Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 07:46
Behavioral task
behavioral1
Sample
Valkyria.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Valkyria.exe
Resource
win10v2004-20240426-en
General
-
Target
Valkyria.exe
-
Size
8.2MB
-
MD5
1626922cadeeedea404cadfe628d7e16
-
SHA1
9323dbefdd49c84ae79e188b79bac5cee2ab6a6e
-
SHA256
202faa66219e927a3b57d90ee9b2b4fbd309ed72ff89a7e28d7668ca08d0fd49
-
SHA512
80d0d6b93a8b85e2ed0fb6dee775b6f40f6d39381640c8e8ab3309f58e84d8b17e86b321849a2ffdfa4b7dd39736730b5a1d822f95a20153c1d41d52b604a9e0
-
SSDEEP
196608:68oppJhh2fJB0ZOFkGEWZd7HFApko0eYOiKddHB2icEPld6aGXAr5xN:6jppJEJB0ZOFNVZRlekSFPvHlQAxN
Malware Config
Extracted
blackguard
https://api.telegram.org/bot5865379362:AAEUbyvhTdYJ7SmCp7YyfRe8OBV_Jrj9iqg/sendMessage?chat_id=5481385928
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4244 netsh.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Valkyria.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation Everything.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation zkzkzkz.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\07fe81bb92603a7ba50e57049dc09693Realtek Semiconductor.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\07fe81bb92603a7ba50e57049dc09693Realtek Semiconductor.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Realtek HD Audio Universal Service.exe server.exe -
Executes dropped EXE 4 IoCs
pid Process 452 zkzkzkz.exe 3464 Everything.exe 1224 Natasha.exe 3200 server.exe -
Loads dropped DLL 5 IoCs
pid Process 1224 Natasha.exe 1224 Natasha.exe 1224 Natasha.exe 1224 Natasha.exe 1224 Natasha.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 freegeoip.app 9 freegeoip.app 21 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Natasha.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Natasha.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1224 Natasha.exe 1224 Natasha.exe 1224 Natasha.exe 1224 Natasha.exe 4516 msedge.exe 4516 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3200 server.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1224 Natasha.exe Token: SeDebugPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe Token: 33 3200 server.exe Token: SeIncBasePriorityPrivilege 3200 server.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe 4884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 932 wrote to memory of 452 932 Valkyria.exe 82 PID 932 wrote to memory of 452 932 Valkyria.exe 82 PID 932 wrote to memory of 452 932 Valkyria.exe 82 PID 932 wrote to memory of 3464 932 Valkyria.exe 83 PID 932 wrote to memory of 3464 932 Valkyria.exe 83 PID 932 wrote to memory of 3464 932 Valkyria.exe 83 PID 3464 wrote to memory of 1224 3464 Everything.exe 85 PID 3464 wrote to memory of 1224 3464 Everything.exe 85 PID 3464 wrote to memory of 1224 3464 Everything.exe 85 PID 452 wrote to memory of 3200 452 zkzkzkz.exe 87 PID 452 wrote to memory of 3200 452 zkzkzkz.exe 87 PID 452 wrote to memory of 3200 452 zkzkzkz.exe 87 PID 3200 wrote to memory of 4244 3200 server.exe 90 PID 3200 wrote to memory of 4244 3200 server.exe 90 PID 3200 wrote to memory of 4244 3200 server.exe 90 PID 4884 wrote to memory of 3976 4884 msedge.exe 114 PID 4884 wrote to memory of 3976 4884 msedge.exe 114 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 3664 4884 msedge.exe 115 PID 4884 wrote to memory of 4516 4884 msedge.exe 116 PID 4884 wrote to memory of 4516 4884 msedge.exe 116 PID 4884 wrote to memory of 4944 4884 msedge.exe 117 PID 4884 wrote to memory of 4944 4884 msedge.exe 117 PID 4884 wrote to memory of 4944 4884 msedge.exe 117 PID 4884 wrote to memory of 4944 4884 msedge.exe 117 PID 4884 wrote to memory of 4944 4884 msedge.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\Valkyria.exe"C:\Users\Admin\AppData\Local\Temp\Valkyria.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\zkzkzkz.exe"C:\Users\Admin\AppData\Local\Temp\zkzkzkz.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:4244
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Everything.exe"C:\Users\Admin\AppData\Local\Temp\Everything.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\Natasha.exe"C:\Users\Admin\AppData\Local\Temp\Natasha.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe40a46f8,0x7fffe40a4708,0x7fffe40a47182⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6334356850100397099,8981795619975054058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:8
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3980
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
5KB
MD5e4f168dfc66b47b1746adb82e92f90f7
SHA1dcf48616b60e50b9249ec42e4a2c5952d701c4a4
SHA256e8009b86238486d8cb4b8fbdd562efa6ecdeef8366120dd314069c2ea445ab28
SHA5127e5c47da3ae7a1fb1743265d4ea50c6a922923e7e14cb70f26826f33800282e4fd91f6476fdb665895114f18fcdece478163519809cee1cf848f11a9d6964b8d
-
Filesize
7.7MB
MD537f6f35584fac7f216e69e813d4b7c10
SHA1ddb093f14e5f2beb0512ac828448ff06d0237312
SHA256cc17414b5bd2db809411f93256535e78d0c97f42fe86b6cc3119aa7c33c6e3c3
SHA512917368e662428827f8477cc5915e41f6a06324f0e49721f807a6003740749261a219a25cd3d9a43d1a5714c73930e4b2da1240d2a9f108a62b11f990dc42a09e
-
Filesize
270KB
MD50ad61d702d2aca6801a833ec1d4bf5f7
SHA1d4117c6c5c0ae71ee0ccd2554ab40fe69796c519
SHA256e4668273e4cafe5a9a083eaa0d4d52ca1ba707e37ecb715c1b97de1dbb67faf4
SHA512a0743430cabc74edb8600c71a4513ab83d21542a8088d230cd15e070d6b2b2d70dab057dd1bbd1968836bc0f3b3aceb90b98024b889503c6a28926475185e6ec
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
93KB
MD5ac79af1c488ed1bc1b289e0eb8d89714
SHA1913ceaaaf7664bb83a496ebe746b6d12bb1e5e9a
SHA256dc8e217ced1f36323ce6c237fdaa330e342063a819c13defe3b248ee84c1d492
SHA512cd09c7c5e60ba946f7c83001876f3d5c48eab06c259324a7941161978531a175d00142cd486ff7cf0d2d461a651745808361e894346259ac079cc90eb42022cc
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD516eb2215358957213d4d8298d02102d1
SHA1ba0ecbb3a189c19593b073b807570bac6535427b
SHA256c61782b3ff13512c143add7c479a7ea12417b6254790a85b75664eff26f41614
SHA512c0410a43e7908c425a82206c21bb403701aca85bfff7918bdcfa5cad03cc67a7c9e8e3f2b096bac505e5081c47a9006a63b90ed42a2760d178081c07551e1546
-
Filesize
5B
MD5d43c5b07c128b116b7bc8faf7b8efa9d
SHA1dd3540ad4ae14b21b665d108cf4570c2dfa6a6fa
SHA25680ad1cc7b3a784dad618a445af0c8cf3efa903f82a814756f2aaa7b57f45791f
SHA512618b01e2b808e1954d011635dfdf63bc75855145208fc5cae33ce09c7e5b43cf978f6511beb311765e6920e728a290c9f9ced7563e40e8ff8d093d50fdc18334