Analysis
-
max time kernel
176s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 20:17
Behavioral task
behavioral1
Sample
fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe
-
Size
114KB
-
MD5
28c9e6411eb87ddd16f683076b586c40
-
SHA1
24dfdefc5f7b07cc78a1dd3ade37f9b4d8b1f2d7
-
SHA256
fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490
-
SHA512
93925dfed1f7801a5e546ad2cedb2f1e9f988701a2de05cfd1ccddcc1a171d21952ca7b921534596478a98ae1ebaec1b9ba2485487f18a830692b25cecf035f2
-
SSDEEP
3072:nKllQobyP8ebgcffWqPL1/7w6ZAs+VBK:nKllrbBzm7QV
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 224 Logo1_.exe 2772 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe -
resource yara_rule behavioral2/memory/3292-132-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/files/0x000a000000022e12-137.dat upx behavioral2/files/0x000a000000022e12-138.dat upx behavioral2/memory/3292-139-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/224-146-0x0000000000400000-0x0000000000431000-memory.dmp upx behavioral2/memory/224-149-0x0000000000400000-0x0000000000431000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\F: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office15\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\am\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\browser\features\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\loc\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\MSBuild\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\en-US\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe Logo1_.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Configuration\Registration\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\command\rundl132.exe fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe File created C:\Windows\Logo1_.exe fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe File created C:\Windows\command\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe 224 Logo1_.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1536 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 82 PID 3292 wrote to memory of 1536 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 82 PID 3292 wrote to memory of 1536 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 82 PID 1536 wrote to memory of 444 1536 net.exe 84 PID 1536 wrote to memory of 444 1536 net.exe 84 PID 1536 wrote to memory of 444 1536 net.exe 84 PID 3292 wrote to memory of 2224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 85 PID 3292 wrote to memory of 2224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 85 PID 3292 wrote to memory of 2224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 85 PID 3292 wrote to memory of 224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 87 PID 3292 wrote to memory of 224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 87 PID 3292 wrote to memory of 224 3292 fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe 87 PID 224 wrote to memory of 3988 224 Logo1_.exe 88 PID 224 wrote to memory of 3988 224 Logo1_.exe 88 PID 224 wrote to memory of 3988 224 Logo1_.exe 88 PID 2224 wrote to memory of 2772 2224 cmd.exe 90 PID 2224 wrote to memory of 2772 2224 cmd.exe 90 PID 2224 wrote to memory of 2772 2224 cmd.exe 90 PID 3988 wrote to memory of 3748 3988 net.exe 91 PID 3988 wrote to memory of 3748 3988 net.exe 91 PID 3988 wrote to memory of 3748 3988 net.exe 91 PID 224 wrote to memory of 4848 224 Logo1_.exe 92 PID 224 wrote to memory of 4848 224 Logo1_.exe 92 PID 224 wrote to memory of 4848 224 Logo1_.exe 92 PID 4848 wrote to memory of 3404 4848 net.exe 94 PID 4848 wrote to memory of 3404 4848 net.exe 94 PID 4848 wrote to memory of 3404 4848 net.exe 94 PID 224 wrote to memory of 1108 224 Logo1_.exe 68 PID 224 wrote to memory of 1108 224 Logo1_.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe"C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2441.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe"C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe"4⤵
- Executes dropped EXE
PID:2772
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3748
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:3404
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722B
MD563fda75483cc61b5b0b555dd12f7350c
SHA11767a6e05d6e097779746a2b512bb955fc7acc9c
SHA256b9d14ca1bfe349f7c1fa710ee6a1e47ce3db4154ad33418aa4d0a0e7b59736dc
SHA5129276a7c3dd45a469446260408bb942452356d11845bf7f418549712f3d76e1d69e90ecfe5d642dbbfa7d8922b2fb21cf6b693af5e2ba6923dd5b5c58107df5c4
-
C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe
Filesize76KB
MD5f8a069e7d2bb8868cea4def627cde6e9
SHA125f64b33dd8d98766e12272aab10f6c44cd00d0f
SHA2565af3085b3970bb90679b1afd187b10b98ae4551d7962448b79b2f2def151f3eb
SHA51267ebcd7bd7f2fa224f82762e80f21d27b41a217f07572b278261a2163d55b5e22f1f47522670e3ef570dd4e70a8fc70a84eb3a8e4a3087f34fa6e2cec6ef2985
-
C:\Users\Admin\AppData\Local\Temp\fafd817fab4bb6f570667c14f5eb20555887d94ebddf4e7e5a3431f5ffde1490.exe.exe
Filesize76KB
MD5f8a069e7d2bb8868cea4def627cde6e9
SHA125f64b33dd8d98766e12272aab10f6c44cd00d0f
SHA2565af3085b3970bb90679b1afd187b10b98ae4551d7962448b79b2f2def151f3eb
SHA51267ebcd7bd7f2fa224f82762e80f21d27b41a217f07572b278261a2163d55b5e22f1f47522670e3ef570dd4e70a8fc70a84eb3a8e4a3087f34fa6e2cec6ef2985
-
Filesize
38KB
MD5db7f97e061fda5b5ca7a176fa6dc44ea
SHA154c4ad0fef6e66887f538b352293f92cc612fd81
SHA256a919e2e5a25a269e84e0e30daf919db1804720926a8ab5b59e78fdc8cad14817
SHA512a1deb06d493eb1a8ee9c8959560d606fa686c48c460357ee2c7bdeee0542132515d269bb3d5c91dd09496042676100428f3fbc5c1dceb8e5c7a661bd77d4cc22
-
Filesize
38KB
MD5db7f97e061fda5b5ca7a176fa6dc44ea
SHA154c4ad0fef6e66887f538b352293f92cc612fd81
SHA256a919e2e5a25a269e84e0e30daf919db1804720926a8ab5b59e78fdc8cad14817
SHA512a1deb06d493eb1a8ee9c8959560d606fa686c48c460357ee2c7bdeee0542132515d269bb3d5c91dd09496042676100428f3fbc5c1dceb8e5c7a661bd77d4cc22