Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 22:56
Behavioral task
behavioral1
Sample
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
Resource
win10v2004-20250217-en
General
-
Target
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe
-
Size
2.0MB
-
MD5
74559bd400d5ec38948f032fcc075ce2
-
SHA1
f72d4a67eb021c4373527d50b7a441ec34f4fb93
-
SHA256
24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d
-
SHA512
691e81266125de0ce21a408b06e69b8ca3d6d323a36dbc7d3dbae4d819eed6dece84d8d8d11bdacde192ce4376101b08bddf19712b650b472fe441407c71a95e
-
SSDEEP
49152:MsThC6TYNwUXz+JR2wjx8+X5gZ+th1aaucQPfM7cSCGDt7WWcrRhajx3l7bQonW7:MsThC6TYNwUXz+JR2wjx8+JgZ+th1aa0
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 15 IoCs
resource yara_rule behavioral2/memory/6012-36-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-51-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-53-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-58-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-60-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-62-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-65-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-67-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-69-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-72-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-74-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-76-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-79-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-81-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral2/memory/6012-83-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe -
Executes dropped EXE 3 IoCs
pid Process 1936 Windowsdef.exe 6012 Windowsdef.exe 5368 Windowsdef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDef = "C:\\Users\\Admin\\AppData\\Roaming\\Directory\\Windowsdef.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1936 set thread context of 6012 1936 Windowsdef.exe 93 PID 1936 set thread context of 5368 1936 Windowsdef.exe 94 -
resource yara_rule behavioral2/memory/3224-0-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral2/files/0x0007000000023c9e-16.dat upx behavioral2/memory/3224-28-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral2/memory/6012-34-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-36-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/5368-43-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/5368-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/1936-50-0x0000000000400000-0x00000000005FD000-memory.dmp upx behavioral2/memory/5368-37-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/6012-31-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-51-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/5368-52-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/6012-53-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-58-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-60-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-62-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-65-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-67-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-69-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-74-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-76-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-79-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-81-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral2/memory/6012-83-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windowsdef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 5300 reg.exe 5796 reg.exe 1656 reg.exe 4560 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 6012 Windowsdef.exe Token: SeCreateTokenPrivilege 6012 Windowsdef.exe Token: SeAssignPrimaryTokenPrivilege 6012 Windowsdef.exe Token: SeLockMemoryPrivilege 6012 Windowsdef.exe Token: SeIncreaseQuotaPrivilege 6012 Windowsdef.exe Token: SeMachineAccountPrivilege 6012 Windowsdef.exe Token: SeTcbPrivilege 6012 Windowsdef.exe Token: SeSecurityPrivilege 6012 Windowsdef.exe Token: SeTakeOwnershipPrivilege 6012 Windowsdef.exe Token: SeLoadDriverPrivilege 6012 Windowsdef.exe Token: SeSystemProfilePrivilege 6012 Windowsdef.exe Token: SeSystemtimePrivilege 6012 Windowsdef.exe Token: SeProfSingleProcessPrivilege 6012 Windowsdef.exe Token: SeIncBasePriorityPrivilege 6012 Windowsdef.exe Token: SeCreatePagefilePrivilege 6012 Windowsdef.exe Token: SeCreatePermanentPrivilege 6012 Windowsdef.exe Token: SeBackupPrivilege 6012 Windowsdef.exe Token: