Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/03/2025, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
Resource
win10v2004-20250217-en
General
-
Target
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe
-
Size
1.6MB
-
MD5
a6373929ec69d0d3bde77aca3f4afd8e
-
SHA1
ad672810598934b2c0e79ec884645f8c784b6b69
-
SHA256
83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700
-
SHA512
6140ded034c5ebff1d43c414ff27611ba79ae42c0e3bc7b02ecc5837a51bda8682daa97a9216c6686ea4186da71b9241af0cd50462519926977e38b2f5108b57
-
SSDEEP
12288:avk//qKF76/OXpqSjnTf0clY9uWC+RMpk1OC7HmrWcmbQC5onsYia:h1zltpu0ia
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 12 IoCs
resource yara_rule behavioral1/memory/2428-60-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-63-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-68-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-72-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-74-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-77-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-79-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-82-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-84-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-86-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-96-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades behavioral1/memory/2428-100-0x0000000000400000-0x000000000045C000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Executes dropped EXE 3 IoCs
pid Process 1208 jusched.exe 2428 jusched.exe 2772 jusched.exe -
Loads dropped DLL 7 IoCs
pid Process 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1208 jusched.exe 1208 jusched.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Machine = "C:\\Users\\Admin\\AppData\\Roaming\\JavaWeb\\jusched.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1208 set thread context of 2428 1208 jusched.exe 32 PID 1208 set thread context of 2772 1208 jusched.exe 33 -
resource yara_rule behavioral1/memory/2428-57-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-60-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2772-64-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2428-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-56-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2772-55-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2772-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2772-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2772-69-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2428-68-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-72-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-74-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-77-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-79-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-82-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-84-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-86-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-96-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/2428-100-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2620 reg.exe 2296 reg.exe 2508 reg.exe 2516 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2772 jusched.exe Token: 1 2428 jusched.exe Token: SeCreateTokenPrivilege 2428 jusched.exe Token: SeAssignPrimaryTokenPrivilege 2428 jusched.exe Token: SeLockMemoryPrivilege 2428 jusched.exe Token: SeIncreaseQuotaPrivilege 2428 jusched.exe Token: SeMachineAccountPrivilege 2428 jusched.exe Token: SeTcbPrivilege 2428 jusched.exe Token: SeSecurityPrivilege 2428 jusched.exe Token: SeTakeOwnershipPrivilege 2428 jusched.exe Token: SeLoadDriverPrivilege 2428 jusched.exe Token: SeSystemProfilePrivilege 2428 jusched.exe Token: SeSystemtimePrivilege 2428 jusched.exe Token: SeProfSingleProcessPrivilege 2428 jusched.exe Token: SeIncBasePriorityPrivilege 2428 jusched.exe Token: SeCreatePagefilePrivilege 2428 jusched.exe Token: SeCreatePermanentPrivilege 2428 jusched.exe Token: SeBackupPrivilege 2428 jusched.exe Token: SeRestorePrivilege 2428 jusched.exe Token: SeShutdownPrivilege 2428 jusched.exe Token: SeDebugPrivilege 2428 jusched.exe Token: SeAuditPrivilege 2428 jusched.exe Token: SeSystemEnvironmentPrivilege 2428 jusched.exe Token: SeChangeNotifyPrivilege 2428 jusched.exe Token: SeRemoteShutdownPrivilege 2428 jusched.exe Token: SeUndockPrivilege 2428 jusched.exe Token: SeSyncAgentPrivilege 2428 jusched.exe Token: SeEnableDelegationPrivilege 2428 jusched.exe Token: SeManageVolumePrivilege 2428 jusched.exe Token: SeImpersonatePrivilege 2428 jusched.exe Token: SeCreateGlobalPrivilege 2428 jusched.exe Token: 31 2428 jusched.exe Token: 32 2428 jusched.exe Token: 33 2428 jusched.exe Token: 34 2428 jusched.exe Token: 35 2428 jusched.