Analysis
-
max time kernel
188s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:27
Static task
static1
Behavioral task
behavioral1
Sample
2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe
-
Size
37KB
-
MD5
367d9da92d685619c8dab33498e818d0
-
SHA1
260319b28b47b503096253bc1fe28f30390e4959
-
SHA256
2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef
-
SHA512
e2984ee04e6dd54e12e5b0bdf6de59a1cdfb98095f74970c8bb705956cdfc006efc0083583be22cacb2b54038caca1eeca8a7e4ca9e290170a1589e7d50d1746
-
SSDEEP
768:ZRvO5RroZJ76739sBWss91UVafFjOZB07DuzmF:ZRve+Zk78sfU4fFKOPP
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3764 Logo1_.exe 4940 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe -
resource yara_rule behavioral2/files/0x0007000000022e01-147.dat upx behavioral2/files/0x0007000000022e01-149.dat upx behavioral2/memory/4940-150-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\D: 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini Logo1_.exe File created C:\Program Files\Internet Explorer\de-DE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Internet Explorer\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk16\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\_desktop.ini Logo1_.exe File created C:\Program Files\7-Zip\Lang\_desktop.ini Logo1_.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\deployed\jdk15\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe File created C:\Windows\Logo1_.exe 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe 3764 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4380 wrote to memory of 1408 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 82 PID 4380 wrote to memory of 1408 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 82 PID 4380 wrote to memory of 1408 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 82 PID 1408 wrote to memory of 3336 1408 net.exe 84 PID 1408 wrote to memory of 3336 1408 net.exe 84 PID 1408 wrote to memory of 3336 1408 net.exe 84 PID 4380 wrote to memory of 3492 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 85 PID 4380 wrote to memory of 3492 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 85 PID 4380 wrote to memory of 3492 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 85 PID 4380 wrote to memory of 3764 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 86 PID 4380 wrote to memory of 3764 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 86 PID 4380 wrote to memory of 3764 4380 2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe 86 PID 3764 wrote to memory of 3848 3764 Logo1_.exe 87 PID 3764 wrote to memory of 3848 3764 Logo1_.exe 87 PID 3764 wrote to memory of 3848 3764 Logo1_.exe 87 PID 3848 wrote to memory of 4440 3848 net.exe 89 PID 3848 wrote to memory of 4440 3848 net.exe 89 PID 3848 wrote to memory of 4440 3848 net.exe 89 PID 3764 wrote to memory of 4856 3764 Logo1_.exe 90 PID 3764 wrote to memory of 4856 3764 Logo1_.exe 90 PID 3764 wrote to memory of 4856 3764 Logo1_.exe 90 PID 4856 wrote to memory of 3244 4856 net.exe 92 PID 4856 wrote to memory of 3244 4856 net.exe 92 PID 4856 wrote to memory of 3244 4856 net.exe 92 PID 3764 wrote to memory of 1192 3764 Logo1_.exe 42 PID 3764 wrote to memory of 1192 3764 Logo1_.exe 42 PID 3492 wrote to memory of 4940 3492 cmd.exe 94 PID 3492 wrote to memory of 4940 3492 cmd.exe 94 PID 3492 wrote to memory of 4940 3492 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe"C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵PID:3336
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2328.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe"C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
PID:4940
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:4440
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3244
-
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD5847aaed06b79067763f43fb686f871a3
SHA1df0b3cfaebab72ee7f96203ffaf77a5c94da5643
SHA25676e1aca70d3b572aac23be39d6fc4803a09b46ac7663da215435272d55ac4fc3
SHA512f23fb4497cd53918a79d593cb22106fe1cf1755ea6eb07b9045c8024338cfa18a4d8b895b6475034d1c5b53d942adf5d8165a1d07d74c2034780ab12c58df79c
-
C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe
Filesize4KB
MD5fa69a3308bf38c401192d49b6b5b7e7b
SHA1b32a96e8c4a96e54204b23132802da9e78ad0730
SHA256d2a72284bf9f7ff753237ca3df45e3e9f5aca0cc7b2197aa53a04ad34043c9fe
SHA5129d1777560614a5985acce30e07109294ce1fa68f27453f33ddef3426554c7c16f058196c18d92182e356da9f11f53a16f6c55d27cbf6a403d4b30d4d55b2553c
-
C:\Users\Admin\AppData\Local\Temp\2a5dabecb376c3f12a92bd08607acb9816143f321c628b92045d4ce38decb1ef.exe.exe
Filesize4KB
MD5fa69a3308bf38c401192d49b6b5b7e7b
SHA1b32a96e8c4a96e54204b23132802da9e78ad0730
SHA256d2a72284bf9f7ff753237ca3df45e3e9f5aca0cc7b2197aa53a04ad34043c9fe
SHA5129d1777560614a5985acce30e07109294ce1fa68f27453f33ddef3426554c7c16f058196c18d92182e356da9f11f53a16f6c55d27cbf6a403d4b30d4d55b2553c
-
Filesize
33KB
MD53147f795294440b14fe752a4144d3f60
SHA186413216fdfcd087eae9af9f53a49490a75e3db9
SHA2560842e60ab03a2a8cda832c26a9c76faca35451517e2a54c5faeb00db5e3cb35d
SHA5122b81be708d3e6121f36de1d2067d43d63da63d0869001a3d5555f5fdd0894756b7ea2a2bae0f29beb978944eafdce567b2e634bf26e0d98059a23649f5d574fa
-
Filesize
33KB
MD53147f795294440b14fe752a4144d3f60
SHA186413216fdfcd087eae9af9f53a49490a75e3db9
SHA2560842e60ab03a2a8cda832c26a9c76faca35451517e2a54c5faeb00db5e3cb35d
SHA5122b81be708d3e6121f36de1d2067d43d63da63d0869001a3d5555f5fdd0894756b7ea2a2bae0f29beb978944eafdce567b2e634bf26e0d98059a23649f5d574fa
-
Filesize
33KB
MD53147f795294440b14fe752a4144d3f60
SHA186413216fdfcd087eae9af9f53a49490a75e3db9
SHA2560842e60ab03a2a8cda832c26a9c76faca35451517e2a54c5faeb00db5e3cb35d
SHA5122b81be708d3e6121f36de1d2067d43d63da63d0869001a3d5555f5fdd0894756b7ea2a2bae0f29beb978944eafdce567b2e634bf26e0d98059a23649f5d574fa