Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe
Resource
win7-20220715-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe
-
Size
328KB
-
MD5
5af091523bc0899413a7b601ee2b2abb
-
SHA1
ea2ee777b59f0bc17dfd319ce609616cb47ddd01
-
SHA256
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7
-
SHA512
d37ec05ca494493c78b7a28174f0ac541b4bc69d54a330a36828be69f773b4cdf1bc70935c2e7399999efd096cb283768d8e7c44b550003bc4603d02e16fde64
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-3463845317-933582289-45817732-1000\Recovery+anjxf.txt
Family
teslacrypt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-4096.
More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-4096 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8ADE6B6020FF59F0
2. http://kkd47eh4hdjshb5t.angortra.at/8ADE6B6020FF59F0
3. http://ytrest84y5i456hghadefdsd.pontogrot.com/8ADE6B6020FF59F0
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser
3. Type in the address bar: xlowfznrg4wf7dli.onion/8ADE6B6020FF59F0
4. Follow the instructions on the site.
---------------- IMPORTANT INFORMATION------------------------
*-*-* Your personal pages:
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8ADE6B6020FF59F0
http://kkd47eh4hdjshb5t.angortra.at/8ADE6B6020FF59F0
http://ytrest84y5i456hghadefdsd.pontogrot.com/8ADE6B6020FF59F0
*-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/8ADE6B6020FF59F0
URLs
http://tt54rfdjhb34rfbnknaerg.milerteddy.com/8ADE6B6020FF59F0
http://kkd47eh4hdjshb5t.angortra.at/8ADE6B6020FF59F0
http://ytrest84y5i456hghadefdsd.pontogrot.com/8ADE6B6020FF59F0
http://xlowfznrg4wf7dli.ONION/8ADE6B6020FF59F0
Signatures
-
TeslaCrypt, AlphaCrypt
Ransomware based on CryptoLocker. Shut down by the developers in 2016.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
ywcwdlvmcpex.exepid Process 1212 ywcwdlvmcpex.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ywcwdlvmcpex.exe59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation ywcwdlvmcpex.exe Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ywcwdlvmcpex.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Windows\CurrentVersion\Run ywcwdlvmcpex.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\foedopwpahch = "C:\\Windows\\system32\\cmd.exe /c start \"\" \"C:\\Windows\\ywcwdlvmcpex.exe\"" ywcwdlvmcpex.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ywcwdlvmcpex.exedescription ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\applet\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] ywcwdlvmcpex.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\ERRORREP\QHEADLES\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\az\LC_MESSAGES\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Internet Explorer\en-US\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cy\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Recovery+anjxf.html ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\PCHEALTH\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\Recovery+anjxf.txt ywcwdlvmcpex.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\Recovery+anjxf.png ywcwdlvmcpex.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\el\Recovery+anjxf.html ywcwdlvmcpex.exe -
Drops file in Windows directory 2 IoCs
Processes:
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exedescription ioc Process File opened for modification C:\Windows\ywcwdlvmcpex.exe 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe File created C:\Windows\ywcwdlvmcpex.exe 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ywcwdlvmcpex.exepid Process 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe 1212 ywcwdlvmcpex.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exeywcwdlvmcpex.exeWMIC.exedescription pid Process Token: SeDebugPrivilege 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe Token: SeDebugPrivilege 1212 ywcwdlvmcpex.exe Token: SeIncreaseQuotaPrivilege 4880 WMIC.exe Token: SeSecurityPrivilege 4880 WMIC.exe Token: SeTakeOwnershipPrivilege 4880 WMIC.exe Token: SeLoadDriverPrivilege 4880 WMIC.exe Token: SeSystemProfilePrivilege 4880 WMIC.exe Token: SeSystemtimePrivilege 4880 WMIC.exe Token: SeProfSingleProcessPrivilege 4880 WMIC.exe Token: SeIncBasePriorityPrivilege 4880 WMIC.exe Token: SeCreatePagefilePrivilege 4880 WMIC.exe Token: SeBackupPrivilege 4880 WMIC.exe Token: SeRestorePrivilege 4880 WMIC.exe Token: SeShutdownPrivilege 4880 WMIC.exe Token: SeDebugPrivilege 4880 WMIC.exe Token: SeSystemEnvironmentPrivilege 4880 WMIC.exe Token: SeRemoteShutdownPrivilege 4880 WMIC.exe Token: SeUndockPrivilege 4880 WMIC.exe Token: SeManageVolumePrivilege 4880 WMIC.exe Token: 33 4880 WMIC.exe Token: 34 4880 WMIC.exe Token: 35 4880 WMIC.exe Token: 36 4880 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exeywcwdlvmcpex.exedescription pid Process procid_target PID 2308 wrote to memory of 1212 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 78 PID 2308 wrote to memory of 1212 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 78 PID 2308 wrote to memory of 1212 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 78 PID 2308 wrote to memory of 4900 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 79 PID 2308 wrote to memory of 4900 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 79 PID 2308 wrote to memory of 4900 2308 59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe 79 PID 1212 wrote to memory of 4880 1212 ywcwdlvmcpex.exe 80 PID 1212 wrote to memory of 4880 1212 ywcwdlvmcpex.exe 80 -
System policy modification 1 TTPs 2 IoCs
Processes:
ywcwdlvmcpex.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ywcwdlvmcpex.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" ywcwdlvmcpex.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe"C:\Users\Admin\AppData\Local\Temp\59f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\ywcwdlvmcpex.exeC:\Windows\ywcwdlvmcpex.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1212 -
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\59F3D2~1.EXE2⤵PID:4900
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD55af091523bc0899413a7b601ee2b2abb
SHA1ea2ee777b59f0bc17dfd319ce609616cb47ddd01
SHA25659f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7
SHA512d37ec05ca494493c78b7a28174f0ac541b4bc69d54a330a36828be69f773b4cdf1bc70935c2e7399999efd096cb283768d8e7c44b550003bc4603d02e16fde64
-
Filesize
328KB
MD55af091523bc0899413a7b601ee2b2abb
SHA1ea2ee777b59f0bc17dfd319ce609616cb47ddd01
SHA25659f3d25993b1678406b72625c721ace54355ecf73181cd7a69a5f255141ef1e7
SHA512d37ec05ca494493c78b7a28174f0ac541b4bc69d54a330a36828be69f773b4cdf1bc70935c2e7399999efd096cb283768d8e7c44b550003bc4603d02e16fde64