Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 10:40
Behavioral task
behavioral1
Sample
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
Resource
win7-20220901-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
-
Size
31KB
-
MD5
67fdcca3fe09b1661a34041301bc9df3
-
SHA1
adb88da8da8ad0fba805eaad75a3669eba7dbb15
-
SHA256
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
-
SHA512
37bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
SSDEEP
768:8yw8PGQtd9Uq24SW6T6etI0L09KwE3/tu/IRXN7+qqAA0q:s81dUwS3DyA08EW1+qFnq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Common Files\\System\\lsasss.exe,C:\\Program Files\\Common Files\\System\\msadc\\system32.exe" 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" lsasss.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\SECdrv2.EXT 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Executes dropped EXE 1 IoCs
pid Process 1544 lsasss.exe -
resource yara_rule behavioral1/memory/1484-55-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00090000000126f1-56.dat upx behavioral1/files/0x00090000000126f1-57.dat upx behavioral1/memory/1484-60-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00090000000126f1-59.dat upx behavioral1/memory/1544-66-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1544-70-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1544 lsasss.exe -
Loads dropped DLL 4 IoCs
pid Process 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1544 lsasss.exe 1544 lsasss.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\vsdertl32.DIG 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\WINDOWS\SysWOW64\vsdertl32.dig lsasss.exe File created C:\Windows\SysWOW64\logo.gif lsasss.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\server32.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\Smars.sys 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\Smars.SYS 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File created C:\Program Files\Common Files\System\lsasss.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\lsasss.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File created C:\Program Files\Common Files\System\server32.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\inf\icuc32.dll lsasss.exe File created \??\c:\windows\inf\icucd32.dll lsasss.exe File opened for modification \??\c:\windows\inf\icucd32.dll lsasss.exe File created \??\c:\windows\inf\icuc32.dll lsasss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1544 lsasss.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe Token: SeDebugPrivilege 1544 lsasss.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 1544 lsasss.exe 1544 lsasss.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1544 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 27 PID 1484 wrote to memory of 1544 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 27 PID 1484 wrote to memory of 1544 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 27 PID 1484 wrote to memory of 1544 1484 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 27 PID 1544 wrote to memory of 1136 1544 lsasss.exe 28 PID 1544 wrote to memory of 1136 1544 lsasss.exe 28 PID 1544 wrote to memory of 1136 1544 lsasss.exe 28 PID 1544 wrote to memory of 1136 1544 lsasss.exe 28 PID 1544 wrote to memory of 288 1544 lsasss.exe 30 PID 1544 wrote to memory of 288 1544 lsasss.exe 30 PID 1544 wrote to memory of 288 1544 lsasss.exe 30 PID 1544 wrote to memory of 288 1544 lsasss.exe 30 PID 1136 wrote to memory of 1356 1136 net.exe 32 PID 1136 wrote to memory of 1356 1136 net.exe 32 PID 1136 wrote to memory of 1356 1136 net.exe 32 PID 1136 wrote to memory of 1356 1136 net.exe 32 PID 288 wrote to memory of 1032 288 net.exe 33 PID 288 wrote to memory of 1032 288 net.exe 33 PID 288 wrote to memory of 1032 288 net.exe 33 PID 288 wrote to memory of 1032 288 net.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe"C:\Users\Admin\AppData\Local\Temp\1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files\Common Files\System\lsasss.exe"C:\Program Files\Common Files\System\lsasss.exe"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:1356
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:1032
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD567fdcca3fe09b1661a34041301bc9df3
SHA1adb88da8da8ad0fba805eaad75a3669eba7dbb15
SHA2561c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
SHA51237bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
Filesize
102B
MD576fcf78881b0aee32e0c654a5be61964
SHA14525d3716fd7951d80f4963ee6fc94f486d7467c
SHA256a38b65dec45e19d6f7a168af9deb62f4d21c73d2ac9c3145fd0f5d11ad921ba2
SHA5121a78371768f247e37e5fbcb33a992d040ead67cede947bf314a72bac2c3211480109c51da0fcd0941f18ccad087836e7721a56cd5e975039dd649482f71cb8a5
-
Filesize
31KB
MD567fdcca3fe09b1661a34041301bc9df3
SHA1adb88da8da8ad0fba805eaad75a3669eba7dbb15
SHA2561c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
SHA51237bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
Filesize
31KB
MD567fdcca3fe09b1661a34041301bc9df3
SHA1adb88da8da8ad0fba805eaad75a3669eba7dbb15
SHA2561c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
SHA51237bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
Filesize
52KB
MD507aa7eb8ebe704cfede4fc28d175f60e
SHA1a6561c68ce10e942fadaa413d20a85f9d1674f54
SHA25638ecacce7c620951ebee92ab7355f6f2d9e61dc73dde19dccac8209c33cb0e60
SHA51256450428cc4e9e7db82d7d2d90945ab1872f63ced9d82fc65e833fd424ca143e0b2d111aa9ee8cd91553cfb2b23c055dce01d69f0f3e1baec76c60f335a36a33
-
Filesize
28KB
MD5e5c38f0505822aca902a38007fd5399e
SHA15abfb8ee3a01e357489b01ce8f82e88a45cee83c
SHA256968bab3cb2c284ff56cb51aadc14f588dc435a188080b7c4486ad9de7b5637fa
SHA512674e24d567bd2bdd51395c3bd8db33c90a3e452e132b9fc9d6010ac37140af831c2b8448b7cb7a548cb1a1e6573c8f30ee0282e801795e2626e5b7747d2235d3