Analysis
-
max time kernel
295s -
max time network
303s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-06-2022 03:47
Static task
static1
Behavioral task
behavioral1
Sample
SCAN-026764.pdf.msi
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SCAN-026764.pdf.msi
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
SCAN-026764.pdf.msi
-
Size
224KB
-
MD5
d6a0e1a37a73098a9a7839b137521fe0
-
SHA1
8f0c2d9bdbd1fca8b84cd2cc625607547036d8e6
-
SHA256
e22ec74cd833a85882d5a8e76fa3b35daff0b7390bfbcd6b1ab270fd3741ceea
-
SHA512
0ca3e6839950b0094d1c95647308ceab713ad23e69c73b10156ad4fef4c3f718c76ad5558260f89da84d2a2cd4b53e63a3cb9bc87d2fb47d580a36c9170b9653
Score
10/10
Malware Config
Signatures
-
Matanbuchus
A loader sold as MaaS first seen in February 2021.
-
suricata: ET MALWARE Matanbuchus Loader CnC M1
suricata: ET MALWARE Matanbuchus Loader CnC M1
-
suricata: ET MALWARE Matanbuchus Loader CnC M3
suricata: ET MALWARE Matanbuchus Loader CnC M3
-
Blocklisted process makes network request 3 IoCs
flow pid Process 2 1048 msiexec.exe 4 1048 msiexec.exe 5 2024 msiexec.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 1244 regsvr32.exe 976 regsvr32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\6c46e4.msi msiexec.exe File opened for modification C:\Windows\Installer\6c46e2.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\6c46e1.msi msiexec.exe File created C:\Windows\Installer\6c46e2.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6c46e1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4CA7.tmp msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2024 msiexec.exe 2024 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1048 msiexec.exe Token: SeIncreaseQuotaPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeSecurityPrivilege 2024 msiexec.exe Token: SeCreateTokenPrivilege 1048 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1048 msiexec.exe Token: SeLockMemoryPrivilege 1048 msiexec.exe Token: SeIncreaseQuotaPrivilege 1048 msiexec.exe Token: SeMachineAccountPrivilege 1048 msiexec.exe Token: SeTcbPrivilege 1048 msiexec.exe Token: SeSecurityPrivilege 1048 msiexec.exe Token: SeTakeOwnershipPrivilege 1048 msiexec.exe Token: SeLoadDriverPrivilege 1048 msiexec.exe Token: SeSystemProfilePrivilege 1048 msiexec.exe Token: SeSystemtimePrivilege 1048 msiexec.exe Token: SeProfSingleProcessPrivilege 1048 msiexec.exe Token: SeIncBasePriorityPrivilege 1048 msiexec.exe Token: SeCreatePagefilePrivilege 1048 msiexec.exe Token: SeCreatePermanentPrivilege 1048 msiexec.exe Token: SeBackupPrivilege 1048 msiexec.exe Token: SeRestorePrivilege 1048 msiexec.exe Token: SeShutdownPrivilege 1048 msiexec.exe Token: SeDebugPrivilege 1048 msiexec.exe Token: SeAuditPrivilege 1048 msiexec.exe Token: SeSystemEnvironmentPrivilege 1048 msiexec.exe Token: SeChangeNotifyPrivilege 1048 msiexec.exe Token: SeRemoteShutdownPrivilege 1048 msiexec.exe Token: SeUndockPrivilege 1048 msiexec.exe Token: SeSyncAgentPrivilege 1048 msiexec.exe Token: SeEnableDelegationPrivilege 1048 msiexec.exe Token: SeManageVolumePrivilege 1048 msiexec.exe Token: SeImpersonatePrivilege 1048 msiexec.exe Token: SeCreateGlobalPrivilege 1048 msiexec.exe Token: SeBackupPrivilege 1976 vssvc.exe Token: SeRestorePrivilege 1976 vssvc.exe Token: SeAuditPrivilege 1976 vssvc.exe Token: SeBackupPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeRestorePrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeLoadDriverPrivilege 676 DrvInst.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe Token: SeTakeOwnershipPrivilege 2024 msiexec.exe Token: SeRestorePrivilege 2024 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1048 msiexec.exe 1048 msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1444 2024 msiexec.exe 32 PID 2024 wrote to memory of 1444 2024 msiexec.exe 32 PID 2024 wrote to memory of 1444 2024 msiexec.exe 32 PID 2024 wrote to memory of 1372 2024 msiexec.exe 33 PID 2024 wrote to memory of 1372 2024 msiexec.exe 33 PID 2024 wrote to memory of 1372 2024 msiexec.exe 33 PID 2024 wrote to memory of 1372 2024 msiexec.exe 33 PID 2024 wrote to memory of 1372 2024 msiexec.exe 33 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1372 wrote to memory of 1244 1372 regsvr32.exe 34 PID 1924 wrote to memory of 2044 1924 taskeng.exe 38 PID 1924 wrote to memory of 2044 1924 taskeng.exe 38 PID 1924 wrote to memory of 2044 1924 taskeng.exe 38 PID 1924 wrote to memory of 2044 1924 taskeng.exe 38 PID 1924 wrote to memory of 2044 1924 taskeng.exe 38 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39 PID 2044 wrote to memory of 976 2044 regsvr32.exe 39
