Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994.msi
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994.msi
Resource
win10v2004-20231222-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994.msi
-
Size
4.3MB
-
MD5
4f238c2093606fc296f1f819c2f0fc67
-
SHA1
f8535858fcee6b96e0f49e6156fa110fc0698880
-
SHA256
58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994
-
SHA512
c2422db8871d6303b5903c4b11cca3debd62cb25a406655db5a0ba407f33c9fef739371d297e5ccad45efc99e040e6ae29079b4b9325f52d54c5e780f8c346f7
-
SSDEEP
49152:jpUPN9qhCxzT+WKjSXcmNt6+XzP4BYIeBfCXqyfdo1DDDDDDDDDDPuDgO9hTnxA5:jpqCQbm+jg12f3yaiga6yU
Malware Config
Signatures
-
Detect DarkGate stealer 2 IoCs
resource yara_rule behavioral1/memory/1128-94-0x0000000003810000-0x00000000047E0000-memory.dmp family_darkgate_v6 behavioral1/memory/1128-95-0x0000000004CD0000-0x000000000501E000-memory.dmp family_darkgate_v6 -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 940 ICACLS.EXE 2348 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f77620d.msi msiexec.exe File opened for modification C:\Windows\Installer\f77620d.msi msiexec.exe File created C:\Windows\Installer\f77620e.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\f77620e.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI674B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2484 vlc.exe 1128 Autoit3.exe -
Loads dropped DLL 3 IoCs
pid Process 240 MsiExec.exe 240 MsiExec.exe 2484 vlc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2760 msiexec.exe 2760 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2708 msiexec.exe Token: SeIncreaseQuotaPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeTakeOwnershipPrivilege 2760 msiexec.exe Token: SeSecurityPrivilege 2760 msiexec.exe Token: SeCreateTokenPrivilege 2708 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2708 msiexec.exe Token: SeLockMemoryPrivilege 2708 msiexec.exe Token: SeIncreaseQuotaPrivilege 2708 msiexec.exe Token: SeMachineAccountPrivilege 2708 msiexec.exe Token: SeTcbPrivilege 2708 msiexec.exe Token: SeSecurityPrivilege 2708 msiexec.exe Token: SeTakeOwnershipPrivilege 2708 msiexec.exe Token: SeLoadDriverPrivilege 2708 msiexec.exe Token: SeSystemProfilePrivilege 2708 msiexec.exe Token: SeSystemtimePrivilege 2708 msiexec.exe Token: SeProfSingleProcessPrivilege 2708 msiexec.exe Token: SeIncBasePriorityPrivilege 2708 msiexec.exe Token: SeCreatePagefilePrivilege 2708 msiexec.exe Token: SeCreatePermanentPrivilege 2708 msiexec.exe Token: SeBackupPrivilege 2708 msiexec.exe Token: SeRestorePrivilege 2708 msiexec.exe Token: SeShutdownPrivilege 2708 msiexec.exe Token: SeDebugPrivilege 2708 msiexec.exe Token: SeAuditPrivilege 2708 msiexec.exe Token: SeSystemEnvironmentPrivilege 2708 msiexec.exe Token: SeChangeNotifyPrivilege 2708 msiexec.exe Token: SeRemoteShutdownPrivilege 2708 msiexec.exe Token: SeUndockPrivilege 2708 msiexec.exe Token: SeSyncAgentPrivilege 2708 msiexec.exe Token: SeEnableDelegationPrivilege 2708 msiexec.exe Token: SeManageVolumePrivilege 2708 msiexec.exe Token: SeImpersonatePrivilege 2708 msiexec.exe Token: SeCreateGlobalPrivilege 2708 msiexec.exe Token: SeBackupPrivilege 2736 vssvc.exe Token: SeRestorePrivilege 2736 vssvc.exe Token: SeAuditPrivilege 2736 vssvc.exe Token: SeBackupPrivilege 2760 msiexec.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeLoadDriverPrivilege 2900 DrvInst.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeTakeOwnershipPrivilege 2760 msiexec.exe Token: SeRestorePrivilege 2760 msiexec.exe Token: SeTakeOwnershipPrivilege 2760 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2708 msiexec.exe 2708 msiexec.