Analysis
-
max time kernel
175s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe
-
Size
208KB
-
MD5
0552a25f3ed1bf72603b39281ba0db7b
-
SHA1
6957b27c04ab682677305cfd0efc5ce0f12e8ddf
-
SHA256
e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34
-
SHA512
75f868a050db411c4491fa5baf454c7c4ffbac08db0e2b71910114b9ffeba775dbf22bd7344e9baa1d171d3479da1192b7633da1f163cb7666777da972345812
-
SSDEEP
3072:MXgL+OnCA2JLxEAWLR0lGacNcP7hUPT0w8n0Eb1OSoefWlIv:QgC2A/6tdNixnDJoeU
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1524 chrome.exe 2036 chrome.exe -
resource yara_rule behavioral1/memory/1788-59-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-61-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-62-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-65-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-66-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-69-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1788-96-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2036-99-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2036-101-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome.exe = "C:\\Users\\Admin\\AppData\\Roaming\\temp\\chrome.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1428 set thread context of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1524 set thread context of 2036 1524 chrome.exe 33 PID 1524 set thread context of 796 1524 chrome.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376634990" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{299B45D1-7133-11ED-B68C-6A6CB2F85B9F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe Token: SeShutdownPrivilege 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe Token: SeShutdownPrivilege 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe Token: SeShutdownPrivilege 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe Token: SeShutdownPrivilege 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeShutdownPrivilege 1524 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe Token: SeDebugPrivilege 2036 chrome.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 796 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 1524 chrome.exe 2036 chrome.exe 796 iexplore.exe 796 iexplore.exe 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1428 wrote to memory of 1788 1428 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 28 PID 1788 wrote to memory of 1304 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 29 PID 1788 wrote to memory of 1304 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 29 PID 1788 wrote to memory of 1304 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 29 PID 1788 wrote to memory of 1304 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 29 PID 1304 wrote to memory of 1836 1304 cmd.exe 31 PID 1304 wrote to memory of 1836 1304 cmd.exe 31 PID 1304 wrote to memory of 1836 1304 cmd.exe 31 PID 1304 wrote to memory of 1836 1304 cmd.exe 31 PID 1788 wrote to memory of 1524 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 32 PID 1788 wrote to memory of 1524 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 32 PID 1788 wrote to memory of 1524 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 32 PID 1788 wrote to memory of 1524 1788 e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe 32 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 2036 1524 chrome.exe 33 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 1524 wrote to memory of 796 1524 chrome.exe 34 PID 796 wrote to memory of 1668 796 iexplore.exe 36 PID 796 wrote to memory of 1668 796 iexplore.exe 36 PID 796 wrote to memory of 1668 796 iexplore.exe 36 PID 796 wrote to memory of 1668 796 iexplore.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe"C:\Users\Admin\AppData\Local\Temp\e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe"C:\Users\Admin\AppData\Local\Temp\e5cfeaff2bc96b326dbfb3dc96de5a6d45f61bb17eb74b70a9b75c209f30cd34.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BGVWT.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "chrome.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\temp\chrome.exe" /f4⤵
- Adds Run key to start application
PID:1836
-
-
-
C:\Users\Admin\AppData\Roaming\temp\chrome.exe"C:\Users\Admin\AppData\Roaming\temp\chrome.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Roaming\temp\chrome.exe"C:\Users\Admin\AppData\Roaming\temp\chrome.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5809151c6427bb50acddfd3ab4ef9514b
SHA1d8786a949c372f73750463aab728dd3cf5306813
SHA25602432a4daa99ee328c69a509aaa5cc87a7eb1faa6f465361720dccd33e8e8e86
SHA5121eb057896dee7d2beb3e70040f011a12f63e9036e388f168bf9d573620bdb1e6977e7749f1645ed58a0896ed50769dbd0785e21c358ecd16f0c3cab856356ead
-
Filesize
535B
MD573db31229ae3bc8b99f0dca95c089292
SHA170100db6b4833e362afc09fd32581cb63e583e3a
SHA2566edd8863f28ba803c0d77858b89ee939b3db9ef0f7e094a81ea639c0e492b5a2
SHA5125ee6601eb9f3607ca85261bb8b65496ae4d975ea454a3989ebba624a471f129c8e2d3d289ceb3d0b7bea9ceece4c7b616345e2de52c83679ed3617c6a61eb4ad
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631
-
Filesize
208KB
MD55a144bb48489a910b6030629c4c5dcc4
SHA1d27bb86b588e4b8b3a9f8c434464c06596198b3c
SHA256cbe87c6f9010c5dff788a5db5d193c3c0def224c6b2869968734680e72dcc5ef
SHA512fd2c24624c58aa16a6ed3cfe9fef17ec5c3196b3e6947b7aace9e902dc18d9da85dab7098b4428ed453fdaa6b177caa80dafe44961b3d195283bb748d764d631