Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13-02-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe
Resource
win10v2004-en-20220113
General
-
Target
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe
-
Size
330KB
-
MD5
fd53797716c706419a3d1bf347acbf8a
-
SHA1
3388dac6ab1e07733c007f06d53dbe6a0fbab429
-
SHA256
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b
-
SHA512
e12965fd52cbd450993192ab91aa16cdd263b3c35e3eeda72a29f0e49f12abdaf866e4e4229a13e9a0239365773f487943b19ca4cc81507a5499ae3186e15c5b
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 4 IoCs
Processes:
Satana.exeSatana.exengsnaqe.exengsnaqe.exepid process 1792 Satana.exe 1924 Satana.exe 1740 ngsnaqe.exe 1544 ngsnaqe.exe -
Loads dropped DLL 8 IoCs
Processes:
Satana.exeSatana.exengsnaqe.exengsnaqe.exepid process 1792 Satana.exe 1924 Satana.exe 1924 Satana.exe 1924 Satana.exe 1924 Satana.exe 1924 Satana.exe 1740 ngsnaqe.exe 1544 ngsnaqe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Satana.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Satana.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtapzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" Satana.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ngsnaqe.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 ngsnaqe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Satana.exengsnaqe.exedescription pid process target process PID 1792 set thread context of 1924 1792 Satana.exe Satana.exe PID 1740 set thread context of 1544 1740 ngsnaqe.exe ngsnaqe.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ngsnaqe.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\drag.png ngsnaqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\icon.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg ngsnaqe.exe File created C:\Program Files\Microsoft Games\Mahjong\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png ngsnaqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png ngsnaqe.exe File created C:\Program Files\Windows Journal\fr-FR\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif ngsnaqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png ngsnaqe.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\!satana!.txt ngsnaqe.exe File created C:\Program Files\VideoLAN\VLC\locale\co\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png ngsnaqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml ngsnaqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png ngsnaqe.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\gadget.xml ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png ngsnaqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml ngsnaqe.exe File created C:\Program Files (x86)\Microsoft Office\Office14\3082\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml ngsnaqe.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoDev.png ngsnaqe.exe File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\!satana!.txt ngsnaqe.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml ngsnaqe.exe File created C:\Program Files\Mozilla Firefox\defaults\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif ngsnaqe.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\!satana!.txt ngsnaqe.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\ChessIconImagesMask.bmp ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml ngsnaqe.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg ngsnaqe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_h.png ngsnaqe.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png ngsnaqe.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png ngsnaqe.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\!satana!.txt ngsnaqe.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif ngsnaqe.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml ngsnaqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml ngsnaqe.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\!satana!.txt ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png ngsnaqe.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png ngsnaqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png ngsnaqe.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png ngsnaqe.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png ngsnaqe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif ngsnaqe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif ngsnaqe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
VSSADMIN.EXEpid process 1872 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ngsnaqe.exevssvc.exedescription pid process Token: SeIncBasePriorityPrivilege 1544 ngsnaqe.exe Token: SeBackupPrivilege 1868 vssvc.exe Token: SeRestorePrivilege 1868 vssvc.exe Token: SeAuditPrivilege 1868 vssvc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exeSatana.exeSatana.exengsnaqe.exengsnaqe.exedescription pid process target process PID 968 wrote to memory of 1792 968 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe Satana.exe PID 968 wrote to memory of 1792 968 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe Satana.exe PID 968 wrote to memory of 1792 968 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe Satana.exe PID 968 wrote to memory of 1792 968 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1792 wrote to memory of 1924 1792 Satana.exe Satana.exe PID 1924 wrote to memory of 1740 1924 Satana.exe ngsnaqe.exe PID 1924 wrote to memory of 1740 1924 Satana.exe ngsnaqe.exe PID 1924 wrote to memory of 1740 1924 Satana.exe ngsnaqe.exe PID 1924 wrote to memory of 1740 1924 Satana.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1740 wrote to memory of 1544 1740 ngsnaqe.exe ngsnaqe.exe PID 1544 wrote to memory of 1872 1544 ngsnaqe.exe VSSADMIN.EXE PID 1544 wrote to memory of 1872 1544 ngsnaqe.exe VSSADMIN.EXE PID 1544 wrote to memory of 1872 1544 ngsnaqe.exe VSSADMIN.EXE PID 1544 wrote to memory of 1872 1544 ngsnaqe.exe VSSADMIN.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe"C:\Users\Admin\AppData\Local\Temp\fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\ngsnaqe.exe"C:\Users\Admin\AppData\Local\Temp\ngsnaqe.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ngsnaqe.exe"C:\Users\Admin\AppData\Local\Temp\ngsnaqe.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\Satana\Satana.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet6⤵
- Interacts with shadow copies
PID:1872
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6ac0ac0cb5c23ba7a7e369f2084d0d05
SHA1721b0f1f9e5121ff54c434681da59c0f1f335663
SHA25630ce77f9fd332f903de0c361134062247ea98ee2da64d0a74531bd839acef90a
SHA51272beabbbb492284723985706a32579f6cec411991aa588b9f55081b99f9ee63c76a35928ffd2997a617d1c628cbe11eae9ebee385e08a14063582e8f6a4e6b3b
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5