SeRestorePrivilege 6012 Windowsdef.exe Token: SeShutdownPrivilege 6012 Windowsdef.exe Token: SeDebugPrivilege 6012 Windowsdef.exe Token: SeAuditPrivilege 6012 Windowsdef.exe Token: SeSystemEnvironmentPrivilege 6012 Windowsdef.exe Token: SeChangeNotifyPrivilege 6012 Windowsdef.exe Token: SeRemoteShutdownPrivilege 6012 Windowsdef.exe Token: SeUndockPrivilege 6012 Windowsdef.exe Token: SeSyncAgentPrivilege 6012 Windowsdef.exe Token: SeEnableDelegationPrivilege 6012 Windowsdef.exe Token: SeManageVolumePrivilege 6012 Windowsdef.exe Token: SeImpersonatePrivilege 6012 Windowsdef.exe Token: SeCreateGlobalPrivilege 6012 Windowsdef.exe Token: 31 6012 Windowsdef.exe Token: 32 6012 Windowsdef.exe Token: 33 6012 Windowsdef.exe Token: 34 6012 Windowsdef.exe Token: 35 6012 Windowsdef.exe Token: SeDebugPrivilege 5368 Windowsdef.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 1936 Windowsdef.exe 6012 Windowsdef.exe 6012 Windowsdef.exe 5368 Windowsdef.exe 6012 Windowsdef.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 3224 wrote to memory of 2688 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 87 PID 3224 wrote to memory of 2688 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 87 PID 3224 wrote to memory of 2688 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 87 PID 2688 wrote to memory of 2460 2688 cmd.exe 90 PID 2688 wrote to memory of 2460 2688 cmd.exe 90 PID 2688 wrote to memory of 2460 2688 cmd.exe 90 PID 3224 wrote to memory of 1936 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 92 PID 3224 wrote to memory of 1936 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 92 PID 3224 wrote to memory of 1936 3224 24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe 92 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 6012 1936 Windowsdef.exe 93 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 1936 wrote to memory of 5368 1936 Windowsdef.exe 94 PID 6012 wrote to memory of 1084 6012 Windowsdef.exe 95 PID 6012 wrote to memory of 1084 6012 Windowsdef.exe 95 PID 6012 wrote to memory of 1084 6012 Windowsdef.exe 95 PID 6012 wrote to memory of 4860 6012 Windowsdef.exe 96 PID 6012 wrote to memory of 4860 6012 Windowsdef.exe 96 PID 6012 wrote to memory of 4860 6012 Windowsdef.exe 96 PID 6012 wrote to memory of 6136 6012 Windowsdef.exe 97 PID 6012 wrote to memory of 6136 6012 Windowsdef.exe 97 PID 6012 wrote to memory of 6136 6012 Windowsdef.exe 97 PID 6012 wrote to memory of 2264 6012 Windowsdef.exe 98 PID 6012 wrote to memory of 2264 6012 Windowsdef.exe 98 PID 6012 wrote to memory of 2264 6012 Windowsdef.exe 98 PID 4860 wrote to memory of 5300 4860 cmd.exe 103 PID 4860 wrote to memory of 5300 4860 cmd.exe 103 PID 4860 wrote to memory of 5300 4860 cmd.exe 103 PID 1084 wrote to memory of 5796 1084 cmd.exe 104 PID 1084 wrote to memory of 5796 1084 cmd.exe 104 PID 1084 wrote to memory of 5796 1084 cmd.exe 104 PID 2264 wrote to memory of 1656 2264 cmd.exe 105 PID 2264 wrote to memory of 1656 2264 cmd.exe 105 PID 2264 wrote to memory of 1656 2264 cmd.exe 105 PID 6136 wrote to memory of 4560 6136 cmd.exe 106 PID 6136 wrote to memory of 4560 6136 cmd.exe 106 PID 6136 wrote to memory of 4560 6136 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe"C:\Users\Admin\AppData\Local\Temp\24269894b56f9261559f90bf63fe9fd55777ae3bccd6e008adb345fa04f2106d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Axhgp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDef" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2460
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exeC:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:5796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:5300
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1656
-
-
-
-
C:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exeC:\Users\Admin\AppData\Roaming\Directory\Windowsdef.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5368
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5130a1ad614bfc1851533b7a02e302622
SHA16cd68d0bacb7b24ca9baedc80d90f1bfca3bb92c
SHA2564620f5f49d3f3c3fcb10d7dd83e5fdc0b2efd44ae429ee5a8dc3e64d76e6bc9a
SHA51216b5e40deb2e66287b86bbff11ac986f36b94a5849fbe2ed7124296e95d563ec0e9b00cbd6008c993c383d1610d371177faf5a9cd5da77a34a778e901f9e7a25
-
Filesize
2.0MB
MD5bb80e85fab534548cb4f3b035d6794b7
SHA120700442ee04b742132b44a4695c57c0df0db6ff
SHA256148cd57019ec098ccca6df6ebbbb867abab885e3e0d933e9cd672b7e658fa515
SHA51226ff7709b8bc2dbce0d05b701fc234007eb8dc0fb3260964bf32578bb4ec92405b3c153a91bea689c8939eb8f021200b3b930887925c15f2af0f16abf307529b