Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 01:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1245703864976408689/1245740624926343228/Gwater2installer.zip?ex=665c7cdd&is=665b2b5d&hm=9d236ab9443dbd63621809c39e224f716b3a99852e657d78a649094abdb94c4c&
Resource
win10v2004-20240508-en
General
-
Target
https://cdn.discordapp.com/attachments/1245703864976408689/1245740624926343228/Gwater2installer.zip?ex=665c7cdd&is=665b2b5d&hm=9d236ab9443dbd63621809c39e224f716b3a99852e657d78a649094abdb94c4c&
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Gwater2installer.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Gwater2installer.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3472 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1316 msedge.exe 1316 msedge.exe 888 msedge.exe 888 msedge.exe 4288 identity_helper.exe 4288 identity_helper.exe 648 msedge.exe 648 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5792 Gwater2installer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 5792 Gwater2installer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe 888 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 888 wrote to memory of 1584 888 msedge.exe 85 PID 888 wrote to memory of 1584 888 msedge.exe 85 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1664 888 msedge.exe 86 PID 888 wrote to memory of 1316 888 msedge.exe 87 PID 888 wrote to memory of 1316 888 msedge.exe 87 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88 PID 888 wrote to memory of 1780 888 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1245703864976408689/1245740624926343228/Gwater2installer.zip?ex=665c7cdd&is=665b2b5d&hm=9d236ab9443dbd63621809c39e224f716b3a99852e657d78a649094abdb94c4c&1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcca3d46f8,0x7ffcca3d4708,0x7ffcca3d47182⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1448 /prefetch:22⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:12⤵PID:836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5708 /prefetch:82⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,3392827847103066397,11869885630972105071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4348
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5308
-
C:\Users\Admin\Desktop\Gwater2installer.exe"C:\Users\Admin\Desktop\Gwater2installer.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5792
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\gwater\Gwater03bModArchive.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
186B
MD5859cf9cd77c9a6bd5b0af56f08fb5128
SHA1d62387a78e8a1643ba3117187479da14bce1b65c
SHA256d16c0bd72e9deb73d2e3a40eb21ac668477363c33e58765884b1663324a4eb05
SHA512e60f5d7000507794a20316c7110fbee3f1d9b02efdba877bec150d5d63939eff3aa9fbba758709a8094c65a083b158840563a8e8399b64e16a077d12a1cb8fed
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5355208d7d7f19e09188eede30eebce6e
SHA1f195624fa4321b7437d5da64a405facdbf6b5064
SHA25699128e24c3058442c25428ae82deaa2252c092b3aff5f2fdf67cc462097d9ab3
SHA512f49abc8dcfff8b4bde2d3414b8de915e20cdf7d9f0e9f59b03cdf93c1996d38582053c2ab2a2d36730fe0de5654996f5c8f8b6cf3673a230a2a383e214ef6cdf
-
Filesize
6KB
MD59bd98402bd82b1f8768ab3621d2eeb32
SHA1d58076ff8bdf9b92955ad39a20f012f61f96c7aa
SHA2568509f5c8895851d9085a14e45dc5f98d5470998ced20793e2b628c0c952d2bb5
SHA512573cc9d8f2a35a2b713518fac3e2ef8c1aa327e05ef033e44530c20160954b90fc2e8991932f18adcd06dcec741cee54dda1baa3cf3ab979eb4cfbe9bb434d0f
-
Filesize
6KB
MD5d256088534d1e46f47b10e5c9404afc0
SHA1b390f5697c42b40c03602cc7f17679c902278f4a
SHA2562498379a4c51c09d22e2fe279da58dcac97e445b7ceacc1e8fa9d624d709c5b0
SHA51233e8cd01e9c254a88c26e24a7b45ffdf0985a986cb9e5c97f35a4e026073b0f54533e9e900d96e267866e52d305c72f9d40e3b72c1d09b6bbd7ba9d7b85f6f0f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5e7fc8aff183cda29451d02e2deb9bb76
SHA149570d4934264a2ceb9ac41a77a452061241e4bd
SHA2560979da1b9714ebd5f28af9558566a28c7e0510280a0ec10ce0b8366a423f13a4
SHA512d409445f14a68d62134a41a15012109dc9867015cdd02d12a971443f2f120378b2d4fd3f91c1247202e3cab742eb9d6d4fcc19f1fad92b12006da2cbef28243a
-
Filesize
11KB
MD5d70c8dcd4c428d989ea1c0919431702c
SHA12c4f943061d1d00dfb8d646ff84e33bf866952b7
SHA25689aaf0a19fb936b4739217a54a780f35701798a4c12b4a576d225fdfca37e404
SHA512da992167d4e6233990cf4c69d987cad2618cc2db5adb76ac8b855765f852749fce4617fb4a0b7d83ebc56c385ba23c579fe76db688b1799488d598174ab533f8
-
Filesize
3B
MD5a6105c0a611b41b08f1209506350279e
SHA1fb360f9c09ac8c5edb2f18be5de4e80ea4c430d0
SHA2568a798890fe93817163b10b5f7bd2ca4d25d84c52739a645a889c173eee7d9d3d
SHA51281e92f5d90684db6638344869c82e784b5270b513811080bdba905820be1b0331be8fb7329e4c7a6f97846c1b211572042a0c5bfc7d487a74cab0221c19685c5
-
Filesize
9.0MB
MD53381340d722f504d8cb6e0b5f8d44ce8
SHA1ab3314e326437306bcc4cb7a5c2fd38012ea3ad6
SHA25664c9e5d704af82d5c50897b64f4f032f7891baffd8842ca540e869bedc0e31ae
SHA512ef3e6c68b1e84cd6c1fdf12b08f887d1f11198023ff11028aec3fd476614ac610dcc7c00cae55c7f9db0ae62030f7f7599f890706fe05f1ac177fb5a80704a56