Overview
overview
10Static
static
10foo/0044d6...f7.exe
windows7-x64
1foo/0044d6...f7.exe
windows10-2004-x64
3foo/034e4c...a9.exe
windows7-x64
4foo/034e4c...a9.exe
windows10-2004-x64
4foo/035fa2...72.exe
windows7-x64
6foo/035fa2...72.exe
windows10-2004-x64
6foo/04884a...1b.exe
windows7-x64
7foo/04884a...1b.exe
windows10-2004-x64
7foo/06ed82...59.exe
windows7-x64
7foo/06ed82...59.exe
windows10-2004-x64
7foo/07470b...68.exe
windows7-x64
7foo/07470b...68.exe
windows10-2004-x64
7foo/078adb...c0.exe
windows7-x64
10foo/078adb...c0.exe
windows10-2004-x64
10foo/09e5c8...b4.exe
windows7-x64
3foo/09e5c8...b4.exe
windows10-2004-x64
3foo/0becfe...f4.exe
windows7-x64
10foo/0becfe...f4.exe
windows10-2004-x64
10foo/1a78d3...a3.exe
windows7-x64
5foo/1a78d3...a3.exe
windows10-2004-x64
7foo/1ffe82...a6.exe
windows7-x64
10foo/1ffe82...a6.exe
windows10-2004-x64
10foo/255028...e1.dll
windows7-x64
3foo/255028...e1.dll
windows10-2004-x64
3foo/27601d...cc.exe
windows7-x64
7foo/27601d...cc.exe
windows10-2004-x64
7foo/27f911...49.exe
windows7-x64
10foo/27f911...49.exe
windows10-2004-x64
10foo/28408c...c5.exe
windows7-x64
10foo/28408c...c5.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 17:46
Static task
static1
Behavioral task
behavioral1
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral4
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral14
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
-
Size
443KB
-
MD5
0becfedf4d0b9ad5251aca33274a4cf4
-
SHA1
5d6faf04a6215b08988f289373f3b239d5878d06
-
SHA256
235b35c4574f4d28ac034e7fbd4827384f6243d591d1d1bd76e320905f5b0242
-
SHA512
0e835c83ff46c74acf6140bd434666ddffd2c0aa9875fc9899daff62b473ab98ee0947c226e9ffd8c4322b418574e9f5e2d2d32415b232667921c3db404dcd35
-
SSDEEP
12288:ONWz1AUZbht1FGdX3HLbDLuibinIrwBtTZG:OQzO8bhOLy04IrytI
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,,C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\tormrjXG.exe" 0becfedf4d0b9ad5251aca33274a4cf4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\tormrjXG.exe" 0becfedf4d0b9ad5251aca33274a4cf4.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" DIKHGfmX.exe -
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" DIKHGfmX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DIKHGfmX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" DIKHGfmX.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral17/files/0x000500000001c8a6-17.dat aspack_v212_v242 -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hauKxjyO.exe 0becfedf4d0b9ad5251aca33274a4cf4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hauKxjyO.exe 0becfedf4d0b9ad5251aca33274a4cf4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hauKxjyO.exe DIKHGfmX.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hauKxjyO.exe DIKHGfmX.exe -
Executes dropped EXE 2 IoCs
pid Process 2684 DIKHGfmX.exe 2744 DIKHGfmX.exe -
Loads dropped DLL 2 IoCs
pid Process 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe 2684 DIKHGfmX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" DIKHGfmX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" DIKHGfmX.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\phrtfOWT = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TlDvFjJP.exe" 0becfedf4d0b9ad5251aca33274a4cf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\phrtfOWT = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TlDvFjJP.exe" DIKHGfmX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DIKHGfmX.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2640 set thread context of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2684 set thread context of 2744 2684 DIKHGfmX.exe 32 -
resource yara_rule behavioral17/memory/2656-10-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2656-12-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2656-11-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2656-6-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2744-39-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2656-46-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2744-48-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2744-53-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral17/memory/2744-77-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\tormrjXG.exe 0becfedf4d0b9ad5251aca33274a4cf4.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\tormrjXG.exe 0becfedf4d0b9ad5251aca33274a4cf4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIKHGfmX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0becfedf4d0b9ad5251aca33274a4cf4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0becfedf4d0b9ad5251aca33274a4cf4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIKHGfmX.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe 2744 DIKHGfmX.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeSecurityPrivilege 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe Token: SeDebugPrivilege 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe Token: SeTcbPrivilege 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe Token: SeSecurityPrivilege 2744 DIKHGfmX.exe Token: SeDebugPrivilege 2744 DIKHGfmX.exe Token: SeTcbPrivilege 2744 DIKHGfmX.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2640 wrote to memory of 2656 2640 0becfedf4d0b9ad5251aca33274a4cf4.exe 30 PID 2656 wrote to memory of 2684 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe 31 PID 2656 wrote to memory of 2684 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe 31 PID 2656 wrote to memory of 2684 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe 31 PID 2656 wrote to memory of 2684 2656 0becfedf4d0b9ad5251aca33274a4cf4.exe 31 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 PID 2684 wrote to memory of 2744 2684 DIKHGfmX.exe 32 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DIKHGfmX.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\0becfedf4d0b9ad5251aca33274a4cf4.exe"C:\Users\Admin\AppData\Local\Temp\foo\0becfedf4d0b9ad5251aca33274a4cf4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\foo\0becfedf4d0b9ad5251aca33274a4cf4.exe"C:\Users\Admin\AppData\Local\Temp\foo\0becfedf4d0b9ad5251aca33274a4cf4.exe"2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\DIKHGfmX.exe"C:\Users\Admin\AppData\Local\Temp\DIKHGfmX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\DIKHGfmX.exe"C:\Users\Admin\AppData\Local\Temp\DIKHGfmX.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2744
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443KB
MD50becfedf4d0b9ad5251aca33274a4cf4
SHA15d6faf04a6215b08988f289373f3b239d5878d06
SHA256235b35c4574f4d28ac034e7fbd4827384f6243d591d1d1bd76e320905f5b0242
SHA5120e835c83ff46c74acf6140bd434666ddffd2c0aa9875fc9899daff62b473ab98ee0947c226e9ffd8c4322b418574e9f5e2d2d32415b232667921c3db404dcd35