Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
13-07-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
CFDI_826271_53535.exe
Resource
win7-20220414-en
General
-
Target
CFDI_826271_53535.exe
-
Size
894KB
-
MD5
f89a4c9d373e3c928bc405d56a496850
-
SHA1
de58bf97363c74d83249df1ec2f1e9d62a2101d9
-
SHA256
c040a2c32938707e1579fecce89e3c4fa04d019a467f642dd2bb18bab35bf99d
-
SHA512
eb02dcd476e67db8ec0d9bfde5698967c657bbc6cb55973445c565cd10999772b8ba18ecacd85c36bb88ac81898a0d34f2509cf6e2a954c890ffc5c07421d514
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe -
Executes dropped EXE 3 IoCs
Processes:
Gozip.exemiktotik.exemiktotik.exepid process 1324 Gozip.exe 2852 miktotik.exe 5084 miktotik.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
miktotik.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssym9yu7919c9.exe miktotik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssym9yu7919c9.exe\DisableExceptionChainValidation miktotik.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ncyrqdv.exe" explorer.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exeWScript.exeCFDI_826271_53535.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation CFDI_826271_53535.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\ssym9yu7919c9.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\ssym9yu7919c9.exe" explorer.exe -
Processes:
miktotik.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA miktotik.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
miktotik.exeexplorer.exepid process 5084 miktotik.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
miktotik.exedescription pid process target process PID 2852 set thread context of 5084 2852 miktotik.exe miktotik.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1928 2120 WerFault.exe explorer.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
miktotik.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 miktotik.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString miktotik.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Delays execution with timeout.exe 5 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3388 timeout.exe 1128 timeout.exe 400 timeout.exe 3848 timeout.exe 3252 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 840 taskkill.exe 3076 taskkill.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Modifies registry class 2 IoCs
Processes:
cmd.exeCFDI_826271_53535.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings CFDI_826271_53535.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
explorer.exepid process 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe 2120 explorer.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
miktotik.exeexplorer.exepid process 5084 miktotik.exe 5084 miktotik.exe 2120 explorer.exe 2120 explorer.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
taskkill.exemiktotik.exetaskkill.exeexplorer.exedescription pid process Token: SeDebugPrivilege 840 taskkill.exe Token: SeDebugPrivilege 5084 miktotik.exe Token: SeRestorePrivilege 5084 miktotik.exe Token: SeBackupPrivilege 5084 miktotik.exe Token: SeLoadDriverPrivilege 5084 miktotik.exe Token: SeCreatePagefilePrivilege 5084 miktotik.exe Token: SeShutdownPrivilege 5084 miktotik.exe Token: SeTakeOwnershipPrivilege 5084 miktotik.exe Token: SeChangeNotifyPrivilege 5084 miktotik.exe Token: SeCreateTokenPrivilege 5084 miktotik.exe Token: SeMachineAccountPrivilege 5084 miktotik.exe Token: SeSecurityPrivilege 5084 miktotik.exe Token: SeAssignPrimaryTokenPrivilege 5084 miktotik.exe Token: SeCreateGlobalPrivilege 5084 miktotik.exe Token: 33 5084 miktotik.exe Token: SeDebugPrivilege 3076 taskkill.exe Token: SeDebugPrivilege 2120 explorer.exe Token: SeRestorePrivilege 2120 explorer.exe Token: SeBackupPrivilege 2120 explorer.exe Token: SeLoadDriverPrivilege 2120 explorer.exe Token: SeCreatePagefilePrivilege 2120 explorer.exe Token: SeShutdownPrivilege 2120 explorer.exe Token: SeTakeOwnershipPrivilege 2120 explorer.exe Token: SeChangeNotifyPrivilege 2120 explorer.exe Token: SeCreateTokenPrivilege 2120 explorer.exe Token: SeMachineAccountPrivilege 2120 explorer.exe Token: SeSecurityPrivilege 2120 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2120 explorer.exe Token: SeCreateGlobalPrivilege 2120 explorer.exe Token: 33 2120 explorer.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
CFDI_826271_53535.exeWScript.execmd.exeWScript.execmd.exemiktotik.exemiktotik.exeexplorer.exedescription pid process target process PID 4780 wrote to memory of 4684 4780 CFDI_826271_53535.exe WScript.exe PID 4780 wrote to memory of 4684 4780 CFDI_826271_53535.exe WScript.exe PID 4780 wrote to memory of 4684 4780 CFDI_826271_53535.exe WScript.exe PID 4684 wrote to memory of 1632 4684 WScript.exe cmd.exe PID 4684 wrote to memory of 1632 4684 WScript.exe cmd.exe PID 4684 wrote to memory of 1632 4684 WScript.exe cmd.exe PID 1632 wrote to memory of 3388 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 3388 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 3388 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 1324 1632 cmd.exe Gozip.exe PID 1632 wrote to memory of 1324 1632 cmd.exe Gozip.exe PID 1632 wrote to memory of 1324 1632 cmd.exe Gozip.exe PID 1632 wrote to memory of 1128 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 1128 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 1128 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 2316 1632 cmd.exe WScript.exe PID 1632 wrote to memory of 2316 1632 cmd.exe WScript.exe PID 1632 wrote to memory of 2316 1632 cmd.exe