd64
4MEMZ.bat
debian-12-armhf
MEMZ.bat
debian-12-mipsel
MEMZ.bat
debian-9-armhf
MEMZ.bat
debian-9-mips
MEMZ.bat
debian-9-mipsel
MEMZ.bat
ubuntu-18.04-amd64
MEMZ.bat
ubuntu-20.04-amd64
Analysis
- max time kernel
60s - max time network
57s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
08/05/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ.bat
Resource
win10-20240404-en
windows10-1703-x64
14 signatures
60 seconds
Behavioral task
behavioral2
Sample
MEMZ.bat
Resource
win7-20240508-en
windows7-x64
13 signatures
60 seconds
Behavioral task
behavioral3
Sample
MEMZ.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
60 seconds
Behavioral task
behavioral4
Sample
MEMZ.bat
Resource
win11-20240419-en
windows11-21h2-x64
11 signatures
60 seconds
Behavioral task
behavioral5
Sample
MEMZ.bat
Resource
android-x64-20240506-en
android-10-x64
0 signatures
60 seconds
Behavioral task
behavioral6
Sample
MEMZ.bat
Resource
android-x64-arm64-20240506-en
android-11-x64
0 signatures
60 seconds
Behavioral task
behavioral7
Sample
MEMZ.bat
Resource
android-33-x64-arm64-20240508.1-en
android-13-x64
0 signatures
60 seconds
Behavioral task
behavioral8
Sample
MEMZ.bat
Resource
android-x86-arm-20240506-en
android-9-x86
0 signatures
60 seconds
Behavioral task
behavioral9
Sample
MEMZ.bat
Resource
macos-20240410-en
macos-10.15-amd64
1 signatures
60 seconds
Behavioral task
behavioral10
Sample
MEMZ.bat
Resource
debian12-armhf-20240221-en
debian-12-armhf
0 signatures
60 seconds
Behavioral task
behavioral11
Sample
MEMZ.bat
Resource
debian12-mipsel-20240418-en
debian-12-mipsel
0 signatures
60 seconds
Behavioral task
behavioral12
Sample
MEMZ.bat
Resource
debian9-armhf-20240418-en
debian-9-armhf
0 signatures
60 seconds
Behavioral task
behavioral13
Sample
MEMZ.bat
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
60 seconds
Behavioral task
behavioral14
Sample
MEMZ.bat
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
60 seconds
Behavioral task
behavioral15
Sample
MEMZ.bat
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
0 signatures
60 seconds
Behavioral task
behavioral16
Sample
MEMZ.bat
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
0 signatures
60 seconds
General
- Target MEMZ.bat
- Size 13KB
- Sample240508-xxrt6sdd32
- SHA256 dae968f47476ef79b122e771ccd0a2bacde2ac3535f68047239682fefa3dfe50
- MD5 63c6ec6b042bcb00d2d832c0e4f25dca
- SHA1 a904a7c3fc89ff497e91384a63db3282e00d31ce
- SHA512 1454cd79a59f0603ae083abb7f3b1438e18c7858ab04dfc3df1a725cee72be48274c289d5c0a44ce415f4bdf8a2c316312453862381fdbf0f4af97a62234e41a
- SSDEEP 192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXR:E85qwc35O1+7y/LphxxGtHAhubXR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 7 IoCs
pid Process 2900 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 2208 MEMZ.exe 536 MEMZ.exe 764 MEMZ.exe 1640 MEMZ.exe - Loads dropped DLL 1 IoCs
pid Process 2900 MEMZ.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59CB8DD1-0D6F-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2900 MEMZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1352 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 2188 MEMZ.exe 1352 MEMZ.exe 2208 MEMZ.exe 2188 MEMZ.exe 536 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 536 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 764 MEMZ.exe 2188 MEMZ.exe 764 MEMZ.exe 536 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 536 MEMZ.exe 764 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 2208 MEMZ.exe 536 MEMZ.exe 2188 MEMZ.exe 1352 MEMZ.exe 764 MEMZ.exe 536 MEMZ.exe 2188 MEMZ.exe 764 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 536 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 764 MEMZ.exe 536 MEMZ.exe 2188 MEMZ.exe 764 MEMZ.exe 1352 MEMZ.exe 2208 MEMZ.exe 2188 MEMZ.exe 764 MEMZ.exe 536 MEMZ.exe 2208 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 536 MEMZ.exe 1352 MEMZ.exe 764 MEMZ.exe 2208 MEMZ.exe 764 MEMZ.exe 2208 MEMZ.exe 536 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe 536 MEMZ.exe 764 MEMZ.exe 1352 MEMZ.exe 2188 MEMZ.