Analysis
-
max time kernel
63s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
c6e2fccd7ea71b3b5567de1b77eafb7aff20c2bea581619dae599dc9eebf06e7.dll
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
-
Target
c6e2fccd7ea71b3b5567de1b77eafb7aff20c2bea581619dae599dc9eebf06e7.dll
-
Size
120KB
-
MD5
5429eca8c68d697d8577c35d14ca3090
-
SHA1
54bb976eb4ab550fcb84e0a3ec3f80b5dce0775b
-
SHA256
c6e2fccd7ea71b3b5567de1b77eafb7aff20c2bea581619dae599dc9eebf06e7
-
SHA512
36fecad3320b7bff6af9a3dcbc7ab999067fd38726d1004d62449e61ad0e846c3259458a6bee092dcf0cf3a8368f61d90d4e2cdc2281f8494d5a6c317f1c24dd
-
SSDEEP
3072:G9I05pmuZhQieJNIi4gnn8sQVROd0dGNTd8:o5wuzQvIwn8DVROdY
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e56d6dd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56e7c5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e56e7c5.exe -
Executes dropped EXE 4 IoCs
pid Process 3256 e56d6dd.exe 2064 e56dd07.exe 1908 e56e796.exe 220 e56e7c5.exe -
resource yara_rule behavioral2/memory/3256-136-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3256-139-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3256-152-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3256-153-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/220-155-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/220-156-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e56e7c5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e56e7c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e56d6dd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e56d6dd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56e7c5.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: e56d6dd.exe File opened (read-only) \??\F: e56d6dd.exe File opened (read-only) \??\K: e56d6dd.exe File opened (read-only) \??\O: e56d6dd.exe File opened (read-only) \??\J: e56d6dd.exe File opened (read-only) \??\R: e56d6dd.exe File opened (read-only) \??\G: e56d6dd.exe File opened (read-only) \??\L: e56d6dd.exe File opened (read-only) \??\P: e56d6dd.exe File opened (read-only) \??\M: e56d6dd.exe File opened (read-only) \??\N: e56d6dd.exe File opened (read-only) \??\E: e56d6dd.exe File opened (read-only) \??\H: e56d6dd.exe File opened (read-only) \??\I: e56d6dd.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e56d8f0 e56d6dd.exe File opened for modification C:\Windows\SYSTEM.INI e56d6dd.exe File created C:\Windows\e572d1b e56e7c5.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3256 e56d6dd.exe 3256 e56d6dd.exe 3256 e56d6dd.exe 3256 e56d6dd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe Token: SeDebugPrivilege 3256 e56d6dd.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2948 2732 rundll32.exe 81 PID 2732 wrote to memory of 2948 2732 rundll32.exe 81 PID 2732 wrote to memory of 2948 2732 rundll32.exe 81 PID 2948 wrote to memory of 3256 2948 rundll32.exe 83 PID 2948 wrote to memory of 3256 2948 rundll32.exe 83 PID 2948 wrote to memory of 3256 2948 rundll32.exe 83 PID 3256 wrote to memory of 780 3256 e56d6dd.exe 8 PID 3256 wrote to memory of 788 3256 e56d6dd.exe 13 PID 3256 wrote to memory of 64 3256 e56d6dd.exe 9 PID 3256 wrote to memory of 2632 3256 e56d6dd.exe 21 PID 3256 wrote to memory of 2672 3256 e56d6dd.exe 64 PID 3256 wrote to memory of 2880 3256 e56d6dd.exe 63 PID 3256 wrote to memory of 776 3256 e56d6dd.exe 61 PID 3256 wrote to memory of 3088 3256 e56d6dd.exe 60 PID 3256 wrote to memory of 3288 3256 e56d6dd.exe 59 PID 3256 wrote to memory of 3420 3256 e56d6dd.exe 36 PID 3256 wrote to memory of 3508 3256 e56d6dd.exe 35 PID 3256 wrote to memory of 3604 3256 e56d6dd.exe 58 PID 3256 wrote to memory of 3796 