Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
08-10-2023 15:57
Static task
static1
Behavioral task
behavioral1
Sample
sogou.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
sogou.exe
Resource
win10-20230915-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
sogou.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
sogou.exe
-
Size
119.4MB
-
MD5
a83c0bf75de788695364f5ff95925abb
-
SHA1
fb30afdfe8a4b1d4724a34ebe4ce3cc3a10b0e97
-
SHA256
533d5d4e186d532d20790cc2c7ad1ae5224ece0bd77c80b997726c7323a69f11
-
SHA512
27813d218bef6ef1723036b33a55258b7094754571c7eea35fc5899da3c02b6b9dca07fd8441d16627307c5fbd5aebcb1401a5cbfde0d10ec84362a006107120
-
SSDEEP
3145728:/Jy9VWUV4ofQCucgj1hQZtCSPehM9orB:09heoYCucs1WZtCSP/9o
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 2760 MsiExec.exe 2692 MsiExec.exe 2692 MsiExec.exe 2692 MsiExec.exe 2692 MsiExec.exe 1648 MsiExec.exe 1648 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: sogou.exe File opened (read-only) \??\M: sogou.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\G: sogou.exe File opened (read-only) \??\V: sogou.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: sogou.exe File opened (read-only) \??\W: sogou.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: sogou.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: sogou.exe File opened (read-only) \??\Q: sogou.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: sogou.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: sogou.exe File opened (read-only) \??\E: sogou.exe File opened (read-only) \??\J: sogou.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: sogou.exe File opened (read-only) \??\L: sogou.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: sogou.exe File opened (read-only) \??\P: sogou.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: sogou.exe File opened (read-only) \??\Y: sogou.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: sogou.exe File opened (read-only) \??\Z: sogou.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76d356.msi msiexec.exe File created C:\Windows\Installer\f76d357.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF356.tmp msiexec.exe File created C:\Windows\Installer\f76d356.msi msiexec.exe File opened for modification C:\Windows\Installer\MSID440.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSID5D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2776 msiexec.exe 2776 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2776 msiexec.exe Token: SeTakeOwnershipPrivilege 2776 msiexec.exe Token: SeSecurityPrivilege 2776 msiexec.exe Token: SeCreateTokenPrivilege 1780 sogou.exe Token: SeAssignPrimaryTokenPrivilege 1780 sogou.exe Token: SeLockMemoryPrivilege 1780 sogou.exe Token: SeIncreaseQuotaPrivilege 1780 sogou.exe Token: SeMachineAccountPrivilege 1780 sogou.exe Token: SeTcbPrivilege 1780 sogou.exe Token: SeSecurityPrivilege 1780 sogou.exe Token: SeTakeOwnershipPrivilege 1780 sogou.exe Token: SeLoadDriverPrivilege 1780 sogou.exe Token: SeSystemProfilePrivilege 1780 sogou.exe Token: SeSystemtimePrivilege 1780 sogou.exe Token: SeProfSingleProcessPrivilege 1780 sogou.exe Token: SeIncBasePriorityPrivilege 1780 sogou.exe Token: SeCreatePagefilePrivilege 1780 sogou.exe Token: SeCreatePermanentPrivilege 1780 sogou.exe Token: SeBackupPrivilege 1780 sogou.exe Token: SeRestorePrivilege 1780 sogou.exe Token: SeShutdownPrivilege 1780 sogou.exe Token: SeDebugPrivilege 1780 sogou.exe Token: SeAuditPrivilege 1780 sogou.exe Token: SeSystemEnvironmentPrivilege 1780 sogou.exe Token: SeChangeNotifyPrivilege 1780 sogou.exe Token: SeRemoteShutdownPrivilege 1780 sogou.exe Token: SeUndockPrivilege 1780 sogou.exe Token: SeSyncAgentPrivilege 1780 sogou.exe Token: SeEnableDelegationPrivilege 1780 sogou.exe Token: SeManageVolumePrivilege 1780 sogou.exe Token: SeImpersonatePrivilege 1780 sogou.exe Token: SeCreateGlobalPrivilege 1780 sogou.exe Token: SeCreateTokenPrivilege 1780 sogou.exe Token: SeAssignPrimaryTokenPrivilege 1780 sogou.exe Token: