Analysis
-
max time kernel
205s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 13:41
Behavioral task
behavioral1
Sample
PerX.exe
Resource
win7-20221111-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
PerX.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
Scarletz.dll
Resource
win7-20221111-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Scarletz.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
PerX.exe
-
Size
700KB
-
MD5
2a1a572771597d924ed145efaf4c77d6
-
SHA1
0302a5986fadc56557018291003a2bc852fd0913
-
SHA256
333ea334c1a637d1ef888771bf6542953d28f76c26487356ff2a94a971667c55
-
SHA512
17560878ae608fe947220f0d640d72d51e7c607e238e8be7b9f19fc7d20a7dd631633c21f424629bb8f57963161d8226601308cf95ced86c7c178b64dd0302fc
-
SSDEEP
12288:Ddm3xc4L24cmoS8c97WyggbpPYfBZpLnPO2Vmi1ZXA2m/jl+mixj2:Ddm3xX9ggbpcLP7A2gomOC
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" PerX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" PerX.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" PerX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" PerX.exe -
Executes dropped EXE 1 IoCs
pid Process 1916 PerXmgr.exe -
resource yara_rule behavioral2/memory/4772-133-0x0000000000400000-0x0000000000531000-memory.dmp upx behavioral2/memory/1916-138-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4772-137-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/1916-140-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1916-141-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1916-139-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4772-143-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral2/memory/1916-144-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4772-146-0x0000000000400000-0x0000000000531000-memory.dmp upx behavioral2/memory/4772-147-0x00000000024B0000-0x000000000353E000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1916 PerXmgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" PerX.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc PerX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" PerX.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: PerX.exe File opened (read-only) \??\K: PerX.exe File opened (read-only) \??\Q: PerX.exe File opened (read-only) \??\M: PerX.exe File opened (read-only) \??\O: PerX.exe File opened (read-only) \??\U: PerX.exe File opened (read-only) \??\V: PerX.exe File opened (read-only) \??\Z: PerX.exe File opened (read-only) \??\G: PerX.exe File opened (read-only) \??\H: PerX.exe File opened (read-only) \??\L: PerX.exe File opened (read-only) \??\F: PerX.exe File opened (read-only) \??\W: PerX.exe File opened (read-only) \??\P: PerX.exe File opened (read-only) \??\R: PerX.exe File opened (read-only) \??\S: PerX.exe File opened (read-only) \??\T: PerX.exe File opened (read-only) \??\X: PerX.exe File opened (read-only) \??\E: PerX.exe File opened (read-only) \??\I: PerX.exe File opened (read-only) \??\N: PerX.exe File opened (read-only) \??\Y: PerX.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf PerX.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe PerX.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe PerX.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe PerX.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI PerX.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 4604 1916 WerFault.exe 80 3160 1916 WerFault.exe 80 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe 4772 PerX.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe Token: SeDebugPrivilege 4772 PerX.