Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 13:29
Behavioral task
behavioral1
Sample
52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe
Resource
win10v2004-20220812-en
General
-
Target
52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe
-
Size
667KB
-
MD5
a25be5a7a41f1c97f23a1d15baffd4f5
-
SHA1
22dd9031e1b38ff132760b7c867ee50be809d313
-
SHA256
52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
-
SHA512
37a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
SSDEEP
12288:DpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/W:FwAcu99lPzvxP+Bsz2XjWTRMQckkIXn
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\rundl32.exe" 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\rundl32.exe,C:\\Windows\\system32\\rundl32.exe" rundl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\rundl32.exe,C:\\Windows\\system32\\rundl32.exe,C:\\Windows\\system32\\rundl32.exe" rundl32.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 1760 rundl32.exe 828 rundl32.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Loads dropped DLL 4 IoCs
pid Process 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 1760 rundl32.exe 1760 rundl32.exe -
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\rundl32.exe" 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\rundl32.exe" rundl32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run rundl32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\rundl32.exe" rundl32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\ rundl32.exe File created C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe File opened for modification C:\Windows\SysWOW64\ rundl32.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe File opened for modification C:\Windows\SysWOW64\ 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe File created C:\Windows\SysWOW64\rundl32.exe 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe File opened for modification C:\Windows\SysWOW64\rundl32.exe rundl32.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 828 set thread context of 1708 828 rundl32.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundl32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundl32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier rundl32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier rundl32.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 688 ping.exe 1704 ping.exe 1424 ping.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1708 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeSecurityPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeTakeOwnershipPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeLoadDriverPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeSystemProfilePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeSystemtimePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeProfSingleProcessPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeIncBasePriorityPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeCreatePagefilePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeBackupPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeRestorePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeShutdownPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeDebugPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeSystemEnvironmentPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeChangeNotifyPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeRemoteShutdownPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeUndockPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeManageVolumePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeImpersonatePrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeCreateGlobalPrivilege 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: 33 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: 34 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: 35 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe Token: SeIncreaseQuotaPrivilege 1760 rundl32.exe Token: SeSecurityPrivilege 1760 rundl32.exe Token: SeTakeOwnershipPrivilege 1760 rundl32.exe Token: SeLoadDriverPrivilege 1760 rundl32.exe Token: SeSystemProfilePrivilege 1760 rundl32.exe Token: SeSystemtimePrivilege 1760 rundl32.exe Token: SeProfSingleProcessPrivilege 1760 rundl32.exe Token: SeIncBasePriorityPrivilege 1760 rundl32.exe Token: SeCreatePagefilePrivilege 1760 rundl32.exe Token: SeBackupPrivilege 1760 rundl32.exe Token: SeRestorePrivilege 1760 rundl32.exe Token: SeShutdownPrivilege 1760 rundl32.exe Token: SeDebugPrivilege 1760 rundl32.exe Token: SeSystemEnvironmentPrivilege 1760 