Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-11-2024 19:47
Behavioral task
behavioral1
Sample
Luna.exe
Resource
win7-20240903-en
General
-
Target
Luna.exe
-
Size
469KB
-
MD5
0e1f18269f4d5830d1963b033de49c31
-
SHA1
d1b43487f7ed369e64109e40b43f9f9d7a582c2f
-
SHA256
bc74405d530b50d63eaa5fd282dd477cb2607b4935f603a34d0a22066ac667f3
-
SHA512
047dccca911644287422fe0ac2c65d02179b6ffacb9e4cceff89b5dd7350b9b270e2e82ca621c265937df02fc31f13c5d6bf0bc65750965999b012a9d4d8ec87
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSon9:uiLJbpI7I2WhQqZ7o9
Malware Config
Extracted
remcos
RemoteHost
items-jeffrey.gl.at.ply.gg:58427
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
system.exe
-
copy_folder
Remcos
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-W6XH0D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Hawkeye family
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Deletes itself 1 IoCs
pid Process 2516 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 2292 system.exe -
Loads dropped DLL 2 IoCs
pid Process 1956 cmd.exe 1956 cmd.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" Luna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" Luna.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" iexplore.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remcos\system.exe Luna.exe File opened for modification C:\Windows\SysWOW64\Remcos\system.exe Luna.exe File opened for modification C:\Windows\SysWOW64\Remcos Luna.exe File opened for modification C:\Windows\SysWOW64\Remcos iexplore.exe File opened for modification C:\Windows\SysWOW64\Remcos\system.exe iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2292 set thread context of 2700 2292 system.exe 38 PID 2700 set thread context of 2252 2700 iexplore.exe 43 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log dxdiag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdiag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Luna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 34 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B} dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7} dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dxdiagn.dll" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class" dxdiag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1" dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer dxdiag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove dxdiag.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 2368 reg.exe 2728 reg.exe 2872 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 896 dxdiag.exe 896 dxdiag.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2700 iexplore.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2292 system.exe 2700 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe Token: SeRestorePrivilege 896 dxdiag.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 896 dxdiag.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2136 2212 Luna.exe 30 PID 2212 wrote to memory of 2136 2212 Luna.exe 30 PID 2212 wrote to memory of 2136 2212 Luna.exe 30 PID 2212 wrote to memory of 2136 2212 Luna.exe 30 PID 2136 wrote to memory of 2368 2136 cmd.exe 32 PID 2136 wrote to memory of 2368 2136 cmd.exe 32 PID 2136 wrote to memory of 2368 2136 cmd.exe 32 PID 2136 wrote to memory of 2368 2136 cmd.exe 32 PID 2212 wrote to memory of 2516 2212 Luna.exe 33 PID 2212 wrote to memory of 2516 2212 Luna.exe 33 PID 2212 wrote to memory of 2516 2212 Luna.exe 33 PID 2212 wrote to memory of 2516 2212 Luna.exe 33 PID 2516 wrote to memory of 1956 2516 WScript.exe 34 PID 2516 wrote to memory of 1956 2516 WScript.exe 34 PID 2516 wrote to memory of 1956 2516 WScript.exe 34 PID 2516 wrote to memory of 1956 2516 WScript.exe 34 PID 1956 wrote to memory of 2292 1956 cmd.exe 36 PID 1956 wrote to memory of 2292 1956 cmd.exe 36 PID 