Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-05-2023 22:43
Static task
static1
Behavioral task
behavioral1
Sample
raw.js
Resource
win7-20230220-en
windows7-x64
General
-
Target
raw.js
-
Size
15KB
-
MD5
37f56794fcc202b0568d6005de64fe12
-
SHA1
11a3e14c1daff0b32af21d071c1593a9fa3f4975
-
SHA256
0bbcf926861f0bab4410477493187a89fc7e28b9da5a1bf607c33316f575343f
-
SHA512
85c23a31c25e814ae95f2c6bad29411cc1cec410ddcadac1a47e7d71c81d99342d1db66c57a01ca81e842a20608b3c57be33f2c939a04f306bb406625354839e
-
SSDEEP
192:72QHFX0ZcX/Cv3gtMMNcJ5+km8ime6C7IRmX/noHnkpgmlyHnlTjYktAcn/kdeD:iYX/voRacJRHwrYmX/YU+AktAikdo
Malware Config
Extracted
qakbot
404.1249
BB29
1685100431
50.68.186.195:443
66.180.234.51:2222
103.141.50.43:995
69.242.31.249:443
173.88.135.179:443
12.172.173.82:465
86.130.9.242:2222
92.27.86.48:2222
88.126.94.4:50000
113.11.92.30:443
12.172.173.82:995
92.154.17.149:2222
92.135.0.154:2222
212.169.233.141:3389
103.123.223.133:443
12.172.173.82:32101
70.28.50.223:3389
47.21.51.138:443
75.98.154.19:443
47.205.25.170:443
12.172.173.82:993
176.142.207.63:443
12.172.173.82:22
12.172.173.82:50001
190.199.228.254:2222
75.143.236.149:443
70.50.83.139:2222
184.153.132.82:443
122.184.143.86:443
70.28.50.223:2087
12.172.173.82:21
103.87.128.228:443
50.68.204.71:993
190.75.158.216:2222
73.41.215.237:443
186.75.95.6:443
90.29.86.138:2222
151.62.238.176:443
85.104.105.67:443
125.99.69.178:443
92.186.69.229:2222
78.130.215.67:443
27.99.32.26:2222
12.172.173.82:2087
50.68.204.71:443
69.119.123.159:2222
184.181.75.148:443
86.97.52.82:2222
92.20.204.198:2222
91.2.143.185:995
65.30.139.145:995
82.125.44.236:2222
89.36.206.69:995
104.35.24.154:443
197.0.76.189:443
89.129.109.27:2222
83.114.60.6:2222
151.65.69.12:443
87.202.101.164:50000
2.36.64.159:2078
69.133.162.35:443
87.223.86.50:443
105.101.34.87:443
75.141.227.169:443
105.186.138.188:995
172.115.17.50:443
95.45.50.93:2222
183.87.163.165:443
86.248.228.57:2078
24.198.114.130:995
78.192.109.105:2222
71.38.155.217:443
188.83.251.100:443
102.159.19.118:443
103.140.174.20:2222
92.9.45.20:2222
100.6.31.96:443
80.12.88.148:2222
70.112.206.5:443
198.2.51.242:993
197.164.217.136:995
86.128.15.167:2222
223.166.13.95:995
213.64.33.61:2222
72.134.124.16:443
70.28.50.223:2078
47.34.30.133:443
79.77.142.22:2222
31.17.195.13:8443
147.219.4.194:443
92.1.170.110:995
70.160.67.203:443
84.215.202.8:443
94.207.104.225:443
174.4.89.3:443
76.185.109.16:443
125.99.76.102:443
84.35.26.14:995
12.172.173.82:20
124.149.143.189:2222
96.56.197.26:2222
188.28.19.84:443
27.109.19.90:2078
70.48.46.235:2222
161.142.103.187:995
116.75.63.253:443
77.86.98.236:443
123.3.240.16:6881
83.110.223.61:443
109.50.128.59:2222
171.96.192.178:443
205.237.67.69:995
65.95.141.84:2222
74.58.71.237:443
91.169.12.198:32100
37.14.229.220:2222
70.28.50.223:32100
76.170.252.153:995
184.182.66.109:443
96.87.28.170:2222