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 2760 wrote to memory of 240 2760 msiexec.exe 33 PID 240 wrote to memory of 2348 240 MsiExec.exe 34 PID 240 wrote to memory of 2348 240 MsiExec.exe 34 PID 240 wrote to memory of 2348 240 MsiExec.exe 34 PID 240 wrote to memory of 2348 240 MsiExec.exe 34 PID 240 wrote to memory of 2244 240 MsiExec.exe 36 PID 240 wrote to memory of 2244 240 MsiExec.exe 36 PID 240 wrote to memory of 2244 240 MsiExec.exe 36 PID 240 wrote to memory of 2244 240 MsiExec.exe 36 PID 240 wrote to memory of 2484 240 MsiExec.exe 38 PID 240 wrote to memory of 2484 240 MsiExec.exe 38 PID 240 wrote to memory of 2484 240 MsiExec.exe 38 PID 240 wrote to memory of 2484 240 MsiExec.exe 38 PID 2484 wrote to memory of 1128 2484 vlc.exe 39 PID 2484 wrote to memory of 1128 2484 vlc.exe 39 PID 2484 wrote to memory of 1128 2484 vlc.exe 39 PID 2484 wrote to memory of 1128 2484 vlc.exe 39 PID 240 wrote to memory of 1740 240 MsiExec.exe 40 PID 240 wrote to memory of 1740 240 MsiExec.exe 40 PID 240 wrote to memory of 1740 240 MsiExec.exe 40 PID 240 wrote to memory of 1740 240 MsiExec.exe 40 PID 240 wrote to memory of 940 240 MsiExec.exe 42 PID 240 wrote to memory of 940 240 MsiExec.exe 42 PID 240 wrote to memory of 940 240 MsiExec.exe 42 PID 240 wrote to memory of 940 240 MsiExec.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2708
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7DD0220520C1DCA75689A73399DE53272⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-dc4caf3b-0f5f-4bc9-95d3-18b0d2051ae8\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2348
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:2244
-
-
C:\Users\Admin\AppData\Local\Temp\MW-dc4caf3b-0f5f-4bc9-95d3-18b0d2051ae8\files\vlc.exe"C:\Users\Admin\AppData\Local\Temp\MW-dc4caf3b-0f5f-4bc9-95d3-18b0d2051ae8\files\vlc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1128
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-dc4caf3b-0f5f-4bc9-95d3-18b0d2051ae8\files"3⤵PID:1740
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-dc4caf3b-0f5f-4bc9-95d3-18b0d2051ae8\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:940
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003B4" "0000000000000580"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD5b617d565e52112548d239e32b05eecb4
SHA15e37585718e80f11c44537f21ecd6d1c45f44c6b
SHA25696146d2cb6aa614ffe3aac47f5e0d8a3bcf28bacb3f27bc9a80a18ede73ac607
SHA51223f2b21f4bb19eba68c39bd93964160f55611686546aee904cac925ee058a6f8f6c6e1f113cdeb7c42ca5375d83de1169051c9a001aeb1f48f322dbe5d6bcd7d
-
Filesize
1.5MB
MD53843f0f904fc531b2c528b65ada84dff
SHA17ad3a66bd8be7456ceb7a5976548cdd6c2643d8f
SHA256f3cbababb4ba75f65b4a5ec6d603ef93ed23089aef777b22db710d5bc873a11a
SHA512e099cef3bd5f80f9e861f97e6c7ddace0adddfb26e316c76a4d66cda7942c2e46f6f66ed6ca9a6d06a587645c6a01527f542420e3720d462d6b09d5fe44cbf5c
-
Filesize
1.6MB
MD5775d01ac4a84cf493c27759ae6b55355
SHA1e27078488d12e7ab7feff45fe2b2b7f60d72b0f3
SHA256e894e2781806b306298f85a1af60b1ca38b4695bde30cf6839518e10501b6b5a
SHA512b6168b83deb2c95e88b6eb4e1fbc1bf7f3a3353e6fee9b016f5e25472ed202225aed0338f196fbcd116a480d6708487191afa8be4a21cd5316f90f6167d1c978
-
Filesize
966KB
MD5035860e139ba6db1b38d5346cb6ff5b6
SHA1d515303cbca3a8ae7a0463fecd418d81b314e650
SHA25616197a321fc7b0a2a311e689621fe4a7cd50fdcb2d163973a31e4fd6352232d7
SHA51214dab9108d85af72001631130923b94483dd1440f24a8eedad41756db3030c5e11e80ec894922c389e09c86e8b721bcbd8594bd3646f484560f89963a7e18cc7
-
Filesize
1KB
MD59599f3e3146c05ad49440543b979c5b3
SHA1fb105cf747f27e878bbf3f2972ccbd3e795e8578
SHA256e665d69d5c6c580834337b941447c0edcb326638ddbb04b33ed4c08eab7c20d3
SHA5122993b53b426dab2e9d87ec8fdea83cccf12c6f4d6db05e4f774fdff24d2ff99b7ad908002e420838519a5658f0445e3f30231cdedad0d79267227434c0d74f96
-
Filesize
1KB
MD51d4fadb54466b409a98dc983edf649d4
SHA1f709ba2e49b10b93c8a23c09a17c23fa4fc5ba4e
SHA2560051fd4f49aef2791d750092aaa4cb5dbc484d0ad1ccaae117cd79228601aa99
SHA51236813658ae53da22156f604c4b78c04924c419e9908be8aa2347ea7e810e20228f55eeb59367f6f3943478f2a3c27b015c08981bc892466ddcc62b70f014435a
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
466KB
MD5caf6d14ee91108f878d6108071d72b7a
SHA16166b2db78c93bdb24dc693b18a8bc6f1cd96fe6
SHA2563182937fdba31b1fe9f18f78e0901fe8d3bac7ed72b87f8409dcd19e2e1f4184
SHA51274b46ffd50acf54055e05ac12b8167b8f4976de345f478b648f71c05cf8f1f9cb584cdc2711d605aaea05c1f0fb643028ef8524e0f9144b0ab2975792c9681c9
-
Filesize
76B
MD5eb493e70c279b059272d93eb86156a25
SHA1cc6d75663d2647ce59741958b9334d9319dc1e40
SHA256c5c350d106264a59acb4049244933261da379b6fc5577b519cfc113c83fb1e31
SHA512c4617f8d45d00bf3fbe6a1ab4b25052e2012e2f2783022528d625618956814ab6497a82800f14592eda1886903d88a075ffeff29d72bec8c4817927b9dcac514