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 756 cscript.exe 340 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 340 iexplore.exe 340 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2156 wrote to memory of 756 2156 cmd.exe 30 PID 2156 wrote to memory of 756 2156 cmd.exe 30 PID 2156 wrote to memory of 756 2156 cmd.exe 30 PID 2156 wrote to memory of 2900 2156 cmd.exe 31 PID 2156 wrote to memory of 2900 2156 cmd.exe 31 PID 2156 wrote to memory of 2900 2156 cmd.exe 31 PID 2156 wrote to memory of 2900 2156 cmd.exe 31 PID 2900 wrote to memory of 1352 2900 MEMZ.exe 32 PID 2900 wrote to memory of 1352 2900 MEMZ.exe 32 PID 2900 wrote to memory of 1352 2900 MEMZ.exe 32 PID 2900 wrote to memory of 1352 2900 MEMZ.exe 32 PID 2900 wrote to memory of 2188 2900 MEMZ.exe 33 PID 2900 wrote to memory of 2188 2900 MEMZ.exe 33 PID 2900 wrote to memory of 2188 2900 MEMZ.exe 33 PID 2900 wrote to memory of 2188 2900 MEMZ.exe 33 PID 2900 wrote to memory of 2208 2900 MEMZ.exe 34 PID 2900 wrote to memory of 2208 2900 MEMZ.exe 34 PID 2900 wrote to memory of 2208 2900 MEMZ.exe 34 PID 2900 wrote to memory of 2208 2900 MEMZ.exe 34 PID 2900 wrote to memory of 536 2900 MEMZ.exe 35 PID 2900 wrote to memory of 536 2900 MEMZ.exe 35 PID 2900 wrote to memory of 536 2900 MEMZ.exe 35 PID 2900 wrote to memory of 536 2900 MEMZ.exe 35 PID 2900 wrote to memory of 764 2900 MEMZ.exe 36 PID 2900 wrote to memory of 764 2900 MEMZ.exe 36 PID 2900 wrote to memory of 764 2900 MEMZ.exe 36 PID 2900 wrote to memory of 764 2900 MEMZ.exe 36 PID 2900 wrote to memory of 1640 2900 MEMZ.exe 37 PID 2900 wrote to memory of 1640 2900 MEMZ.exe 37 PID 2900 wrote to memory of 1640 2900 MEMZ.exe 37 PID 2900 wrote to memory of 1640 2900 MEMZ.exe 37 PID 1640 wrote to memory of 1836 1640 MEMZ.exe 38 PID 1640 wrote to memory of 1836 1640 MEMZ.exe 38 PID 1640 wrote to memory of 1836 1640 MEMZ.exe 38 PID 1640 wrote to memory of 1836 1640 MEMZ.exe 38 PID 1640 wrote to memory of 340 1640 MEMZ.exe 39 PID 1640 wrote to memory of 340 1640 MEMZ.exe 39 PID 1640 wrote to memory of 340 1640 MEMZ.exe 39 PID 1640 wrote to memory of 340 1640 MEMZ.exe 39 PID 340 wrote to memory of 3048 340 iexplore.exe 41 PID 340 wrote to memory of 3048 340 iexplore.exe 41 PID 340 wrote to memory of 3048 340 iexplore.exe 41 PID 340 wrote to memory of 3048 340 iexplore.exe 41 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MEMZ.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\cscript.execscript x.js2⤵
- Suspicious use of FindShellTrayWindow
PID:756
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2188
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2208
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵PID:1836
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=dank+memz4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CabC850.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x
- Size 3KB
- SHA256 1e19bc83410e1ab92be87ce0cb1d745af7943376b06236dda755df25887e498f
- MD5 a054d5f3d069a7755679bd3d63af6629
- SHA1 29ff2e5883fe1812afc94d788b228f101e2a4086
- SHA512 8893791a015a51a46b8aef7d33788cd409d59b2ffed3ba2a556049d5f880b6fe15abf9ffc28959aad5dc4960162c5effdb98b1eb3ee0d45809f0305e1eb18a14
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\x
- Size 11KB
- SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
- MD5 1882f3dd051e401349f1af58d55b0a37
- SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
- SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
- SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x
- Size 4KB
- SHA256 cc73e2990e99d47471ec12092ca56183604c3c0d0bf49b1d13260ef22a58dcd7
- MD5 68086481b352be726adfe4aca6311460
- SHA1 4f96c608c2a3acf23eda92bf80a39234e2fae22b
- SHA512 ec07b421c3bea856970c6258a7167f6ac369d14aa666f526e5755ecddb474260cfdd43b9897db3449c4e4226e27b386fd293edf9e741dd0ebd7e2e3916d4e702
- SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2j+:Ljafl1gt6iUq/l0ZQj+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x.js
- Size 448B
- SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
- MD5 8eec8704d2a7bc80b95b7460c06f4854
- SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
- SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\z.zip
- Size 8KB
- SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
- MD5 63ee4412b95d7ad64c54b4ba673470a7
- SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
- SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
- SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
- Size 14KB
- SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
- MD5 19dbec50735b5f2a72d4199c4e184960
- SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
- SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
- SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\note.txt
- Size 218B
- SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
- MD5 afa6955439b8d516721231029fb9ca1b
- SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
- SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
- MD5 SHA1 SHA512