SeLockMemoryPrivilege 1780 sogou.exe Token: SeIncreaseQuotaPrivilege 1780 sogou.exe Token: SeMachineAccountPrivilege 1780 sogou.exe Token: SeTcbPrivilege 1780 sogou.exe Token: SeSecurityPrivilege 1780 sogou.exe Token: SeTakeOwnershipPrivilege 1780 sogou.exe Token: SeLoadDriverPrivilege 1780 sogou.exe Token: SeSystemProfilePrivilege 1780 sogou.exe Token: SeSystemtimePrivilege 1780 sogou.exe Token: SeProfSingleProcessPrivilege 1780 sogou.exe Token: SeIncBasePriorityPrivilege 1780 sogou.exe Token: SeCreatePagefilePrivilege 1780 sogou.exe Token: SeCreatePermanentPrivilege 1780 sogou.exe Token: SeBackupPrivilege 1780 sogou.exe Token: SeRestorePrivilege 1780 sogou.exe Token: SeShutdownPrivilege 1780 sogou.exe Token: SeDebugPrivilege 1780 sogou.exe Token: SeAuditPrivilege 1780 sogou.exe Token: SeSystemEnvironmentPrivilege 1780 sogou.exe Token: SeChangeNotifyPrivilege 1780 sogou.exe Token: SeRemoteShutdownPrivilege 1780 sogou.exe Token: SeUndockPrivilege 1780 sogou.exe Token: SeSyncAgentPrivilege 1780 sogou.exe Token: SeEnableDelegationPrivilege 1780 sogou.exe Token: SeManageVolumePrivilege 1780 sogou.exe Token: SeImpersonatePrivilege 1780 sogou.exe Token: SeCreateGlobalPrivilege 1780 sogou.exe Token: SeCreateTokenPrivilege 1780 sogou.exe Token: SeAssignPrimaryTokenPrivilege 1780 sogou.exe Token: SeLockMemoryPrivilege 1780 sogou.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1780 sogou.exe 2804 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 2776 wrote to memory of 2760 2776 msiexec.exe 29 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 1780 wrote to memory of 2804 1780 sogou.exe 30 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 2692 2776 msiexec.exe 31 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 PID 2776 wrote to memory of 1648 2776 msiexec.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sogou.exe"C:\Users\Admin\AppData\Local\Temp\sogou.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\您的公司\搜狗手心输入法 1.1.5\install\搜狗手心输入法.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\sogou.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1696521338 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2804
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F324D90081A5C46DA157C00589C74927 C2⤵
- Loads dropped DLL
PID:2760
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15BAB656B1C029C20EDEA3C1F4DC42CF C2⤵
- Loads dropped DLL
PID:2692
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DC33D9C9743CB68551385EA4764EE90E2⤵
- Loads dropped DLL
PID:1648
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1828
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000004D4"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
1.4MB
MD5c038ef4ed468dc19589ad6fd4378fa86
SHA196c1a6e531d03b8207df1353510663558a2dbc4c
SHA25696fd47b7b0a06fb2b3d46ad153bff9d5b237ff95c50f5f24a7245bf57d7c7e05
SHA51226cb4ecad5c5b86f2ff2464c5d689dcd4b56b4a17220d3ede36407ee17100662b420558088f9ab444466f96de96d2b74692f3bb8428b68bd18193327b489c156
-
Filesize
1.4MB
MD5c038ef4ed468dc19589ad6fd4378fa86
SHA196c1a6e531d03b8207df1353510663558a2dbc4c
SHA25696fd47b7b0a06fb2b3d46ad153bff9d5b237ff95c50f5f24a7245bf57d7c7e05
SHA51226cb4ecad5c5b86f2ff2464c5d689dcd4b56b4a17220d3ede36407ee17100662b420558088f9ab444466f96de96d2b74692f3bb8428b68bd18193327b489c156
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
597KB
MD5999c6b224a8215a8ffe9792c82d93754
SHA19aa98fd47aa4472a9d44c1d41233d9c767deee4c
SHA2562e15823e8384eb7a15cb5daae61ebb031f3928bc511e74115d950afa98ef9572
SHA5127438d35e7263b8b9918c163beafeb18bc35cab7b8577487e24089517016b85e8e13817f13caee011bb1e4ed35af28d3a91e99950c24a2566c0b6453092fa1347
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
597KB
MD5999c6b224a8215a8ffe9792c82d93754
SHA19aa98fd47aa4472a9d44c1d41233d9c767deee4c
SHA2562e15823e8384eb7a15cb5daae61ebb031f3928bc511e74115d950afa98ef9572
SHA5127438d35e7263b8b9918c163beafeb18bc35cab7b8577487e24089517016b85e8e13817f13caee011bb1e4ed35af28d3a91e99950c24a2566c0b6453092fa1347