Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
Resource
win7-20230712-en
General
-
Target
db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
-
Size
1.7MB
-
MD5
3464eb3eb4650b9bdcfa0d0eea6ca068
-
SHA1
755c1bf6eb3e548e6f8def56f3860e2ee7bad48e
-
SHA256
db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990
-
SHA512
58a82f92a7d98f92bf437c8c56d3b1d3f1c094788526cb1350d0a64b4f4ca162d42b6b3d6d1961dce221431f41e3e0de93ef27a7db91832959cb354a6db7cfd3
-
SSDEEP
49152:dQZAdVyVT9n/Gg0P+Who6wTh4yEQncvij:GGdVyVT9nOgmhXwTh4fQV
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2968-60-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2968-62-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-70-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2968-76-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2912-85-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-89-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-91-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2832-143-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 14 IoCs
resource yara_rule behavioral1/memory/2968-61-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2968-60-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2968-62-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-70-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2968-76-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2912-85-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x00080000000146c6-87.dat family_gh0strat behavioral1/memory/2832-89-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2832-91-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x00080000000146c6-97.dat family_gh0strat behavioral1/files/0x00080000000146c6-96.dat family_gh0strat behavioral1/memory/2532-108-0x0000000002550000-0x0000000002696000-memory.dmp family_gh0strat behavioral1/memory/2832-143-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x00080000000146c6-150.dat family_gh0strat -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259422315.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
pid Process 2968 svchost.exe 2912 TXPlatforn.exe 2832 TXPlatforn.exe 2920 svchos.exe 1992 HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2796 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 9 IoCs
pid Process 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2912 TXPlatforn.exe 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2920 svchos.exe 2764 svchost.exe 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2764 svchost.exe 2796 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral1/memory/2968-58-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2968-61-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2968-60-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2968-62-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-70-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2968-76-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2912-85-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-89-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2832-91-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/files/0x0009000000014b45-101.dat upx behavioral1/files/0x0009000000014b45-107.dat upx behavioral1/files/0x0009000000014b45-105.dat upx behavioral1/files/0x0009000000014b45-103.dat upx behavioral1/memory/1992-110-0x0000000000400000-0x0000000000546000-memory.dmp upx behavioral1/memory/2832-143-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259422315.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 112 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2832 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2968 svchost.exe Token: SeLoadDriverPrivilege 2832 TXPlatforn.exe Token: 33 2832 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2832 TXPlatforn.exe Token: 33 2832 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2832 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2532 wrote to memory of 2968 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 28 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2912 wrote to memory of 2832 2912 TXPlatforn.exe 31 PID 2968 wrote to memory of 2932 2968 svchost.exe 30 PID 2968 wrote to memory of 2932 2968 svchost.exe 30 PID 2968 wrote to memory of 2932 2968 svchost.exe 30 PID 2968 wrote to memory of 2932 2968 svchost.exe 30 PID 2532 wrote to memory of 2920 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 33 PID 2532 wrote to memory of 2920 