rundl32.exe Token: SeChangeNotifyPrivilege 1760 rundl32.exe Token: SeRemoteShutdownPrivilege 1760 rundl32.exe Token: SeUndockPrivilege 1760 rundl32.exe Token: SeManageVolumePrivilege 1760 rundl32.exe Token: SeImpersonatePrivilege 1760 rundl32.exe Token: SeCreateGlobalPrivilege 1760 rundl32.exe Token: 33 1760 rundl32.exe Token: 34 1760 rundl32.exe Token: 35 1760 rundl32.exe Token: SeIncreaseQuotaPrivilege 828 rundl32.exe Token: SeSecurityPrivilege 828 rundl32.exe Token: SeTakeOwnershipPrivilege 828 rundl32.exe Token: SeLoadDriverPrivilege 828 rundl32.exe Token: SeSystemProfilePrivilege 828 rundl32.exe Token: SeSystemtimePrivilege 828 rundl32.exe Token: SeProfSingleProcessPrivilege 828 rundl32.exe Token: SeIncBasePriorityPrivilege 828 rundl32.exe Token: SeCreatePagefilePrivilege 828 rundl32.exe Token: SeBackupPrivilege 828 rundl32.exe Token: SeRestorePrivilege 828 rundl32.exe Token: SeShutdownPrivilege 828 rundl32.exe Token: SeDebugPrivilege 828 rundl32.exe Token: SeSystemEnvironmentPrivilege 828 rundl32.exe Token: SeChangeNotifyPrivilege 828 rundl32.exe Token: SeRemoteShutdownPrivilege 828 rundl32.exe Token: SeUndockPrivilege 828 rundl32.exe Token: SeManageVolumePrivilege 828 rundl32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1708 explorer.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1808 wrote to memory of 952 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 27 PID 1808 wrote to memory of 952 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 27 PID 1808 wrote to memory of 952 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 27 PID 1808 wrote to memory of 952 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 27 PID 1808 wrote to memory of 1760 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 28 PID 1808 wrote to memory of 1760 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 28 PID 1808 wrote to memory of 1760 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 28 PID 1808 wrote to memory of 1760 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 28 PID 1808 wrote to memory of 1424 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 29 PID 1808 wrote to memory of 1424 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 29 PID 1808 wrote to memory of 1424 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 29 PID 1808 wrote to memory of 1424 1808 52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe 29 PID 1760 wrote to memory of 1004 1760 rundl32.exe 31 PID 1760 wrote to memory of 1004 1760 rundl32.exe 31 PID 1760 wrote to memory of 1004 1760 rundl32.exe 31 PID 1760 wrote to memory of 1004 1760 rundl32.exe 31 PID 1760 wrote to memory of 828 1760 rundl32.exe 32 PID 1760 wrote to memory of 828 1760 rundl32.exe 32 PID 1760 wrote to memory of 828 1760 rundl32.exe 32 PID 1760 wrote to memory of 828 1760 rundl32.exe 32 PID 1760 wrote to memory of 688 1760 rundl32.exe 33 PID 1760 wrote to memory of 688 1760 rundl32.exe 33 PID 1760 wrote to memory of 688 1760 rundl32.exe 33 PID 1760 wrote to memory of 688 1760 rundl32.exe 33 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1708 828 rundl32.exe 35 PID 828 wrote to memory of 1704 828 rundl32.exe 37 PID 828 wrote to memory of 1704 828 rundl32.exe 37 PID 828 wrote to memory of 1704 828 rundl32.exe 37 PID 828 wrote to memory of 1704 828 rundl32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe"C:\Users\Admin\AppData\Local\Temp\52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵PID:952
-
-
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\system32\rundl32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:1004
-
-
C:\Windows\SysWOW64\rundl32.exe"C:\Windows\system32\rundl32.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵
- Windows security bypass
- Checks BIOS information in registry
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Windows\SysWOW64\ping.exeping 127.0.0.1 -n 5 > NUL del "C:\Windows\SysWOW64\rundl32.exe"4⤵
- Runs ping.exe
PID:1704
-
-
-
C:\Windows\SysWOW64\ping.exeping 127.0.0.1 -n 5 > NUL del "C:\Windows\SysWOW64\rundl32.exe"3⤵
- Runs ping.exe
PID:688
-
-
-
C:\Windows\SysWOW64\ping.exeping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\52184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108.exe"2⤵
- Runs ping.exe
PID:1424
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b
-
Filesize
667KB
MD5a25be5a7a41f1c97f23a1d15baffd4f5
SHA122dd9031e1b38ff132760b7c867ee50be809d313
SHA25652184e448e67a013b0acd018065b06cd24fdc3055584f1d4b3d299a9d06e7108
SHA51237a95dcdb9957c92c95f99f8687673f47ac4c0ed4c9d2a51b37451368869c57730a239c3ec4c0e94d37a6c216ebbd43966603f28028550edb629884b56bae48b