1956 wrote to memory of 2292 1956 cmd.exe 36 PID 1956 wrote to memory of 2292 1956 cmd.exe 36 PID 2292 wrote to memory of 2000 2292 system.exe 37 PID 2292 wrote to memory of 2000 2292 system.exe 37 PID 2292 wrote to memory of 2000 2292 system.exe 37 PID 2292 wrote to memory of 2000 2292 system.exe 37 PID 2292 wrote to memory of 2700 2292 system.exe 38 PID 2292 wrote to memory of 2700 2292 system.exe 38 PID 2292 wrote to memory of 2700 2292 system.exe 38 PID 2292 wrote to memory of 2700 2292 system.exe 38 PID 2292 wrote to memory of 2700 2292 system.exe 38 PID 2700 wrote to memory of 2844 2700 iexplore.exe 40 PID 2700 wrote to memory of 2844 2700 iexplore.exe 40 PID 2700 wrote to memory of 2844 2700 iexplore.exe 40 PID 2700 wrote to memory of 2844 2700 iexplore.exe 40 PID 2000 wrote to memory of 2728 2000 cmd.exe 42 PID 2000 wrote to memory of 2728 2000 cmd.exe 42 PID 2000 wrote to memory of 2728 2000 cmd.exe 42 PID 2000 wrote to memory of 2728 2000 cmd.exe 42 PID 2700 wrote to memory of 2252 2700 iexplore.exe 43 PID 2700 wrote to memory of 2252 2700 iexplore.exe 43 PID 2700 wrote to memory of 2252 2700 iexplore.exe 43 PID 2700 wrote to memory of 2252 2700 iexplore.exe 43 PID 2700 wrote to memory of 2252 2700 iexplore.exe 43 PID 2844 wrote to memory of 2872 2844 cmd.exe 44 PID 2844 wrote to memory of 2872 2844 cmd.exe 44 PID 2844 wrote to memory of 2872 2844 cmd.exe 44 PID 2844 wrote to memory of 2872 2844 cmd.exe 44 PID 2700 wrote to memory of 896 2700 iexplore.exe 47 PID 2700 wrote to memory of 896 2700 iexplore.exe 47 PID 2700 wrote to memory of 896 2700 iexplore.exe 47 PID 2700 wrote to memory of 896 2700 iexplore.exe 47 PID 2700 wrote to memory of 1692 2700 iexplore.exe 49 PID 2700 wrote to memory of 1692 2700 iexplore.exe 49 PID 2700 wrote to memory of 1692 2700 iexplore.exe 49 PID 2700 wrote to memory of 1692 2700 iexplore.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\Luna.exe"C:\Users\Admin\AppData\Local\Temp\Luna.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2368
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Remcos\system.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\Remcos\system.exeC:\Windows\SysWOW64\Remcos\system.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2728
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2872
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵PID:2252
-
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt6⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:896
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kkrmfibfiigijfmuwojmjbgn.vbs"6⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516B
MD511bfb67f928b0558ccd925e17199f1d0
SHA11a6f10caf0575dac048571356a6f253c8e4d5fab
SHA25694cdc47ae1407e5c1074cc6dd923d7f038a110b6d096e51e571224fb2e2a92f1
SHA5127b72f01ac2163508d539fdbc19e4b4726ea2c39aec328e0d52617bccd9e3743a7d4a1bee5fd77f66d55069f5689f33f69404d8631d148486673da16406debd29
-
Filesize
560B
MD5c0add116e665aca2f04ed038c6399441
SHA13bff7d3fb255ad159c9aee36f5c10a73c8bc3596
SHA256daecfdf55ec8f0726e6b69ff85a25baf4b8287d93113a3aa5b3ecd272839daa6
SHA51202d41f91d6ced10b2735b065db3c88569e14ea781a666016a644c7a7269fce12abbe004faa06fba966bb655ba74a3b2ff36ec0cd4153a4a8989a2c82f56e958a
-
Filesize
15KB
MD524ab11b8532f9bfa358b0ccb37dcb8e3
SHA18d89fa1fd1ef7751573974551b78909d4a080ba5
SHA2563ee150c24d4f2431a5e88489aab096f7838c924978876a61499a44b05c18f780
SHA512e4362e79bb360d085d39af0370a0ef47cab412c378fc1ed05ef0e1f44e05f5bf0b2df73dd0d46bcda3d997b3e84a65784aa887eaaf2934f07432001fe819e9cc
-
Filesize
469KB
MD50e1f18269f4d5830d1963b033de49c31
SHA1d1b43487f7ed369e64109e40b43f9f9d7a582c2f
SHA256bc74405d530b50d63eaa5fd282dd477cb2607b4935f603a34d0a22066ac667f3
SHA512047dccca911644287422fe0ac2c65d02179b6ffacb9e4cceff89b5dd7350b9b270e2e82ca621c265937df02fc31f13c5d6bf0bc65750965999b012a9d4d8ec87