Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2024, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe
Resource
win10v2004-20241007-en
General
-
Target
df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe
-
Size
940KB
-
MD5
c93f9b9a6783953719568612a8c9ff80
-
SHA1
c771532fc4b04fbf340f9a6119ad48b0d3959bf1
-
SHA256
df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7
-
SHA512
0b27f724ddf20373d86e2f9e827d923e4e7a0e46ebe84cefd7d9acb8ec65a4b7c51df676fc80179dbbb05302b1478f0a6a8df99899f4a9a58273cff0ca8306f4
-
SSDEEP
12288:cy90lf4XM+6Wu4cQw2KIn2+cXzQ/2VAtb2HEm1w2Ru7RqPOGgnKNXQE9GlZvA:cyWUV6WqIizQ/LsHnw2INqP5NbGnI
Malware Config
Extracted
amadey
3.80
9c0adb
http://193.3.19.154
-
install_dir
cb7ae701b3
-
install_file
oneetx.exe
-
strings_key
23b27c80db2465a8e1dc15491b69b82f
-
url_paths
/store/games/index.php
Signatures
-
Amadey family
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2044-21-0x00000000023B0000-0x00000000023CA000-memory.dmp healer behavioral1/memory/2044-23-0x0000000004AC0000-0x0000000004AD8000-memory.dmp healer behavioral1/memory/2044-51-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-49-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-47-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-45-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-43-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-41-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-39-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-37-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-35-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-33-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-31-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-29-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-27-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-25-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer behavioral1/memory/2044-24-0x0000000004AC0000-0x0000000004AD3000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 240096771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 240096771.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 240096771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 240096771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 240096771.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 137161149.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/memory/1692-105-0x00000000024F0000-0x000000000252C000-memory.dmp family_redline behavioral1/memory/1692-106-0x0000000002630000-0x000000000266A000-memory.dmp family_redline behavioral1/memory/1692-112-0x0000000002630000-0x0000000002665000-memory.dmp family_redline behavioral1/memory/1692-110-0x0000000002630000-0x0000000002665000-memory.dmp family_redline behavioral1/memory/1692-108-0x0000000002630000-0x0000000002665000-memory.dmp family_redline behavioral1/memory/1692-107-0x0000000002630000-0x0000000002665000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 371172443.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 8 IoCs
pid Process 1916 tQ500108.exe 2424 Yn895989.exe 2044 137161149.exe 2112 240096771.exe 2924 371172443.exe 3208 oneetx.exe 1692 434375331.exe 1944 oneetx.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 137161149.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 240096771.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tQ500108.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Yn895989.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3756 2112 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137161149.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371172443.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tQ500108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oneetx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434375331.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Yn895989.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240096771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4400 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2044 137161149.exe 2044 137161149.exe 2112 240096771.exe 2112 240096771.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2044 137161149.exe Token: SeDebugPrivilege 2112 240096771.exe Token: SeDebugPrivilege 1692 434375331.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 371172443.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1916 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 84 PID 1636 wrote to memory of 1916 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 84 PID 1636 wrote to memory of 1916 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 84 PID 1916 wrote to memory of 2424 1916 tQ500108.exe 86 PID 1916 wrote to memory of 2424 1916 tQ500108.exe 86 PID 1916 wrote to memory of 2424 1916 tQ500108.exe 86 PID 2424 wrote to memory of 2044 2424 Yn895989.exe 87 PID 2424 wrote to memory of 2044 2424 Yn895989.exe 87 PID 2424 wrote to memory of 2044 2424 Yn895989.exe 87 PID 2424 wrote to memory of 2112 2424 Yn895989.exe 97 PID 2424 wrote to memory of 2112 2424 Yn895989.exe 97 PID 2424 wrote to memory of 2112 2424 Yn895989.exe 97 PID 1916 wrote to memory of 2924 1916 tQ500108.exe 102 PID 1916 wrote to memory of 2924 1916 tQ500108.exe 102 PID 1916 wrote to memory of 2924 1916 tQ500108.exe 102 PID 2924 wrote to memory of 3208 2924 371172443.exe 103 PID 2924 