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 1616 msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB904.tmp msiexec.exe File created C:\Windows\Installer\6d3ad1.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\6d3ad3.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3CF3.tmp msiexec.exe File opened for modification C:\Windows\Installer\6d3ad1.ipi msiexec.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1616 msiexec.exe 1616 msiexec.exe 1920 rundll32.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe 868 wermgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1848 wscript.exe Token: SeIncreaseQuotaPrivilege 1848 wscript.exe Token: SeRestorePrivilege 1616 msiexec.exe Token: SeTakeOwnershipPrivilege 1616 msiexec.exe Token: SeSecurityPrivilege 1616 msiexec.exe Token: SeCreateTokenPrivilege 1848 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1848 wscript.exe Token: SeLockMemoryPrivilege 1848 wscript.exe Token: SeIncreaseQuotaPrivilege 1848 wscript.exe Token: SeMachineAccountPrivilege 1848 wscript.exe Token: SeTcbPrivilege 1848 wscript.exe Token: SeSecurityPrivilege 1848 wscript.exe Token: SeTakeOwnershipPrivilege 1848 wscript.exe Token: SeLoadDriverPrivilege 1848 wscript.exe Token: SeSystemProfilePrivilege 1848 wscript.exe Token: SeSystemtimePrivilege 1848 wscript.exe Token: SeProfSingleProcessPrivilege 1848 wscript.exe Token: SeIncBasePriorityPrivilege 1848 wscript.exe Token: SeCreatePagefilePrivilege 1848 wscript.exe Token: SeCreatePermanentPrivilege 1848 wscript.exe Token: SeBackupPrivilege 1848 wscript.exe Token: SeRestorePrivilege 1848 wscript.exe Token: SeShutdownPrivilege 1848 wscript.exe Token: SeDebugPrivilege 1848 wscript.exe Token: SeAuditPrivilege 1848 wscript.exe Token: SeSystemEnvironmentPrivilege 1848 wscript.exe Token: SeChangeNotifyPrivilege 1848 wscript.exe Token: SeRemoteShutdownPrivilege 1848 wscript.exe Token: SeUndockPrivilege 1848 wscript.exe Token: SeSyncAgentPrivilege 1848 wscript.exe Token: SeEnableDelegationPrivilege 1848 wscript.exe Token: SeManageVolumePrivilege 1848 wscript.exe Token: SeImpersonatePrivilege 1848 wscript.exe Token: SeCreateGlobalPrivilege 1848 wscript.exe Token: SeShutdownPrivilege 1848 wscript.exe Token: SeIncreaseQuotaPrivilege 1848 wscript.exe Token: SeCreateTokenPrivilege 1848 wscript.exe Token: SeAssignPrimaryTokenPrivilege 1848 wscript.exe Token: SeLockMemoryPrivilege 1848 wscript.exe Token: SeIncreaseQuotaPrivilege 1848 wscript.exe Token: SeMachineAccountPrivilege 1848 wscript.exe Token: SeTcbPrivilege 1848 wscript.exe Token: SeSecurityPrivilege 1848 wscript.exe Token: SeTakeOwnershipPrivilege 1848 wscript.exe Token: SeLoadDriverPrivilege 1848 wscript.exe Token: SeSystemProfilePrivilege 1848 wscript.exe Token: SeSystemtimePrivilege 1848 wscript.exe Token: SeProfSingleProcessPrivilege 1848 wscript.exe Token: SeIncBasePriorityPrivilege 1848 wscript.exe Token: SeCreatePagefilePrivilege 1848 wscript.exe Token: SeCreatePermanentPrivilege 1848 wscript.exe Token: SeBackupPrivilege 1848 wscript.exe Token: SeRestorePrivilege 1848 wscript.exe Token: SeShutdownPrivilege 1848 wscript.exe Token: SeDebugPrivilege 1848 wscript.exe Token: SeAuditPrivilege 1848 wscript.exe Token: SeSystemEnvironmentPrivilege 1848 wscript.exe Token: SeChangeNotifyPrivilege 1848 wscript.exe Token: SeRemoteShutdownPrivilege 1848 wscript.exe Token: SeUndockPrivilege 1848 wscript.exe Token: SeSyncAgentPrivilege 1848 wscript.exe Token: SeEnableDelegationPrivilege 1848 wscript.exe Token: SeManageVolumePrivilege 1848 wscript.exe Token: SeImpersonatePrivilege 1848 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1848 wscript.exe 1848 wscript.exe 1848 wscript.exe 1848 wscript.