WScript.exe PID 1632 wrote to memory of 400 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 400 1632 cmd.exe timeout.exe PID 1632 wrote to memory of 400 1632 cmd.exe timeout.exe PID 2316 wrote to memory of 224 2316 WScript.exe cmd.exe PID 2316 wrote to memory of 224 2316 WScript.exe cmd.exe PID 2316 wrote to memory of 224 2316 WScript.exe cmd.exe PID 224 wrote to memory of 3068 224 cmd.exe attrib.exe PID 224 wrote to memory of 3068 224 cmd.exe attrib.exe PID 224 wrote to memory of 3068 224 cmd.exe attrib.exe PID 224 wrote to memory of 3848 224 cmd.exe timeout.exe PID 224 wrote to memory of 3848 224 cmd.exe timeout.exe PID 224 wrote to memory of 3848 224 cmd.exe timeout.exe PID 224 wrote to memory of 2852 224 cmd.exe miktotik.exe PID 224 wrote to memory of 2852 224 cmd.exe miktotik.exe PID 224 wrote to memory of 2852 224 cmd.exe miktotik.exe PID 2852 wrote to memory of 5084 2852 miktotik.exe miktotik.exe PID 2852 wrote to memory of 5084 2852 miktotik.exe miktotik.exe PID 2852 wrote to memory of 5084 2852 miktotik.exe miktotik.exe PID 2852 wrote to memory of 5084 2852 miktotik.exe miktotik.exe PID 2852 wrote to memory of 5084 2852 miktotik.exe miktotik.exe PID 224 wrote to memory of 840 224 cmd.exe taskkill.exe PID 224 wrote to memory of 840 224 cmd.exe taskkill.exe PID 224 wrote to memory of 840 224 cmd.exe taskkill.exe PID 224 wrote to memory of 3076 224 cmd.exe taskkill.exe PID 224 wrote to memory of 3076 224 cmd.exe taskkill.exe PID 224 wrote to memory of 3076 224 cmd.exe taskkill.exe PID 224 wrote to memory of 3312 224 cmd.exe attrib.exe PID 224 wrote to memory of 3312 224 cmd.exe attrib.exe PID 224 wrote to memory of 3312 224 cmd.exe attrib.exe PID 224 wrote to memory of 3252 224 cmd.exe timeout.exe PID 224 wrote to memory of 3252 224 cmd.exe timeout.exe PID 224 wrote to memory of 3252 224 cmd.exe timeout.exe PID 5084 wrote to memory of 2120 5084 miktotik.exe explorer.exe PID 5084 wrote to memory of 2120 5084 miktotik.exe explorer.exe PID 5084 wrote to memory of 2120 5084 miktotik.exe explorer.exe PID 2120 wrote to memory of 1632 2120 explorer.exe cmd.exe PID 2120 wrote to memory of 1632 2120 explorer.exe cmd.exe PID 2120 wrote to memory of 400 2120 explorer.exe timeout.exe PID 2120 wrote to memory of 400 2120 explorer.exe timeout.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3068 attrib.exe 3312 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\timeout.exetimeout 74⤵
- Delays execution with timeout.exe
PID:3388
-
-
C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar4⤵
- Executes dropped EXE
PID:1324
-
-
C:\Windows\SysWOW64\timeout.exetimeout 64⤵
- Delays execution with timeout.exe
PID:1128
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3068
-
-
C:\Windows\SysWOW64\timeout.exetimeout 16⤵
- Delays execution with timeout.exe
PID:3848
-
-
C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exemiktotik.exe /start6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exemiktotik.exe /start7⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe8⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 11209⤵
- Program crash
PID:1928
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Gozip.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Gozip.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"6⤵
- Views/modifies file attributes
PID:3312
-
-
C:\Windows\SysWOW64\timeout.exetimeout 46⤵
- Delays execution with timeout.exe
PID:3252
-
-
-
-
C:\Windows\SysWOW64\timeout.exetimeout 84⤵
- Delays execution with timeout.exe
PID:400
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2120 -ip 21201⤵PID:2260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD58f5293bc4ace65a9f51ba97bddcd7eee
SHA1e11a5055530092c3a805d757110c4f8761976eef
SHA256a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4
SHA512c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d
-
Filesize
551KB
MD5061f64173293969577916832be29b90d
SHA1b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA25634dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA51266e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da
-
Filesize
551KB
MD5061f64173293969577916832be29b90d
SHA1b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA25634dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA51266e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da
-
Filesize
373KB
MD5b1aa11c4722efbcaaf5ebf5f17880d17
SHA1b4b8578e13eb1a860524e827ac8bdd5d8ece604b
SHA2562e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27
SHA512a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5
-
Filesize
1KB
MD5bf223a7df3a7feecfcb49a5d01d781d9
SHA1d8b2b0f48887e63928576773efe1ab5776d7dfb0
SHA256494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e
SHA512e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2
-
Filesize
668B
MD5814380ebb377d7ebca662c6ac563eec0
SHA13487cf2382cd0bc87a677e637de1ae40ccfbc13b
SHA256b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136
SHA51241737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66
-
Filesize
947KB
MD56ed0cca96fe69be3b775499509f0b029
SHA1e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5
-
Filesize
947KB
MD56ed0cca96fe69be3b775499509f0b029
SHA1e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5
-
Filesize
947KB
MD56ed0cca96fe69be3b775499509f0b029
SHA1e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5
-
Filesize
85B
MD5bf045999e4ca77b57de18d5ff25e1272
SHA1e8dab3a106e479a53c4ea61443c2ff7873d17c67
SHA25689f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17
SHA512e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a