Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:30
Static task
static1
Behavioral task
behavioral1
Sample
8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe
Resource
win10v2004-20241007-en
General
-
Target
8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe
-
Size
1.8MB
-
MD5
be131b7bc8cd4eb30eb81ccceeaaea4d
-
SHA1
d3370bc98065a5b0d11b06a089f9280e184325b1
-
SHA256
8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60
-
SHA512
d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c
-
SSDEEP
49152:x1C65bDvLzDByacb4n+rK7oXKjdPSoj+:xMGbbQai4nMSpSo
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral1/memory/2156-49-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d5403bf8da.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 3 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1544 chrome.exe 1384 chrome.exe 2544 chrome.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d5403bf8da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d5403bf8da.exe -
Executes dropped EXE 4 IoCs
pid Process 2920 skotes.exe 2156 d5403bf8da.exe 2264 service123.exe 2176 service123.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine d5403bf8da.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe -
Loads dropped DLL 10 IoCs
pid Process 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 2920 skotes.exe 2920 skotes.exe 2156 d5403bf8da.exe 2156 d5403bf8da.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 2264 service123.exe 2176 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 2920 skotes.exe 2156 d5403bf8da.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1456 2156 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5403bf8da.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d5403bf8da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d5403bf8da.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 900 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 2920 skotes.exe 2156 d5403bf8da.exe 2544 chrome.exe 2544 chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2544 chrome.exe Token: SeShutdownPrivilege 2544 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe 2544 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2920 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 29 PID 2596 wrote to memory of 2920 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 29 PID 2596 wrote to memory of 2920 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 29 PID 2596 wrote to memory of 2920 2596 8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe 29 PID 2920 wrote to memory of 2156 2920 skotes.exe 31 PID 2920 wrote to memory of 2156 2920 skotes.exe 31 PID 2920 wrote to memory of 2156 2920 skotes.exe 31 PID 2920 wrote to memory of 2156 2920 skotes.exe 31 PID 2156 wrote to memory of 2544 2156 d5403bf8da.exe 32 PID 2156 wrote to memory of 2544 2156 d5403bf8da.exe 32 PID 2156 wrote to memory of 2544 2156 d5403bf8da.exe 32 PID 2156 wrote to memory of 2544 2156 d5403bf8da.exe 32 PID 2544 wrote to memory of 2500 2544 chrome.exe 33 PID 2544 wrote to memory of 2500 2544 chrome.exe 33 PID 2544 wrote to memory of 2500 2544 chrome.exe 33 PID 2544 wrote to memory of 1844 2544 chrome.exe 34 PID 2544 wrote to memory of 1844 2544 chrome.exe 34 PID 2544 wrote to memory of 1844 2544 chrome.exe 34 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 1724 2544 chrome.exe 36 PID 2544 wrote to memory of 948 2544 chrome.exe 37 PID 2544 wrote to memory of 948 2544 chrome.exe 37 PID 2544 wrote to memory of 948 2544 chrome.exe 37 PID 2544 wrote to memory of 1472 2544 chrome.exe 38 PID 2544 wrote to memory of 1472 2544 chrome.exe 38 PID 2544 wrote to memory of 1472 2544 chrome.exe 38 PID 2544 wrote to memory of 1472 2544 chrome.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe"C:\Users\Admin\AppData\Local\Temp\8672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1008250001\d5403bf8da.exe"C:\Users\Admin\AppData\Local\Temp\1008250001\d5403bf8da.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"4⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7839758,0x7fef7839768,0x7fef78397785⤵PID:2500
-
-
C:\Windows\system32\ctfmon.exectfmon.exe5⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:25⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:85⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:85⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:15⤵
- Uses browser remote debugging
PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1396 --field-trial-handle=1296,i,9130422890590441512,13900068191673524429,131072 /prefetch:25⤵PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 9564⤵
- Loads dropped DLL
- Program crash
PID:1456
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2004
-
C:\Windows\system32\taskeng.exetaskeng.exe {D2F8EA68-FCF1-4226-A450-B5AB627D52F8} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
4.2MB
MD53540f08b37b30b6c554e0e5ff05a8e97
SHA11ca146fe61b66a73900f1008f8267ec5554413c2
SHA256562ab7435cbde0c5528a05f60ce959fa9b428d3378f4d0f5b22f48eb09fe13e6
SHA5129ca4c49a620c2cb06a8c334d1cdce999579f3dcd472b10e7227c54089efe9e68844bfc0e2d34e0b72558e714b01094eeaa849b30566b1d7e7461fe928f1ed201
-
Filesize
1.8MB
MD5be131b7bc8cd4eb30eb81ccceeaaea4d
SHA1d3370bc98065a5b0d11b06a089f9280e184325b1
SHA2568672c7c63c3cf3e5a823a0f5c999c4d29383e810457f79264f64bc2edb563c60
SHA512d3923b754ad3199815d154b996f6fc620ef2a4752e337268ebf46263271d434a35cb94ce0f48c54250a0f3e5284fa263ce00b518df577b76d3ee03b3635a5c9c