Resubmissions
09/05/2024, 00:31
240509-at4y1agc8x 809/05/2024, 00:30
240509-atn8jsgc7v 109/05/2024, 00:29
240509-as6q7sgc4t 109/05/2024, 00:26
240509-arpfjagb6v 8Analysis
-
max time kernel
58s -
max time network
119s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/05/2024, 00:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/pankoza2-pl/salinewin.exe-Malware
Resource
win11-20240426-en
Errors
General
-
Target
https://github.com/pankoza2-pl/salinewin.exe-Malware
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 salinewin.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings msedge.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3276 reg.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\salinewin.exe-Malware-main.zip:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2716 msedge.exe 2716 msedge.exe 3084 msedge.exe 3084 msedge.exe 3252 msedge.exe 3252 msedge.exe 2324 identity_helper.exe 2324 identity_helper.exe 4568 msedge.exe 4568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe 3084 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 892 salinewin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3104 3084 msedge.exe 77 PID 3084 wrote to memory of 3104 3084 msedge.exe 77 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 3860 3084 msedge.exe 78 PID 3084 wrote to memory of 2716 3084 msedge.exe 79 PID 3084 wrote to memory of 2716 3084 msedge.exe 79 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80 PID 3084 wrote to memory of 2800 3084 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/salinewin.exe-Malware1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98bd13cb8,0x7ff98bd13cc8,0x7ff98bd13cd82⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,2140837119289599500,6561537886875240575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4208
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3480
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1676
-
C:\Users\Admin\Downloads\salinewin.exe-Malware-main\salinewin.exe-Malware-main\salinewin\salinewin.exe"C:\Users\Admin\Downloads\salinewin.exe-Malware-main\salinewin.exe-Malware-main\salinewin\salinewin.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f2⤵PID:380
-
C:\Windows\SysWOW64\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Modifies registry key
PID:3276
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x000000000000049C1⤵PID:3132
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a27855 /state1:0x41c64e6d1⤵PID:5680
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:6136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5de47c3995ae35661b0c60c1f1d30f0ab
SHA16634569b803dc681dc068de3a3794053fa68c0ca
SHA2564d063bb78bd4fa86cee3d393dd31a08cab05e3539d31ca9f0a294df754cd00c7
SHA512852a9580564fd4c53a9982ddf36a5679dbdce55d445b979001b4d97d60a9a688e532821403322c88acc42f6b7fa9cc5e964a79cbe142a96cbe0f5612fe1d61cb
-
Filesize
152B
MD5704d4cabea796e63d81497ab24b05379
SHA1b4d01216a6985559bd4b6d193ed1ec0f93b15ff8
SHA2563db2f8ac0fb3889fcf383209199e35ac8380cf1b78714fc5900df247ba324d26
SHA5120f4803b7b7396a29d43d40f971701fd1af12d82f559dcfd25e0ca9cc8868a182acba7b28987142c1f003efd7dd22e474ac4c8f01fe73725b3618a7bf3e77801d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD564296df5063c4a30912128b0138ea412
SHA1eb9cdf641c371a76556a4eb1e543a85b95463f0c
SHA256ee2e4658b88ea2e8d373b252f14969e144390dbc19ba2da00fe081a4f806f075
SHA512efaab2e29e9dfc6e711e3acf80064f77541d479e97132042c382324a90fe49d96337f471d9f5a2712f1b2f0e28c05b737b544887d773398454f43d08697d425f
-
Filesize
573B
MD5865f5d803aeae00b4abed0a95cbe66b2
SHA134af0fdf4b2eeeb6ee7a9b2060add5eb65ab9a32
SHA256068af329e3c6855e015e79f39586e34264d26e26bacc5298de6d94a11dba0990
SHA512058385cb8cc506a0daaabba6b18980fbb5d5aad007c52b2e377f9fd434b9d22718fdbe2abf8cbffb939dbbb529d20449648d7002263a1cab4456c9b96c131f6a
-
Filesize
5KB
MD54b2c87346575e8c10cd5424a595d7f09
SHA1bd80c507bc63ca90598194dfca2ea43e02ab1b93
SHA256b5f9e7b5d3b9ad2fb12097bdd4c46483392329e2c3d9ba220961d3bbe83e8326
SHA5129d5ae23a62fa14367843bb3dead4759987a9ca84a352e47fcd73f9d6d3112f36e5a888779d4b857a5a568734ee47e1253978c2754df43c35c8a0dd98b12394ff
-
Filesize
6KB
MD51eb3614ab790be57566629d2dcee864c
SHA1e370bbd363d1a1f85d07242094cfe745ea099207
SHA25698f5200c3e65fcdedffd3f02acd0a8711268afb6359ac1a972e632aac95fff69
SHA5123cd4165182c7bf08dbe13b25dbc37aad8d880bff762fb90c21fbdbe8c5875ef6136653071e92186a537aba60bf80e78441feb0661018c726087f53521f6875c8
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5952ba438739f43e874f5793b250f9e34
SHA1a466bb7a2f6b01050df8de3ba84c2fb8e1d59526
SHA256649153767b242adb09e6ea17279971bd40bd50535f072c76627b06610481bc49
SHA51259c35ad405669d76f0d618be213a55c378aab6a0fc8ddebf8ef65b9e779c0253fdc0c8414a21c71481beed03b33e023b3db5919dd96f942de248440833fdcf83
-
Filesize
11KB
MD5d95887b7b761fcdacb7e03c4c090689c
SHA1a8ea9b38d7a883917d0f9d1d30aab8054df4e40c
SHA256ff7d07f978433a00b8d816e5e3c534f8b1e72aa1456e7c82172040260bde3336
SHA51283e05057589ef495d9be8b74b748caaa943a22263a8e0714a06407ec464f578554a425c37c500abb4fcc4df53dcc9c0acf0dd542a49f81e68ab2ca66e8e452d4
-
Filesize
12.1MB
MD5c8bf514a334eaa148cb3c6135c2fb394
SHA10e47a89c3729db5a6f195c6abb04e5129d788df8
SHA2569127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67
SHA5129879a258f429ef492cf495dbddd4f2b9c9fbc061e325aa8ad870ed05049b7ad595b26d223d20c55fc99f403fc9b5d0235353d71bf5d9a39ee4462838feb247ff
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98