Analysis
-
max time kernel
74s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 07:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fantom.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fantom.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Fantom.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
Ransom Note
<html>
<head>
<style>
body{
background-color: #3366CC;
}
h1 {
background-color: RGB(249, 201, 16);
}
p {
background-color: maroon;
color: white;
}
</style>
</head>
<body>
<center>
<h1><b> Attention ! All your files </b> have been encrypted. </h1></br>
<p>
Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br>
That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br>
Getting a decryption of your files is - SIMPLY task.</br></br>
That all what you need:</br>
1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br>
2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br>
3. Pay our services. </br>
4. GET software with passwords for decrypt you files.</br>
5. Make measures to prevent this type situations again.</br></br>
IMPORTANT(1)</br>
Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br>
IMPORTANT(2) </br>
We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption.
</p>
<p> Your ID_KEY: <br>
</p>
<table width="1024" border="0">
<tbody>
<tr>
<td><p>U6AlZXxYj6gQVrD3ycdCISvjY27pKGWMCUhil6114SyFfg0EMgUChKxc+aioxwYSe5tiwDEMCUvMzuxViRfFKuK0U+fET7lvn1i7muS0norG5xow9qdqCt+OZqD8csJtwjwry/nrgj1COycPqFCokLjz+2onr9WusWa9qtUTzxO/c72ltta2gIEYRdYJeWLBFaGX5JMAyIMWnSy914GnR677XdSFDAu77yfg3Nx6oaQjromgP5cMCH5mPkhj4hi3y2tgkB/s4oYXhyKsEVmeAOrQuOJRgyVaDgPKG3oRLJYqYQ6fzm/Jjeyehu2sngw/XrnwMlfaOeTMi1mQ+TyXqQ==ZW4tVVM=</p></td>
</tr>
</tbody>
</table>
</center></html></body>
Signatures
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (757) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1432 WindowsUpdate.exe -
Loads dropped DLL 1 IoCs
pid Process 1668 Fantom.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png Fantom.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json Fantom.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg Fantom.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt Fantom.exe File created C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png Fantom.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png Fantom.exe File created C:\Program Files\Internet Explorer\ja-JP\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt Fantom.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png Fantom.exe File opened for modification C:\Program Files\CheckpointTrace.wma Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv Fantom.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar Fantom.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar Fantom.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp Fantom.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak Fantom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fantom.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1668 Fantom.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1668 Fantom.exe Token: SeDebugPrivilege 1620 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe 1620 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1432 1668 Fantom.exe 35 PID 1668 wrote to memory of 1432 1668 Fantom.exe 35 PID 1668 wrote to memory of 1432 1668 Fantom.exe 35 PID 1668 wrote to memory of 1432 1668 Fantom.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fantom.exe"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
PID:1432
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1620
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58d183d7f44a5b6d1afa7582548e19ca1
SHA1a84d27bf6aee458e63aef25426875c0501cfa8ff
SHA2560da2995fec443c4316212d58c2db3336c7ee71971e7a44c9da802430d9c4b608
SHA512bda3f6a7d57fbffd3f53797de28fc2796e1bb1137171d046abf29c6d470488d94f0e53653acf77a9de3b1b32fecf297b26f2b4facbff3052a43812c1dd059f05
-
Filesize
160B
MD5d021685af98bdde26ceb0fdb62a3d6ae
SHA1f0f6f8846f6c2b943de323eaa5ace3bea450fb65
SHA2569be8fe8ff10907142ddab30ae43772d95e019ddfbd4abf9f0ae7c10b2f546efb
SHA512afa77fcad6989f91f8cbbbdcdff6d4a973b1635ebedb86083d08c3817ecbd69a3e4c6029d45080ad2e7bc2b1c53125cf8eed2b34fad5fe9ca70b9d333e8e13ea
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize12KB
MD5f645b67b4398cce7c89d96565c0cd44c
SHA1bd0fbe82e051bb8baf5018036c801c6885cbfcfa
SHA2566831b04542035e647895c3da3f10b7c62ff49601b2eb1214da04a28880bc0ffc
SHA5121341767996f9dcbd670aa94197ec3e7508098c5770d547c2e3b4e7f8771eb033291ce5789c67f4099a147af08eb835c9d060f262bfc2b8c0b031e64688a800c8
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize8KB
MD52c3ce9988ef76ed3255e3736c89e8deb
SHA103cb021ca043330706ee2b4070e5dc7521768db0
SHA256239aed0c345bc6321a398d919b91b021b0a3a8dbd7b35e28389523e4af05a49f
SHA512708ba3661c98066597d0ee6fbb7e70020ac8c846e30e58241e28e4155f8ad9192cdcf724c658f9f12a93a763e7f8797b58eef865f236ba95bf28370c8195cd17
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize11KB
MD5cff33f9fe010c3a47493ced30ecf4d51
SHA17b22bd8b07b6967df403a038a98d5f752e17e138
SHA2565e8190f45a36981e6e676bb0b2817b402c2379c34dcb0db9177c2751a73922c1
SHA512942641d7efcba754b4fb0cc201474cef6d9ebcdcf125fd187bc5cd17b5d96289cb401dc1b8d284d23d804776325e86ed98fe2b3d50397a1474c8515f5030ca12
-
Filesize
21KB
MD5fec89e9d2784b4c015fed6f5ae558e08
SHA1581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2
SHA256489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
SHA512e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24
