Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
General
-
Target
57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe
-
Size
886KB
-
MD5
078e2046ac7838975476a91321c13e00
-
SHA1
97fb58c2870d2b50e1cf010bda810b51ccf58ff4
-
SHA256
57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573
-
SHA512
27509d4270d48134ba4bd170590deea9bd15f47025544971a5fc82ff692ec73b7e7556b51069b04f62b2d42837a8ce67524b4db5a8cc8787ac1c09df45f16ff6
-
SSDEEP
24576:JdKhrfuPmUghtFKviSKCe3UFvciuRWJc:JwUKKqXUKv
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
Executes dropped EXE 1 IoCs
pid Process 1396 sgh.exe -
resource yara_rule behavioral2/memory/4656-136-0x0000000002330000-0x00000000033BE000-memory.dmp upx behavioral2/memory/4656-141-0x0000000002330000-0x00000000033BE000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\602game\sgh\sgh.exe 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe File created C:\Program Files (x86)\602game\sgh\static.ini 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe File opened for modification C:\Program Files (x86)\602game\sgh\static.ini 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe File opened for modification C:\Program Files (x86)\602game\sgh\static.ini sgh.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe Token: SeDebugPrivilege 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1396 sgh.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1396 sgh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1396 sgh.exe 1396 sgh.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4656 wrote to memory of 776 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 4 PID 4656 wrote to memory of 784 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 13 PID 4656 wrote to memory of 1020 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 10 PID 4656 wrote to memory of 2312 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 58 PID 4656 wrote to memory of 2340 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 57 PID 4656 wrote to memory of 2396 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 56 PID 4656 wrote to memory of 3068 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 46 PID 4656 wrote to memory of 2632 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 45 PID 4656 wrote to memory of 3236 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 44 PID 4656 wrote to memory of 3328 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 43 PID 4656 wrote to memory of 3408 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 42 PID 4656 wrote to memory of 3496 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 41 PID 4656 wrote to memory of 3648 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 40 PID 4656 wrote to memory of 4716 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 37 PID 4656 wrote to memory of 1984 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 21 PID 4656 wrote to memory of 1396 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 83 PID 4656 wrote to memory of 1396 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 83 PID 4656 wrote to memory of 1396 4656 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe 83 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1984
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4716
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3648
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3496
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3408
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3328
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:2632
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe"C:\Users\Admin\AppData\Local\Temp\57a68f016854455c96c7d8dffda101920cf5435dc2eacf30bba395776c8c1573.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4656 -
C:\Program Files (x86)\602game\sgh\sgh.exe"C:\Program Files (x86)\602game\sgh\sgh.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2340
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2312
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1023KB
MD55dcb7c023166f4c5c7dafc644dd2b31e
SHA129f33244534b573d71f42c17643dde5a06147708
SHA256a17baaa2a19f2bcf81e9d83c747d4c1fe77282b6514205fc92c1e01b3016de8c
SHA5124e6a3cf27d2dcebd1c64e01913dac55a3e3df69726f07ba449dfc92cb189f6021daa8801a6e1e29c2f8b37aaf250d684f2b9013180669526e64dfc2309f5b5d5
-
Filesize
1023KB
MD55dcb7c023166f4c5c7dafc644dd2b31e
SHA129f33244534b573d71f42c17643dde5a06147708
SHA256a17baaa2a19f2bcf81e9d83c747d4c1fe77282b6514205fc92c1e01b3016de8c
SHA5124e6a3cf27d2dcebd1c64e01913dac55a3e3df69726f07ba449dfc92cb189f6021daa8801a6e1e29c2f8b37aaf250d684f2b9013180669526e64dfc2309f5b5d5
-
Filesize
124B
MD5cf38f2648bdccf4431928075984ae9bc
SHA163b76c9aaa0412762fc89837ecc1cbb50350c3e2
SHA25670170aea4e2e869eb8a6371a71ef23a41a3adba916cd3e5cb1320e390fef1afb
SHA51242168d298b12bdc010e527af33b0844e410c839d353f2c1a1d64a153fd83a6e8904cedbe3c8d64e18d96004c7b6a9ec743ed06832c2a6bfe1fb0db499d534328
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7