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 33 PID 2532 wrote to memory of 2920 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 33 PID 2532 wrote to memory of 2920 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 33 PID 2532 wrote to memory of 1992 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 36 PID 2532 wrote to memory of 1992 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 36 PID 2532 wrote to memory of 1992 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 36 PID 2532 wrote to memory of 1992 2532 db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe 36 PID 2932 wrote to memory of 112 2932 cmd.exe 37 PID 2932 wrote to memory of 112 2932 cmd.exe 37 PID 2932 wrote to memory of 112 2932 cmd.exe 37 PID 2932 wrote to memory of 112 2932 cmd.exe 37 PID 2764 wrote to memory of 2796 2764 svchost.exe 39 PID 2764 wrote to memory of 2796 2764 svchost.exe 39 PID 2764 wrote to memory of 2796 2764 svchost.exe 39 PID 2764 wrote to memory of 2796 2764 svchost.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe"C:\Users\Admin\AppData\Local\Temp\db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exeC:\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe2⤵
- Executes dropped EXE
PID:1992
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259422315.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD55cedaff71e6e0bc0f5bff7aead2023ad
SHA12a0576b588d433ebf297ae148a8e162eeca88e43
SHA25639b2856c0f880da2e36f2e2ef8d6b5d1a18fef13385ee7b60fc2be159c3ec3bc
SHA512c580055258e8609a5fdb07d2d0167c9919f7e13af761549bf752074770853db4a7d84df13a51e268f610d917fe41b4232c6d4cf7bb5b8bd28860ba8ce4dfe20d
-
C:\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
Filesize260KB
MD59d5599e6ebd2fddc068bfa56b2117649
SHA137613d93a85431bc74b6fbf123247c8f686a2a25
SHA2567fab28fb1682255b9b13d68e5987e8e2660bad8f1fc1e450d5b63564de77aae3
SHA512094f1b29b09668ecd34719fd62c682684e28c7f52d64aaa8472431f3a9792f74d72da03ad395a4ac2f4ff2205d2f10caf4cc3c8bd6478955a7121bf7d26b7742
-
C:\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
Filesize260KB
MD59d5599e6ebd2fddc068bfa56b2117649
SHA137613d93a85431bc74b6fbf123247c8f686a2a25
SHA2567fab28fb1682255b9b13d68e5987e8e2660bad8f1fc1e450d5b63564de77aae3
SHA512094f1b29b09668ecd34719fd62c682684e28c7f52d64aaa8472431f3a9792f74d72da03ad395a4ac2f4ff2205d2f10caf4cc3c8bd6478955a7121bf7d26b7742
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
50KB
MD5fb82e07cb3a53c242a0cdb5ef98ac031
SHA1e5014296741d987b542475a0447f76980f00ae34
SHA2568e8d0e73220e80394e41886dce54b03a21c049bc19e4fbe392c90ea37028527b
SHA5121af7476c5ffac9c53ec2d7a6da03175ba624d1e33015d447b11c2d55a74ff0639c5ebd80529575dd034d4771e8c2af9ecd9f5da7e9cc74761b78caddce8ff6dd
-
\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
Filesize260KB
MD59d5599e6ebd2fddc068bfa56b2117649
SHA137613d93a85431bc74b6fbf123247c8f686a2a25
SHA2567fab28fb1682255b9b13d68e5987e8e2660bad8f1fc1e450d5b63564de77aae3
SHA512094f1b29b09668ecd34719fd62c682684e28c7f52d64aaa8472431f3a9792f74d72da03ad395a4ac2f4ff2205d2f10caf4cc3c8bd6478955a7121bf7d26b7742
-
\Users\Admin\AppData\Local\Temp\HD_db90bba81fb096a26ed09cdf0285ac77d81e3c607ff53d7b5b82f84c39f8e990.exe
Filesize260KB
MD59d5599e6ebd2fddc068bfa56b2117649
SHA137613d93a85431bc74b6fbf123247c8f686a2a25
SHA2567fab28fb1682255b9b13d68e5987e8e2660bad8f1fc1e450d5b63564de77aae3
SHA512094f1b29b09668ecd34719fd62c682684e28c7f52d64aaa8472431f3a9792f74d72da03ad395a4ac2f4ff2205d2f10caf4cc3c8bd6478955a7121bf7d26b7742
-
Filesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
50KB
MD5fb82e07cb3a53c242a0cdb5ef98ac031
SHA1e5014296741d987b542475a0447f76980f00ae34
SHA2568e8d0e73220e80394e41886dce54b03a21c049bc19e4fbe392c90ea37028527b
SHA5121af7476c5ffac9c53ec2d7a6da03175ba624d1e33015d447b11c2d55a74ff0639c5ebd80529575dd034d4771e8c2af9ecd9f5da7e9cc74761b78caddce8ff6dd
-
Filesize
50KB
MD5fb82e07cb3a53c242a0cdb5ef98ac031
SHA1e5014296741d987b542475a0447f76980f00ae34
SHA2568e8d0e73220e80394e41886dce54b03a21c049bc19e4fbe392c90ea37028527b
SHA5121af7476c5ffac9c53ec2d7a6da03175ba624d1e33015d447b11c2d55a74ff0639c5ebd80529575dd034d4771e8c2af9ecd9f5da7e9cc74761b78caddce8ff6dd
-
Filesize
50KB
MD5fb82e07cb3a53c242a0cdb5ef98ac031
SHA1e5014296741d987b542475a0447f76980f00ae34
SHA2568e8d0e73220e80394e41886dce54b03a21c049bc19e4fbe392c90ea37028527b
SHA5121af7476c5ffac9c53ec2d7a6da03175ba624d1e33015d447b11c2d55a74ff0639c5ebd80529575dd034d4771e8c2af9ecd9f5da7e9cc74761b78caddce8ff6dd
-
Filesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d