Analysis
-
max time kernel
162s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
22-02-2022 08:33
Static task
static1
Behavioral task
behavioral1
Sample
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
General
-
Target
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe
-
Size
267KB
-
MD5
ec3a003082a19fd6a00f84df315d18a2
-
SHA1
e7268a6982c3d17aaf472b331b67fbdbc4000dec
-
SHA256
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143
-
SHA512
d3e804add5ebf3efdbf4794cbc1cc53bfc0485298771a1f43d7d683870f82561be3387d83436cf308e260bd600ce475998add0d094d63ab46f3dd75ad16f74aa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Mc.exeMc.exepid Process 3688 Mc.exe 1544 Mc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe -
Loads dropped DLL 2 IoCs
Processes:
Mc.exeMc.exepid Process 3688 Mc.exe 1544 Mc.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 54 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "11.538927" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4164" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901688803651352" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.492604" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4272" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.434743" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4020" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\XXXX\CLSID = 41003400320043004400330034003700410036003400420043003200380043000000 svchost.exe Key created \REGISTRY\MACHINE\Software\CLASSES\XXXX svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exemsiexec.exepid Process 3728 svchost.exe 3728 svchost.exe 3728 svchost.exe 3728 svchost.exe 3728 svchost.exe 3728 svchost.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 3728 svchost.exe 3728 svchost.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 3728 svchost.exe 3728 svchost.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 3728 svchost.exe 3728 svchost.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 3728 svchost.exe 3728 svchost.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe 212 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exemsiexec.exepid Process 3728 svchost.exe 212 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Mc.exeMc.exesvchost.exemsiexec.exedescription pid Process Token: SeDebugPrivilege 3688 Mc.exe Token: SeTcbPrivilege 3688 Mc.exe Token: SeDebugPrivilege 1544 Mc.exe Token: SeTcbPrivilege 1544 Mc.exe Token: SeDebugPrivilege 3728 svchost.exe Token: SeTcbPrivilege 3728 svchost.exe Token: SeDebugPrivilege 212 msiexec.exe Token: SeTcbPrivilege 212 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exeMc.exesvchost.exedescription pid Process procid_target PID 1128 wrote to memory of 3688 1128 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 58 PID 1128 wrote to memory of 3688 1128 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 58 PID 1128 wrote to memory of 3688 1128 8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe 58 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 1544 wrote to memory of 3728 1544 Mc.exe 63 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67 PID 3728 wrote to memory of 212 3728 svchost.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe"C:\Users\Admin\AppData\Local\Temp\8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mc.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:64
-
C:\ProgramData\MC\Mc.exeC:\ProgramData\MC\Mc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
884d46c01c762ad6ddd2759fd921bf71
SHA1d201b130232e0ea411daa23c1ba2892fe6468712
SHA2563124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe
SHA5120acb3fe1050c1c07880ed2161956c4bee7c1e813a5fb518059b9bb88ed0bff50c108ad7b3708b6568413df4bdcc6f4d26dcd8759625a5ab77c4b26c1ba4f8813
-
MD5
884d46c01c762ad6ddd2759fd921bf71
SHA1d201b130232e0ea411daa23c1ba2892fe6468712
SHA2563124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe
SHA5120acb3fe1050c1c07880ed2161956c4bee7c1e813a5fb518059b9bb88ed0bff50c108ad7b3708b6568413df4bdcc6f4d26dcd8759625a5ab77c4b26c1ba4f8813
-
MD5
ffa5f4b6b580d53bc311d6e5bace3110
SHA1d599ca575b995d8de971aed8a64762225bde386d
SHA2569857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02
SHA51220ac2b2508e931d545e952d29afa5ee8ce6600934e56ff8aee169ee2e1cb7c0d7eb1396c947edb45c31a434bd17ceada0cdfd5ea0c11ce7cc7298cbac4c9ca90
-
MD5
ffa5f4b6b580d53bc311d6e5bace3110
SHA1d599ca575b995d8de971aed8a64762225bde386d
SHA2569857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02
SHA51220ac2b2508e931d545e952d29afa5ee8ce6600934e56ff8aee169ee2e1cb7c0d7eb1396c947edb45c31a434bd17ceada0cdfd5ea0c11ce7cc7298cbac4c9ca90
-
MD5
e8f20ec41ae7091198579a1b731f6da2
SHA1ac524110bcf5148db5f0d0b7f0ff42f3470209b4
SHA25627b9495c45248c3702d355323d8e70731f87c4889abebc6967265c83527e40e7
SHA5127686e53076993926ed7f012d5cde0848d6b5119ef1a5f6760e382f72c2ff3205a5d2fc6846778ee4e560bd01c8b2eedb46ab5efed8152aa588891dfa8b761bd8
-
MD5
884d46c01c762ad6ddd2759fd921bf71
SHA1d201b130232e0ea411daa23c1ba2892fe6468712
SHA2563124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe
SHA5120acb3fe1050c1c07880ed2161956c4bee7c1e813a5fb518059b9bb88ed0bff50c108ad7b3708b6568413df4bdcc6f4d26dcd8759625a5ab77c4b26c1ba4f8813
-
MD5
884d46c01c762ad6ddd2759fd921bf71
SHA1d201b130232e0ea411daa23c1ba2892fe6468712
SHA2563124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe
SHA5120acb3fe1050c1c07880ed2161956c4bee7c1e813a5fb518059b9bb88ed0bff50c108ad7b3708b6568413df4bdcc6f4d26dcd8759625a5ab77c4b26c1ba4f8813
-
MD5
ffa5f4b6b580d53bc311d6e5bace3110
SHA1d599ca575b995d8de971aed8a64762225bde386d
SHA2569857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02
SHA51220ac2b2508e931d545e952d29afa5ee8ce6600934e56ff8aee169ee2e1cb7c0d7eb1396c947edb45c31a434bd17ceada0cdfd5ea0c11ce7cc7298cbac4c9ca90
-
MD5
ffa5f4b6b580d53bc311d6e5bace3110
SHA1d599ca575b995d8de971aed8a64762225bde386d
SHA2569857e40be1fb5b9b6db93dc03f96f6b3ff0ffab85af7944dddcac0e37775ab02
SHA51220ac2b2508e931d545e952d29afa5ee8ce6600934e56ff8aee169ee2e1cb7c0d7eb1396c947edb45c31a434bd17ceada0cdfd5ea0c11ce7cc7298cbac4c9ca90
-
MD5
e8f20ec41ae7091198579a1b731f6da2
SHA1ac524110bcf5148db5f0d0b7f0ff42f3470209b4
SHA25627b9495c45248c3702d355323d8e70731f87c4889abebc6967265c83527e40e7
SHA5127686e53076993926ed7f012d5cde0848d6b5119ef1a5f6760e382f72c2ff3205a5d2fc6846778ee4e560bd01c8b2eedb46ab5efed8152aa588891dfa8b761bd8