3256 e56d6dd.exe 57 PID 3256 wrote to memory of 4764 3256 e56d6dd.exe 55 PID 3256 wrote to memory of 2444 3256 e56d6dd.exe 38 PID 3256 wrote to memory of 2732 3256 e56d6dd.exe 49 PID 3256 wrote to memory of 2948 3256 e56d6dd.exe 81 PID 3256 wrote to memory of 2948 3256 e56d6dd.exe 81 PID 3256 wrote to memory of 3948 3256 e56d6dd.exe 82 PID 2948 wrote to memory of 2064 2948 rundll32.exe 84 PID 2948 wrote to memory of 2064 2948 rundll32.exe 84 PID 2948 wrote to memory of 2064 2948 rundll32.exe 84 PID 2948 wrote to memory of 1908 2948 rundll32.exe 85 PID 2948 wrote to memory of 1908 2948 rundll32.exe 85 PID 2948 wrote to memory of 1908 2948 rundll32.exe 85 PID 2948 wrote to memory of 220 2948 rundll32.exe 86 PID 2948 wrote to memory of 220 2948 rundll32.exe 86 PID 2948 wrote to memory of 220 2948 rundll32.exe 86 PID 3256 wrote to memory of 780 3256 e56d6dd.exe 8 PID 3256 wrote to memory of 788 3256 e56d6dd.exe 13 PID 3256 wrote to memory of 64 3256 e56d6dd.exe 9 PID 3256 wrote to memory of 2632 3256 e56d6dd.exe 21 PID 3256 wrote to memory of 2672 3256 e56d6dd.exe 64 PID 3256 wrote to memory of 2880 3256 e56d6dd.exe 63 PID 3256 wrote to memory of 776 3256 e56d6dd.exe 61 PID 3256 wrote to memory of 3088 3256 e56d6dd.exe 60 PID 3256 wrote to memory of 3288 3256 e56d6dd.exe 59 PID 3256 wrote to memory of 3420 3256 e56d6dd.exe 36 PID 3256 wrote to memory of 3508 3256 e56d6dd.exe 35 PID 3256 wrote to memory of 3604 3256 e56d6dd.exe 58 PID 3256 wrote to memory of 3796 3256 e56d6dd.exe 57 PID 3256 wrote to memory of 4764 3256 e56d6dd.exe 55 PID 3256 wrote to memory of 3948 3256 e56d6dd.exe 82 PID 3256 wrote to memory of 2064 3256 e56d6dd.exe 84 PID 3256 wrote to memory of 2064 3256 e56d6dd.exe 84 PID 3256 wrote to memory of 1908 3256 e56d6dd.exe 85 PID 3256 wrote to memory of 1908 3256 e56d6dd.exe 85 PID 3256 wrote to memory of 220 3256 e56d6dd.exe 86 PID 3256 wrote to memory of 220 3256 e56d6dd.exe 86 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56d6dd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e56e7c5.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2632
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3508
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3420
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e2fccd7ea71b3b5567de1b77eafb7aff20c2bea581619dae599dc9eebf06e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6e2fccd7ea71b3b5567de1b77eafb7aff20c2bea581619dae599dc9eebf06e7.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\e56d6dd.exeC:\Users\Admin\AppData\Local\Temp\e56d6dd.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\e56dd07.exeC:\Users\Admin\AppData\Local\Temp\e56dd07.exe3⤵
- Executes dropped EXE
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\e56e796.exeC:\Users\Admin\AppData\Local\Temp\e56e796.exe3⤵
- Executes dropped EXE
PID:1908
-
-
C:\Users\Admin\AppData\Local\Temp\e56e7c5.exeC:\Users\Admin\AppData\Local\Temp\e56e7c5.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:220
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4764
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3796
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3088
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:776
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2672
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04
-
Filesize
97KB
MD504e152c474278eff62a61decac195526
SHA18a8cbab2a2b6c21aada04dd32507ab5b2d8892e3
SHA25649f23e72a5c02d79ac94c615b89624e26ce67fa72cda10a706379117a4103edc
SHA512563157ea23c643d63fa03a29b7fb40d3afb67ba312709551cb9c8720e49fd5dc3f93a75f0b74ff92ad4aef09439bf63bf93c7122f03d77d2b3f7824cb6c3cc04