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1644 1616 msiexec.exe 30 PID 1616 wrote to memory of 1644 1616 msiexec.exe 30 PID 1616 wrote to memory of 1644 1616 msiexec.exe 30 PID 1616 wrote to memory of 1648 1616 msiexec.exe 31 PID 1616 wrote to memory of 1648 1616 msiexec.exe 31 PID 1616 wrote to memory of 1648 1616 msiexec.exe 31 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1648 wrote to memory of 1920 1648 rundll32.exe 32 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 PID 1920 wrote to memory of 868 1920 rundll32.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\raw.js1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1848
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\notify.vbs2⤵PID:1644
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll,next2⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\ZoomDesktopClient\main.dll,next3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
PID:868
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:936
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003AC" "00000000000003DC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD55e5468f7d25a33c039643707a22e1750
SHA1d1caea38f6fae5b7de107016a6db68d2a1553fef
SHA2567d3cb0a8f6752822731c920d18eedf2dc0007ee8c27069593dfa3f6c7023fe60
SHA5124e87592876dc93ee94f69aa54fcf280906126c4d218d45bf08d9907992b15bb0e154f2ceddd059ad84614e64fe2a8fe565c17151eb6f4abacf0411ec94897b32
-
Filesize
727KB
MD5880aaeb61626ae9a43cc8aae144d949a
SHA17f6bde013a551b9ecd609e364c8db8c568e1660b
SHA2566c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
SHA512b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
-
Filesize
106B
MD581bc3c331877bbb6f1d9688813402d28
SHA1c06175deba61f3eb2ee47893d26dcfbf680d7b20
SHA2566142d9959be3e3d6276d33b6a8f5feac0116da002ae847f96079d7371974919f
SHA51231da6db1ea4780852fd941f9a887693fae756c369b3c3ae71f76ba331445fa82b33bcea43c67df4c5df555055556242b172c0c256d0ea9f1bf190b70816bdf6f
-
Filesize
416KB
MD584f60d908dc7e65d585d1f1e51a1c211
SHA109d7ae37353a93c2d3651cfb7c70b2a164a169c4
SHA256a9740680f1c75a1b5ceb136f04ab322d3dcec86bb4102e54de16c72cb3970dd5
SHA5126a251b9facaf407fce79715a2bc9853133a66ba9edf4ce9465e23b4de9d0f663ff45b1bd7e620bce2f44e603e321592ff6414d0e17dd65a4c683f0b89d3044c3
-
Filesize
727KB
MD5880aaeb61626ae9a43cc8aae144d949a
SHA17f6bde013a551b9ecd609e364c8db8c568e1660b
SHA2566c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
SHA512b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
-
Filesize
727KB
MD5880aaeb61626ae9a43cc8aae144d949a
SHA17f6bde013a551b9ecd609e364c8db8c568e1660b
SHA2566c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
SHA512b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
-
Filesize
727KB
MD5880aaeb61626ae9a43cc8aae144d949a
SHA17f6bde013a551b9ecd609e364c8db8c568e1660b
SHA2566c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
SHA512b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2
-
Filesize
727KB
MD5880aaeb61626ae9a43cc8aae144d949a
SHA17f6bde013a551b9ecd609e364c8db8c568e1660b
SHA2566c0d3531c95bf245d6413dc7f3bf5739fc41f6064bf6d8fc66443f8e46d9ffd2
SHA512b27b685bc27973c47ff6c53a9fd3a8d7aa963c27240d36eb9c1f78f3d2d24a79ca15374ec5bc88a70a1a3f4986acf60cb37807b294f658953f750810127b13a2