Analysis
-
max time kernel
147s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2022 21:22
Behavioral task
behavioral1
Sample
e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe
Resource
win10v2004-20220812-en
General
-
Target
e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe
-
Size
666KB
-
MD5
6e1f9df1a8a359bc82f5288139ac8d70
-
SHA1
53fbdde8d2f45f0a09a269ba4fc1eb84c55343bf
-
SHA256
e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747
-
SHA512
72df4fce5b78409ec2762a3ee0002721693026f3285ab804b2dbc58d55c3cce40efbdff34c7cfe415e3715b12b8e9418d78d3af19f23381aa4d7a0e2480a9ab2
-
SSDEEP
12288:ZYW1LNT35lDbK/LIVaN8+T7vwqyqhYMhWt918vulASC9+m:dd35lDbKDIwWUDyqS5omHC9+
Malware Config
Extracted
C:\!-Recovery_Instructions-!.html
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral2/files/0x000c000000022e26-135.dat family_medusalocker behavioral2/files/0x000c000000022e26-136.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Executes dropped EXE 1 IoCs
pid Process 2816 svhost.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\PopSubmit.png => C:\Users\Admin\Pictures\PopSubmit.png.bulwark5 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File renamed C:\Users\Admin\Pictures\ResetStart.png => C:\Users\Admin\Pictures\ResetStart.png.bulwark5 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File renamed C:\Users\Admin\Pictures\SearchUndo.raw => C:\Users\Admin\Pictures\SearchUndo.raw.bulwark5 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File renamed C:\Users\Admin\Pictures\ConvertFromSync.raw => C:\Users\Admin\Pictures\ConvertFromSync.raw.bulwark5 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File renamed C:\Users\Admin\Pictures\ExitConnect.crw => C:\Users\Admin\Pictures\ExitConnect.crw.bulwark5 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2295526160-1155304984-640977766-1000\desktop.ini e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\W: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\Y: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\Z: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\N: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\O: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\R: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\T: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\P: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\E: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\K: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\L: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\M: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\U: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\X: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\A: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\B: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\G: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\J: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\S: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\F: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\H: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\I: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe File opened (read-only) \??\Q: e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2420 wmic.exe Token: SeSecurityPrivilege 2420 wmic.exe Token: SeTakeOwnershipPrivilege 2420 wmic.exe Token: SeLoadDriverPrivilege 2420 wmic.exe Token: SeSystemProfilePrivilege 2420 wmic.exe Token: SeSystemtimePrivilege 2420 wmic.exe Token: SeProfSingleProcessPrivilege 2420 wmic.exe Token: SeIncBasePriorityPrivilege 2420 wmic.exe Token: SeCreatePagefilePrivilege 2420 wmic.exe Token: SeBackupPrivilege 2420 wmic.exe Token: SeRestorePrivilege 2420 wmic.exe Token: SeShutdownPrivilege 2420 wmic.exe Token: SeDebugPrivilege 2420 wmic.exe Token: SeSystemEnvironmentPrivilege 2420 wmic.exe Token: SeRemoteShutdownPrivilege 2420 wmic.exe Token: SeUndockPrivilege 2420 wmic.exe Token: SeManageVolumePrivilege 2420 wmic.exe Token: 33 2420 wmic.exe Token: 34 2420 wmic.exe Token: 35 2420 wmic.exe Token: 36 2420 wmic.exe Token: SeIncreaseQuotaPrivilege 5076 wmic.exe Token: SeSecurityPrivilege 5076 wmic.exe Token: SeTakeOwnershipPrivilege 5076 wmic.exe Token: SeLoadDriverPrivilege 5076 wmic.exe Token: SeSystemProfilePrivilege 5076 wmic.exe Token: SeSystemtimePrivilege 5076 wmic.exe Token: SeProfSingleProcessPrivilege 5076 wmic.exe Token: SeIncBasePriorityPrivilege 5076 wmic.exe Token: SeCreatePagefilePrivilege 5076 wmic.exe Token: SeBackupPrivilege 5076 wmic.exe Token: SeRestorePrivilege 5076 wmic.exe Token: SeShutdownPrivilege 5076 wmic.exe Token: SeDebugPrivilege 5076 wmic.exe Token: SeSystemEnvironmentPrivilege 5076 wmic.exe Token: SeRemoteShutdownPrivilege 5076 wmic.exe Token: SeUndockPrivilege 5076 wmic.exe Token: SeManageVolumePrivilege 5076 wmic.exe Token: 33 5076 wmic.exe Token: 34 5076 wmic.exe Token: 35 5076 wmic.exe Token: 36 5076 wmic.exe Token: SeIncreaseQuotaPrivilege 3916 wmic.exe Token: SeSecurityPrivilege 3916 wmic.exe Token: SeTakeOwnershipPrivilege 3916 wmic.exe Token: SeLoadDriverPrivilege 3916 wmic.exe Token: SeSystemProfilePrivilege 3916 wmic.exe Token: SeSystemtimePrivilege 3916 wmic.exe Token: SeProfSingleProcessPrivilege 3916 wmic.exe Token: SeIncBasePriorityPrivilege 3916 wmic.exe Token: SeCreatePagefilePrivilege 3916 wmic.exe Token: SeBackupPrivilege 3916 wmic.exe Token: SeRestorePrivilege 3916 wmic.exe Token: SeShutdownPrivilege 3916 wmic.exe Token: SeDebugPrivilege 3916 wmic.exe Token: SeSystemEnvironmentPrivilege 3916 wmic.exe Token: SeRemoteShutdownPrivilege 3916 wmic.exe Token: SeUndockPrivilege 3916 wmic.exe Token: SeManageVolumePrivilege 3916 wmic.exe Token: 33 3916 wmic.exe Token: 34 3916 wmic.exe Token: 35 3916 wmic.exe Token: 36 3916 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4304 wrote to memory of 2420 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 84 PID 4304 wrote to memory of 2420 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 84 PID 4304 wrote to memory of 2420 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 84 PID 4304 wrote to memory of 5076 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 86 PID 4304 wrote to memory of 5076 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 86 PID 4304 wrote to memory of 5076 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 86 PID 4304 wrote to memory of 3916 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 88 PID 4304 wrote to memory of 3916 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 88 PID 4304 wrote to memory of 3916 4304 e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe 88 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe"C:\Users\Admin\AppData\Local\Temp\e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4304 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:2816
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
666KB
MD56e1f9df1a8a359bc82f5288139ac8d70
SHA153fbdde8d2f45f0a09a269ba4fc1eb84c55343bf
SHA256e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747
SHA51272df4fce5b78409ec2762a3ee0002721693026f3285ab804b2dbc58d55c3cce40efbdff34c7cfe415e3715b12b8e9418d78d3af19f23381aa4d7a0e2480a9ab2
-
Filesize
666KB
MD56e1f9df1a8a359bc82f5288139ac8d70
SHA153fbdde8d2f45f0a09a269ba4fc1eb84c55343bf
SHA256e5d819fd969d6bc913698c44beb5c8f763a6d6f07b7cdb3514c4b61a68a1d747
SHA51272df4fce5b78409ec2762a3ee0002721693026f3285ab804b2dbc58d55c3cce40efbdff34c7cfe415e3715b12b8e9418d78d3af19f23381aa4d7a0e2480a9ab2