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 1208 jusched.exe 2772 jusched.exe 2428 jusched.exe 2428 jusched.exe 2428 jusched.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1732 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 28 PID 2440 wrote to memory of 1732 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 28 PID 2440 wrote to memory of 1732 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 28 PID 2440 wrote to memory of 1732 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 28 PID 1732 wrote to memory of 2064 1732 cmd.exe 30 PID 1732 wrote to memory of 2064 1732 cmd.exe 30 PID 1732 wrote to memory of 2064 1732 cmd.exe 30 PID 1732 wrote to memory of 2064 1732 cmd.exe 30 PID 2440 wrote to memory of 1208 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 31 PID 2440 wrote to memory of 1208 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 31 PID 2440 wrote to memory of 1208 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 31 PID 2440 wrote to memory of 1208 2440 83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe 31 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2428 1208 jusched.exe 32 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 1208 wrote to memory of 2772 1208 jusched.exe 33 PID 2428 wrote to memory of 2764 2428 jusched.exe 34 PID 2428 wrote to memory of 2764 2428 jusched.exe 34 PID 2428 wrote to memory of 2764 2428 jusched.exe 34 PID 2428 wrote to memory of 2764 2428 jusched.exe 34 PID 2428 wrote to memory of 2728 2428 jusched.exe 35 PID 2428 wrote to memory of 2728 2428 jusched.exe 35 PID 2428 wrote to memory of 2728 2428 jusched.exe 35 PID 2428 wrote to memory of 2728 2428 jusched.exe 35 PID 2428 wrote to memory of 2640 2428 jusched.exe 36 PID 2428 wrote to memory of 2640 2428 jusched.exe 36 PID 2428 wrote to memory of 2640 2428 jusched.exe 36 PID 2428 wrote to memory of 2640 2428 jusched.exe 36 PID 2428 wrote to memory of 2860 2428 jusched.exe 38 PID 2428 wrote to memory of 2860 2428 jusched.exe 38 PID 2428 wrote to memory of 2860 2428 jusched.exe 38 PID 2428 wrote to memory of 2860 2428 jusched.exe 38 PID 2728 wrote to memory of 2516 2728 cmd.exe 41 PID 2728 wrote to memory of 2516 2728 cmd.exe 41 PID 2728 wrote to memory of 2516 2728 cmd.exe 41 PID 2728 wrote to memory of 2516 2728 cmd.exe 41 PID 2764 wrote to memory of 2508 2764 cmd.exe 43 PID 2764 wrote to memory of 2508 2764 cmd.exe 43 PID 2764 wrote to memory of 2508 2764 cmd.exe 43 PID 2764 wrote to memory of 2508 2764 cmd.exe 43 PID 2640 wrote to memory of 2296 2640 cmd.exe 44 PID 2640 wrote to memory of 2296 2640 cmd.exe 44 PID 2640 wrote to memory of 2296 2640 cmd.exe 44 PID 2640 wrote to memory of 2296 2640 cmd.exe 44 PID 2860 wrote to memory of 2620 2860 cmd.exe 45 PID 2860 wrote to memory of 2620 2860 cmd.exe 45 PID 2860 wrote to memory of 2620 2860 cmd.exe 45 PID 2860 wrote to memory of 2620 2860 cmd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"C:\Users\Admin\AppData\Local\Temp\83249c51a35b17d345b677a90c651d5655f8d31d1eddd193dbd764ffe5f72700.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kLwjG.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java Machine" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2064
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2620
-
-
-
-
C:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exeC:\Users\Admin\AppData\Roaming\JavaWeb\jusched.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149B
MD5976ffa9a304b234c039c8739d97bb893
SHA1f70f7ede8b6e5d1b8a9b53c9bf43882485b55bd6
SHA2562b77cf051bb584aada8b9e5e07cba06e2077b42f009c33d10e31994ceec10384
SHA5121bd398b968736efbab740c81776781023a4ef0dc1c0191d6393a7582bd79b452666163691d82a27ee8989a1e293e6d6df57c303aa9b34497ae52be417f9e269c
-
Filesize
1.6MB
MD5281b383c4d6e6cee631c543b8c7f853e
SHA1f8e17233f92cb696f96fe53cbb2e64315de34c94
SHA256821907d299dacffdaa0e6014c04c9155e3febf86d561002cc08f43ed812ad884
SHA5127db1b4131859d646bd8e3fa15f07eacfc4620ed81ee92b882678be1d5c1215219bfb64c3c9395096625c3a7039b413462d4b7736c48c7388d0558d9035bd4e9e