wrote to memory of 3208 2924 371172443.exe 103 PID 2924 wrote to memory of 3208 2924 371172443.exe 103 PID 1636 wrote to memory of 1692 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 104 PID 1636 wrote to memory of 1692 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 104 PID 1636 wrote to memory of 1692 1636 df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe 104 PID 3208 wrote to memory of 4400 3208 oneetx.exe 105 PID 3208 wrote to memory of 4400 3208 oneetx.exe 105 PID 3208 wrote to memory of 4400 3208 oneetx.exe 105 PID 3208 wrote to memory of 4752 3208 oneetx.exe 107 PID 3208 wrote to memory of 4752 3208 oneetx.exe 107 PID 3208 wrote to memory of 4752 3208 oneetx.exe 107 PID 4752 wrote to memory of 2040 4752 cmd.exe 109 PID 4752 wrote to memory of 2040 4752 cmd.exe 109 PID 4752 wrote to memory of 2040 4752 cmd.exe 109 PID 4752 wrote to memory of 1372 4752 cmd.exe 110 PID 4752 wrote to memory of 1372 4752 cmd.exe 110 PID 4752 wrote to memory of 1372 4752 cmd.exe 110 PID 4752 wrote to memory of 212 4752 cmd.exe 111 PID 4752 wrote to memory of 212 4752 cmd.exe 111 PID 4752 wrote to memory of 212 4752 cmd.exe 111 PID 4752 wrote to memory of 1740 4752 cmd.exe 112 PID 4752 wrote to memory of 1740 4752 cmd.exe 112 PID 4752 wrote to memory of 1740 4752 cmd.exe 112 PID 4752 wrote to memory of 2088 4752 cmd.exe 113 PID 4752 wrote to memory of 2088 4752 cmd.exe 113 PID 4752 wrote to memory of 2088 4752 cmd.exe 113 PID 4752 wrote to memory of 1996 4752 cmd.exe 114 PID 4752 wrote to memory of 1996 4752 cmd.exe 114 PID 4752 wrote to memory of 1996 4752 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe"C:\Users\Admin\AppData\Local\Temp\df41c9377f3cd9c6d472a1d2ee30e0645918a1cae0aa35a5da4b46c9b0f74ec7N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ500108.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ500108.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yn895989.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yn895989.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137161149.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\137161149.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\240096771.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\240096771.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 10805⤵
- Program crash
PID:3756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\371172443.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\371172443.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4400
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
- System Location Discovery: System Language Discovery
PID:2040
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"6⤵
- System Location Discovery: System Language Discovery
PID:1372
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E6⤵
- System Location Discovery: System Language Discovery
PID:212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
- System Location Discovery: System Language Discovery
PID:1740
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:N"6⤵
- System Location Discovery: System Language Discovery
PID:2088
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb7ae701b3" /P "Admin:R" /E6⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\434375331.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\434375331.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2112 -ip 21121⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exeC:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe1⤵
- Executes dropped EXE
PID:1944
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
341KB
MD55e4de716c5120221b619cd5db49bf760
SHA1618bed8808c200cd29718e106aefd13b7276d1d1
SHA2562f9f6dd211707d5f67d722493df529efac1c87de615fc642286d9d72b91f768c
SHA512978f589fd58b19f0635c3effcbf53e3b5faaec4daed9a89f11b676576013b0361a2578b4a7112cb0388889bbafc57adfa7caa0ba246e2181b21a5cd7c6b1d3b4
-
Filesize
586KB
MD5f785b223d79ce158a0d7569d59df742d
SHA1053473652e92fa71876d8982ab9a336b4732db05
SHA2561299e17d46bbe2190db175ddf85f4c48db1496f35479effcd4e8367f96975f16
SHA512516a58bd5555c1cba86f2df70c938b1d82fabe72986cb977fc98ed9983706b0c75f3c767e7ec1b615ca39ac3cfd4416e58e8770cd2aa2543138f353cc406c595
-
Filesize
204KB
MD51304f384653e08ae497008ff13498608
SHA1d9a76ed63d74d4217c5027757cb9a7a0d0093080
SHA2562a9dabab35fb09085750e1cc762e32b0fe4cbd7ed4276ef7e68ba159ae330eaa
SHA5124138217fd538e827c89db5c0cd4ea21bd8c8d3a7196d2eabf10412caf7b929479e768747df5fd92fc022d758f1840474530ba82dcb7e8672cc6eb88caeaf38c1
-
Filesize
414KB
MD5990379722e3f8ed93c93b9ef73d33adc
SHA1cf675274d5725a0ddd247b68d48c0845e84eea0c
SHA256deb6d0ec979939f2f7473b8b41ab3fad72fab5c1c75c1b8f6183b68752d45c39
SHA5127b3e948a0a2ded83cb6c0e2d9ce972baed44389ff166b52789fe8a0618e441f1359291684c0bdc8fa3fd2617d82b027332d4b779a50ee780fe9552fcf838d313
-
Filesize
175KB
MD5a165b5f6b0a4bdf808b71de57bf9347d
SHA139a7b301e819e386c162a47e046fa384bb5ab437
SHA25668349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a
SHA5123dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1
-
Filesize
258KB
MD512a5245b6ee93aa0a2681826a70e511d
SHA1e9e38991e889628e1aa91c852050cd027f4b2569
SHA256ad1fd1194637b7c48b261f5871fd1dd216606c6a291bd9e3ebe5be57cd617286
SHA512a5af6daae3e558997b41cb96b88bde011816c1b943c6189cae953e27281c851b736784309de312b056bf2c8f55c5dbcf6a9ab9eb87931b7000dd5f1c1200fe3b