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SCAN-026764.pdf.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1048
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\AdobeFontPack\notify.vbs2⤵PID:1444
-
-
C:\Windows\system32\regsvr32.exeregsvr32.exe -n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\regsvr32.exe-n -i:"Install" C:\Users\Admin\AppData\Local\AdobeFontPack\main.dll3⤵
- Loads dropped DLL
PID:1244
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000004A0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:676
-
C:\Windows\system32\taskeng.exetaskeng.exe {BDD76BE8-B564-4B21-91F9-0DFE8B095CD5} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe -n -i:"UpdateСheck" "C:\Users\Admin\AppData\Local\x86\3d02.nls"2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\regsvr32.exe-n -i:"UpdateСheck" "C:\Users\Admin\AppData\Local\x86\3d02.nls"3⤵
- Loads dropped DLL
PID:976
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5308336e7f515478969b24c13ded11ede
SHA18fb0cf42b77dbbef224a1e5fc38abc2486320775
SHA256889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9
SHA51261ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f
-
Filesize
1KB
MD578f2fcaa601f2fb4ebc937ba532e7549
SHA1ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA256552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
SHA512bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57df84293d5426123e15fc11f9b2e82ec
SHA16a4a77f5652f2d8c7c6c50c6d435a0e394e3d98b
SHA256c208c08fc03d9ac80f67a4fa4c2c188b023e6dd3e43fb503b6cf89c9174ba71a
SHA5126924066d41c1785ea3de8cfd72d4407c914440e0cb2e1701356e994ff7dcc044e2a32c52c862a3cf649a0a0bf65ea8e43765b440f5535bb10a6aa05bba4c066f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56118d1e12d8415aa494a6136c8398697
SHA1c0d9664b512727b4de0f3b30b1b99613f3a0bb98
SHA256b70c5d2a085d5466fe3c4c1454db4ddc2430ffd2a9ae9152c92f0fb7b990007c
SHA512accab0a34697c0c202bc39c643fd84977a536a3cee60d4dd53763aab0542ca7fbc04203877bc2c30bae3f6f38a2c402dbf77493462ac89432650f05ca21ffabf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Filesize254B
MD5db3307b8c0bc4938312eac0d2a67b3ed
SHA1433289a23ef6f44e9d18a22a64d99df242781474
SHA256405dc3e50e310ca70aee4c3968075f5b971bdee2f83b87ff688e6de7b5353655
SHA512d9de47d8a0a3531761aeae496c509ee22f4396b0aa3ec6a45ccd8ce9ae72865fc76ef0666a12c0f7e3c93ecfa947065fdcd8a108d5ff701bf3482356abe0b99b
-
Filesize
401KB
MD575ec49f612ed27b454a02f86f4f21c3d
SHA1506d9139c7536541bb4cf59c4ad89626ef921e49
SHA2564cb6877f25072af644fcf0a4d22893b5b00be691b5e21238a16073db9f1fb008
SHA512743949ad1825ddeb2342d0425dfcaf748ac2cdf23b23910c372a679d1983c30a39080a67533794f716beb5aa5971b3c3dc4076375cab541abe534a567dc32141
-
Filesize
68B
MD50308aa2c8dab8a69de41f5d16679bb9b
SHA1c6827bf44a433ff086e787653361859d6f6e2fb3
SHA2560a7e8fd68575db5f84c18b9a26e4058323d1357e2a29a5b12278e4bfa6939489
SHA5121a1ca92e3c8d52c8b5adbb3117a88d8a2a8c33eaf2f7b0d620fe006653f57f4ba0b803884616594ca31e13a1b0b59ddae52cecf044621ec44371084dac6beb72
-
Filesize
401KB
MD595159f5427c976d28c86aa716799e6de
SHA14bfbf8c48f17a7c7269dfc314e5e5bd166db857f
SHA256f8cc2cf36e193774f13c9c5f23ab777496dcd7ca588f4f73b45a7a5ffa96145e
SHA51204af830cecd7ec8bf5d2f637a0e52036800d171f8d74f837648bd2129f8d19385fa46ae39c4cb0fc47c03aaa32d17f8739661d8b57b0d3d74532de29fc20f629
-
Filesize
401KB
MD575ec49f612ed27b454a02f86f4f21c3d
SHA1506d9139c7536541bb4cf59c4ad89626ef921e49
SHA2564cb6877f25072af644fcf0a4d22893b5b00be691b5e21238a16073db9f1fb008
SHA512743949ad1825ddeb2342d0425dfcaf748ac2cdf23b23910c372a679d1983c30a39080a67533794f716beb5aa5971b3c3dc4076375cab541abe534a567dc32141
-
Filesize
401KB
MD595159f5427c976d28c86aa716799e6de
SHA14bfbf8c48f17a7c7269dfc314e5e5bd166db857f
SHA256f8cc2cf36e193774f13c9c5f23ab777496dcd7ca588f4f73b45a7a5ffa96145e
SHA51204af830cecd7ec8bf5d2f637a0e52036800d171f8d74f837648bd2129f8d19385fa46ae39c4cb0fc47c03aaa32d17f8739661d8b57b0d3d74532de29fc20f629