Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe
- Size 399KB
- Sample260423-vm8ntsb12x
- SHA256 f2bcb97af36922282a947864055f64939f52014682b2a4e54cbed3b58d0d6c10
- MD5 ae1cdc88e3c0501f9040681c3ef75f6e
- SHA1 310069f9b7d470e892b8dc4486b3a477404f862d
- SHA512 b4b8b932da245fe90676506aa0e5b1a10d59dd8f31d0d8bc40909c44d4b995762bc21231b3439067974bdf9c06e45acb61602dd0c2fda863627916539790a471
- SSDEEP 6144:6j9jU4TvLRdd1+vsZ/c2++hdP6E/FY4TQAEXXLgRHe0r7e4F2rneqB3E4t:6j1rFb1+b2NFYAEXX4e0ne4F2rnXt
- TLSH T1EB9419127BF98435F2F36B319D7582714A77BC61AD38C20E2390262D9EB1A90DA74737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4548 Logo1_.exe 4980 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\edge_BITS_4164_987505187\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\_desktop.ini Logo1_.exe File created C:\Program Files\edge_BITS_4416_1256810829\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\_desktop.ini Logo1_.exe File created C:\Program Files\edge_BITS_4164_1111427751\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f14\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\edge_BITS_4164_1111427751\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\edge_BITS_4164_1834225923\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\edge_BITS_4416_1065688387\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\_desktop.ini Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe File created C:\Windows\Logo1_.exe 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe - Program crash 2 IoCs
pid pid_target Process procid_target 460 4548 WerFault.exe 84 996 4548 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe 4548 Logo1_.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4980 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4980 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 4980 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4416 wrote to memory of 4404 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 83 PID 4416 wrote to memory of 4548 4416 2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe 84 PID 4548 wrote to memory of 4668 4548 Logo1_.exe 85 PID 4668 wrote to memory of 2776 4668 net.exe 88 PID 4404 wrote to memory of 4980 4404 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2EE.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4980
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:2776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 7163⤵
- Program crash
PID:460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 7163⤵
- Program crash
PID:996
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4548 -ip 45481⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4548 -ip 45481⤵PID:5512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.1MB
- SHA256 c08729fc500930b5e8107a0f8ebaff164f26aa2e264ef5270dc185512db7bc7d
- MD5 8e9e0b8928b4eefcc47f5ead02730eac
- SHA1 acfa7de5d073c0a06a9d26f815a58c15bb55352d
- SHA512 b6ad05a274e5eba5c70ad06bf7d4b7ca686e0bfb467181d3fb36987399e7bed5b4ab60308c9fc96e740ec16137c7331ab4c6af1146565464cb5160f553ccfff9
- SSDEEP 49152:AGj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd237:AVQRQyi36YOcP+Lvw2gAf+PN34
- TLSH T177566B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aE2EE.bat
- Size 776B
- SHA256 c831a03f86d4b0157e9d27c6f60605918b303a71f4040597d50c25699b925dd1
- MD5 18a3b318c498f9eb6f190cccd2431e6a
- SHA1 d552e5cf2c27eda2f623d1b8b52d3eb348ccdd6a
- SHA512 a8f38bf743764bc85699a87e66204f9b17ae788d72dd6681442546de52de49e9508f7f1caeb6b7509e12ececa2514a121be88aa6438e1bc619a5d24338639b2f
- TLSH T17D014C1242BB9D7E0A00A01F8FB1598F83DD2AC97A513736B396E3AD41D008AF5E6247
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_ae1cdc88e3c0501f9040681c3ef75f6e_amadey_elex_smoke-loader_stop.exe.exe
- Size 355KB
- SHA256 c22b54d7f91795b06d8f1e8f712befcd37c45e5bfd47e7224093c6b34dd760da
- MD5 0b04bce32b624d32fa3e8db79ce316e1
- SHA1 d6f8fff4f35baaed22107767e9e01cb133079dca
- SHA512 7d6396aaf4b03d36415f5639c7441e2e99b41b3c5ff8d99e559185046a92772002aed6d0b871da584e4c015396514f30f3895bf3e3c124375806d9656d84f6e1
- SSDEEP 6144:7d1+vsZ/c2++hdP6E/FY4TQAEXXLgRHe0r7e4F2rneqB3E4t:Z1+b2NFYAEXX4e0ne4F2rnXt
- TLSH T19074191277F58435F6F32B31AD7582714A7BBC61AD38C20E2390262D9EB1A90DA74737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 44KB
- SHA256 db6a443785d113c28a06566cb990aabc13b069a3b72bb47e811c06bfd80f021b
- MD5 d34c8df725ec27444cc98c0748a9b32e
- SHA1 1202b86671642ece3ffe5ba2f9d8b8f357114779
- SHA512 7d306e2c83efe10af71ca35f5f1340a6a447643df47694547052ea116d2039184f56f9803cefd2a1af5e183128fc1a7c4b96e81557bca1f031de99d39f8f28cf
- SSDEEP 768:hYOT2ljlL5b+/ScqpLTQZBd+vry+1oUEKtBF5fn3ZTJAzONE1d05JyA:6tj95b+lcTQ7d+XoGhv3dJKOY8MA
- TLSH T18D13EF178F0E4AA4D0D1D13426EB0F85D630AC40B421DA1997E0784DDFF2B95FE4AAAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\$RECYCLE.BIN\S-1-5-21-721190819-434563495-2007910846-1000\_desktop.ini
- Size 9B
- SHA256 de3322e1c49dc0b70d2b3a63a9ce062799d4a9d96851d3532ae97dadd8aa2da4
- MD5 de22c088d086e709e318b73d582b66d5
- SHA1 21b0cea79c0be404e5650d5b3fa75a4de34f1d34
- SHA512 c194c24781379e329ee96697c961c80fd6c0483c5f9ac66634e5c8ed5bbdf20c3c5a201fc10a784fdbb9b43a6d4c948415c92f2986ed229d8466d97523645894
- MD5 SHA1 SHA512