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1916 PerXmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 792 4772 PerX.exe 13 PID 4772 wrote to memory of 796 4772 PerX.exe 12 PID 4772 wrote to memory of 1008 4772 PerX.exe 9 PID 4772 wrote to memory of 2708 4772 PerX.exe 70 PID 4772 wrote to memory of 2808 4772 PerX.exe 69 PID 4772 wrote to memory of 2892 4772 PerX.exe 68 PID 4772 wrote to memory of 2032 4772 PerX.exe 66 PID 4772 wrote to memory of 3140 4772 PerX.exe 65 PID 4772 wrote to memory of 3348 4772 PerX.exe 64 PID 4772 wrote to memory of 3444 4772 PerX.exe 63 PID 4772 wrote to memory of 3512 4772 PerX.exe 43 PID 4772 wrote to memory of 3604 4772 PerX.exe 62 PID 4772 wrote to memory of 3816 4772 PerX.exe 60 PID 4772 wrote to memory of 4704 4772 PerX.exe 58 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 2728 4772 PerX.exe PID 4772 wrote to memory of 792 4772 PerX.exe 13 PID 4772 wrote to memory of 796 4772 PerX.exe 12 PID 4772 wrote to memory of 1008 4772 PerX.exe 9 PID 4772 wrote to memory of 2708 4772 PerX.exe 70 PID 4772 wrote to memory of 2808 4772 PerX.exe 69 PID 4772 wrote to memory of 2892 4772 PerX.exe 68 PID 4772 wrote to memory of 2032 4772 PerX.exe 66 PID 4772 wrote to memory of 3140 4772 PerX.exe 65 PID 4772 wrote to memory of 3348 4772 PerX.exe 64 PID 4772 wrote to memory of 3444 4772 PerX.exe 63 PID 4772 wrote to memory of 3512 4772 PerX.exe 43 PID 4772 wrote to memory of 3604 4772 PerX.exe 62 PID 4772 wrote to memory of 3816 4772 PerX.exe 60 PID 4772 wrote to memory of 4704 4772 PerX.exe 58 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 4620 4772 PerX.exe PID 4772 wrote to memory of 4604 4772 PerX.exe 83 PID 4772 wrote to memory of 4604 4772 PerX.exe 83 PID 4772 wrote to memory of 792 4772 PerX.exe 13 PID 4772 wrote to memory of 796 4772 PerX.exe 12 PID 4772 wrote to memory of 1008 4772 PerX.exe 9 PID 4772 wrote to memory of 2708 4772 PerX.exe 70 PID 4772 wrote to memory of 2808 4772 PerX.exe 69 PID 4772 wrote to memory of 2892 4772 PerX.exe 68 PID 4772 wrote to memory of 2032 4772 PerX.exe 66 PID 4772 wrote to memory of 3140 4772 PerX.exe 65 PID 4772 wrote to memory of 3348 4772 PerX.exe 64 PID 4772 wrote to memory of 3444 4772 PerX.exe 63 PID 4772 wrote to memory of 3512 4772 PerX.exe 43 PID 4772 wrote to memory of 3604 4772 PerX.exe 62 PID 4772 wrote to memory of 3816 4772 PerX.exe 60 PID 4772 wrote to memory of 4704 4772 PerX.exe 58 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 1916 4772 PerX.exe 80 PID 4772 wrote to memory of 792 4772 PerX.exe 13 PID 4772 wrote to memory of 796 4772 PerX.exe 12 PID 4772 wrote to memory of 1008 4772 PerX.exe 9 PID 4772 wrote to memory of 2708 4772 PerX.exe 70 PID 4772 wrote to memory of 2808 4772 PerX.exe 69 PID 4772 wrote to memory of 2892 4772 PerX.exe 68 PID 4772 wrote to memory of 2032 4772 PerX.exe 66 PID 4772 wrote to memory of 3140 4772 PerX.exe 65 PID 4772 wrote to memory of 3348 4772 PerX.exe 64 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" PerX.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1008
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3512
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4704
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3816
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3604
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3444
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3140
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\PerX.exe"C:\Users\Admin\AppData\Local\Temp\PerX.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\PerXmgr.exeC:\Users\Admin\AppData\Local\Temp\PerXmgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
PID:1916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 5044⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 4404⤵
- Program crash
PID:3160
-
-
-
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2808
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1916 -ip 19161⤵PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1916 -ip 19161⤵PID:1280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
Filesize
113KB
MD5d26092af969610dab56e02649ecae88d
SHA1cd450ff4b645acd188fa1f9e9c16a972c0e99f87
SHA256e4fedb771fd949517cbf3392c9f36be599bf16726a4702cb960a1f4845c39a71
SHA5128c87bf4318089dc03d7c60b1d1f04ac46333f792ca37bd3a0ca832dc22ae56dc8b0a473154706ef58812c70cf99d6fee877ab4984ce973eaaa3e5d1525730b05
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219