Analysis
-
max time kernel
42s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 18:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Cringeboom/Valorant-Hacks
Resource
win10v2004-20241007-en
General
-
Target
https://github.com/Cringeboom/Valorant-Hacks
Malware Config
Extracted
discordrat
-
discord_token
MTExODU4NjIwMjE0NTE4MTc4Nw.GG4Bcs.73zWXPQK-olfXGUdk5QnnXOItNoV0LzgrIq9AM
-
server_id
1118587557937156227
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1952 Aimbot_v2.1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 55 raw.githubusercontent.com 56 raw.githubusercontent.com 62 discord.com 64 discord.com 68 discord.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 893500.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4384 msedge.exe 4384 msedge.exe 676 msedge.exe 676 msedge.exe 3508 identity_helper.exe 3508 identity_helper.exe 3076 msedge.exe 3076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1952 Aimbot_v2.1.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe 676 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 676 wrote to memory of 3528 676 msedge.exe 83 PID 676 wrote to memory of 3528 676 msedge.exe 83 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 2504 676 msedge.exe 85 PID 676 wrote to memory of 4384 676 msedge.exe 86 PID 676 wrote to memory of 4384 676 msedge.exe 86 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87 PID 676 wrote to memory of 4204 676 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Cringeboom/Valorant-Hacks1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1fe846f8,0x7ffe1fe84708,0x7ffe1fe847182⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4960 /prefetch:82⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3388 /prefetch:82⤵PID:2108
-
-
C:\Users\Admin\Downloads\Aimbot_v2.1.exe"C:\Users\Admin\Downloads\Aimbot_v2.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,11876163071689469304,16290014654235843224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:12⤵PID:2436
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3176
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD5675a8c578cda05422166e2c48b03af31
SHA15889fe07657ad4becc19fdb7ba29df5ef44a985a
SHA2566eb96dee424865c60235301a3fc3200b0c354bb654292174d0c776db5461f1bc
SHA5127189ced758f139d747569386e6a62e871db7d5715a89e0a0b9f8ed2b05fdd4621faae7eb8ee474819d38e538b012fe74aa318a906bce50ac6a985de280535213
-
Filesize
6KB
MD512dd2e1ad53f2e2dd726e13f95fa7bac
SHA19fcb92a280980d29ec1a922954c82c848869d72b
SHA25609812824a9a7c15cefcbdb5969b84f771c9cfcf6d86f084830478b7b6704ffb4
SHA512fedbe23331a84426900bc022194bdf23b892b5ecb5c7d7d8ac420a1a35787df8a7c377a44c49ce316820d38bcd3f2fc4f0bd7b0547eeebef8999f454922b8e85
-
Filesize
5KB
MD5275c8c899cd3e9b332759f3087cbd4a4
SHA1bf1c45ae14e1249b1e339938f48649455dd66838
SHA2569d7c65e75859973a8abc89877be15c4abe74a4c2ce6855dfcf993f5fd2430893
SHA51251f5614d98e383979e2bf8cccdcf0c87bf81412cc2f38008ccd3b7aed769d82c06bd3ad7b7bce7e5e4d8f38b6af3bef0d37c062586806abfe96b9fe0505f0d22
-
Filesize
6KB
MD559c523a214f019c2dc7bbee044abafd8
SHA1c71eb705be2bc0d5e02ebaf58832bed66fe5bb5f
SHA256835a30f4e36539f0e7d6c3089e998fc6094522310d3e44e57c25693b6dae77cd
SHA51289598dd864602d6a2ff98cf4978e6b757268228a23d988e9ef77d9f1706b8b3767876f099a92a7ee5056b4b99bfc5fb249b58bdbb7b7e3c6a7c013186f9c990c
-
Filesize
1KB
MD56f9ac616e15bb272d552985a9c5fb01b
SHA13838889059d8bd5466ae21ae9d4529e8c3b0aa47
SHA25600aa195309110d69ed0ac1818f21f3a28873fdfe44e1dcef48f1130be721deba
SHA512f6c161dcddccbc427abacb42bf0d38bcf38c1f9fc54310919a39f49116b80660a12a1b3b61eb36307a7e1bff1b5e3ed7f092a85be629ad03b83d6918f43d862d
-
Filesize
1KB
MD597090478fb49a8c27149e5cb36c6b907
SHA19f422cec717bc3958c420793f7720a001e12b2cc
SHA2566fc38edb1a924de4f57d75f145c070636c8d6a5d762243db15b9df3f694d668d
SHA512582e16ecc76fe4070101b50dec01c694f49c952f8ddf44f9e2044a321f8ce8202425bc24305269b1a42bc07caa88433ae0c69feb79ee870250f3a17c0408ec84
-
Filesize
874B
MD598ae01f337ff037ec017ee04827d5aac
SHA1b77f651f0bcb15f1ce9843bc5b9322ec93d5b856
SHA2568dafdbd0073fa3fd5a71ac83979137e215b6b4c61ee498fca79af0ddd15db675
SHA512941b6dbd80e6dcaba0bd01161d367999e286d6dcdb884f4579d8b09a7be09026b983273994e6f396db6a250acd072ffe4feabddf4427f46e872406af106fad26
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5bd806e4c4eda1891120a271071c0a0ee
SHA137eaf51860272dfcc39aca5b79c1a09394da7370
SHA2565d6be17e9465b92796ee02846f0dfcd58d22d5ce9f84bc3b1bf313801fd0331a
SHA51286696c77199fdab6ae9455107c8c21399904b6c32a62aec9822fde6980099d890eecd1e2701255d18140cc49b6511a1aae2de95237c842c7ed1e4425d7bc4ceb
-
Filesize
10KB
MD533a935bf7a0623badbb6f3e89eb585dd
SHA160f144ddf269fb438e2e12334311d08a96dfdef4
SHA2561b125f62349eeca8a28da24d28c6bbc624201781e479ec3d6f9a2da716245d46
SHA512534612abbe1cc9dd715f15304c9ab55a28cf8e9027a483ef66cb6ad99280bc688671cbcce67da16a0ceae8bc44c7b093c64d1f5747b01e36da0d82c04523bfc3
-
Filesize
78KB
MD5dec3a0ac0d4d7e622db2bb49565132a8
SHA17e032711352f7fa7f6d084116e93ecdff7297f32
SHA2563a1b4532a7185b89c1f6b5d7420c0364275fdcf4c66d272a06d6ac3a663117e8
SHA5123998a60caae6933afe251b6619b0480e0a465c77bb583819477e301d5243a6d3bfe3005da888400ef6d303d32455e8e2bfe02cf220f8137d7b26e082ea91492b