Analysis
-
max time kernel
18s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
YNAB 4_4.3.857_Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
YNAB 4_4.3.857_Setup.exe
Resource
win10v2004-20240221-en
General
-
Target
YNAB 4_4.3.857_Setup.exe
-
Size
20.2MB
-
MD5
a25c0a73350a99559f1e30c2f86ad0b9
-
SHA1
e537d5658b67739724e5ee38f9075b453052f1cf
-
SHA256
f3021e45c82d72bd139d86f6a68c96af201bedf53a373f183dca037003b9cdc6
-
SHA512
7c5fc8e35fb0bb009c01fd9f4784bb2902b3298cd644fa8664c2fcfd44f2ad0dc0c20990f2d02408a1a3fdc9b8afcf80f433b8e23b9e988f5358266cf80a0de3
-
SSDEEP
393216:GMBVYD1nCAMtsTDzoFYJ3wERZRdW/r7wPLSSkkUYkNMYlC7Ele8lW4a4oUJmGx9P:GMvYpAtsT3oiVfK/APLS/+u87we8UbU9
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2204 YNAB 4_4.3.857_Setup.tmp 2500 YNAB 4.exe 2952 YNAB 4.exe -
Loads dropped DLL 8 IoCs
pid Process 3000 YNAB 4_4.3.857_Setup.exe 2204 YNAB 4_4.3.857_Setup.tmp 2204 YNAB 4_4.3.857_Setup.tmp 2204 YNAB 4_4.3.857_Setup.tmp 2204 YNAB 4_4.3.857_Setup.tmp 2204 YNAB 4_4.3.857_Setup.tmp 2500 YNAB 4.exe 2952 YNAB 4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files (x86)\YNAB 4\is-0IQGE.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Resources\is-PLAAI.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-151UA.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-0TF6P.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\is-K749E.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-68VJ2.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-9E0R2.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-EF08J.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\META-INF\is-3J2BP.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-T603J.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-ULMLR.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Resources\is-VD04I.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-PIRNN.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Resources\WebKit\is-9E1TQ.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-IHKPE.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\META-INF\AIR\is-64ED9.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\META-INF\AIR\is-1I973.tmp YNAB 4_4.3.857_Setup.tmp File opened for modification C:\Program Files (x86)\YNAB 4\unins000.dat YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-3NF2I.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\is-TTMFK.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Resources\is-9RVVN.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-AK3HB.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-DA7Q6.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\unins000.dat YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\Adobe AIR\Versions\1.0\Resources\WebKit\is-TNVPH.tmp YNAB 4_4.3.857_Setup.tmp File created C:\Program Files (x86)\YNAB 4\assets\is-E39SI.tmp YNAB 4_4.3.857_Setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 YNAB 4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz YNAB 4.exe -
Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4 YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\DefaultIcon\ = "C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe,0" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ofx\Content Type = "application/vnd.ynab.ofx" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\ = "Bank File (Opened by YNAB 4)" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\shell\open\ = "Open with YNAB 4" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qfx\ = "com.ynab.YNAB4.qfx" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qif\Content Type = "application/vnd.ynab.qif" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Mime\Database\Content Type\application/vnd.ynab.qif YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ynab4 YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\shell\open YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\shell\open\command\ = "\"C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe\" \"%1\"" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\DefaultIcon YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\shell\open\command YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\DefaultIcon\ = "C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe,0" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\shell\open\command YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ynab4\Content Type = "application/vnd.ynab.ynab4" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Mime\Database\Content Type\application/vnd.ynab.ynab4 YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\shell YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qfx YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\ = "YNAB 4 Budget File" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\shell\open\ = "Open with YNAB 4" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ofx\ = "com.ynab.YNAB4.ofx" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\shell\open\ = "Open with YNAB 4" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\DefaultIcon YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\DefaultIcon\ = "C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe,0" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qif\ = "com.ynab.YNAB4.qif" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ynab.ofx\Extension = ".ofx" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\shell\open\command YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.qfx\Content Type = "application/vnd.ynab.qfx" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ynab4\ = "com.ynab.YNAB4.ynab4" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\shell YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ofx YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Mime\Database\Content Type\application/vnd.ynab.ofx YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\shell YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\ = "Bank File (Opened by YNAB 4)" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\shell\open\command\ = "\"C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe\" \"%1\"" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\shell YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\shell\open YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\DefaultIcon YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\DefaultIcon\ = "C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe,0" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\shell\open\command\ = "\"C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe\" \"%1\"" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ofx\ = "Bank File (Opened by YNAB 4)" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\shell\open\ = "Open with YNAB 4" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\DefaultIcon YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.qif YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ynab.qif\Extension = ".qif" YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ynab.qfx\Extension = ".qfx" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\shell\open YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif\shell\open\command\ = "\"C:\\Program Files (x86)\\YNAB 4\\YNAB 4.exe\" \"%1\"" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qif YNAB 4_4.3.857_Setup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ynab.ynab4\Extension = ".ynab4" YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.ynab4\shell\open\command YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Mime\Database\Content Type\application/vnd.ynab.qfx YNAB 4_4.3.857_Setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\com.ynab.YNAB4.qfx\shell\open YNAB 4_4.3.857_Setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2204 YNAB 4_4.3.857_Setup.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2500 YNAB 4.exe 2952 YNAB 4.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 3000 wrote to memory of 2204 3000 YNAB 4_4.3.857_Setup.exe 28 PID 2204 wrote to memory of 2500 2204 YNAB 4_4.3.857_Setup.tmp 29 PID 2204 wrote to memory of 2500 2204 YNAB 4_4.3.857_Setup.tmp 29 PID 2204 wrote to memory of 2500 2204 YNAB 4_4.3.857_Setup.tmp 29 PID 2204 wrote to memory of 2500 2204 YNAB 4_4.3.857_Setup.tmp 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\is-RBJKR.tmp\YNAB 4_4.3.857_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-RBJKR.tmp\YNAB 4_4.3.857_Setup.tmp" /SL5="$400F4,20782605,219136,C:\Users\Admin\AppData\Local\Temp\YNAB 4_4.3.857_Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\YNAB 4\YNAB 4.exe"C:\Program Files (x86)\YNAB 4\YNAB 4.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
-
C:\Program Files (x86)\YNAB 4\YNAB 4.exe"C:\Program Files (x86)\YNAB 4\YNAB 4.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2952
-
C:\Program Files (x86)\YNAB 4\YNAB 4.exe"C:\Program Files (x86)\YNAB 4\YNAB 4.exe"1⤵PID:1852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD53f9585968be04fec46d1f0e3abe09b1b
SHA1f8b3f7d8b8e81125629dcdc54c7aea378d61bca2
SHA256d00b2eff90913e2997db239f8967b37a436ae3d5870f4f75d097ca79f89e89e2
SHA51227dafd908224546f3884208b450e1726ef43a511e5b27432ef43ff1a6a1c9e8f2df925290bb68b4116bfea552324fdba2f14d0ac3cb53b90bb6c5650b90177d3
-
Filesize
2KB
MD58f7487c76b681fba22a05c595f39b8bf
SHA187e7b04dde3a8fa5dbfa57c6b8b8f1bb8a64989d
SHA256ebdf4f7eaded6a910cc811b77fd89653baee2402dbdeb282358dc208471ce255
SHA5125b4c9d195e91e27f4d2bb3a215a1099c31e25f0576b55b7233fbf5a4b27bdcad0e7e1dffc3acb0fd7424c7dc8c0b8ad5a9cbbaeb2dc1db1584e32ad4aa5afc2e
-
Filesize
128KB
MD5030a3bc512c0981a90149c5e2db3f348
SHA13967e08c546a77f327997a30cd05cff1d3d0bddb
SHA2563c3cf54b228c5ab5cdc62da694e56ec99ac3a3ff6e073521cec7e31980f5eb92
SHA512bbaa807abedef894e4dd1b4b51411629ca4c2faea199e4b69402f7c20066a9c02d61f01f0f5e06f0c1947098e6f441fbf9fecfbe97b75dad6df7ff7bc4c25e24
-
Filesize
1.1MB
MD5a6857bd683c10362bf0513034dc6dd91
SHA1cc3a1839aaf3389bd2881f819eba30a7fb9e9ef5
SHA25651e077287100d014acad98cfd9b0e2af9bcf244e02ee1e17796c17c58e7af3dc
SHA5127d57bbfb078100253cccc8ee9f04ff5a0075d085f07935539fe778d2d8be1f9e84625b2ee31b9f4d919f48bc3ac80a53b20cff55cc8ebad3c03412387f649e5e
-
Filesize
1007KB
MD564308ddd6c9807fd9bb0260c299b4072
SHA173a945f5b628103e76dfbeeac78fcc4bf27402cd
SHA2567d204a50d0180545077609f87fbae45565e7f40dc857a123774609705ff488bb
SHA512b246714b01450051498f3ac058a75eea6d9a9ea2694ca292e70238eb05645d20f8c45ec6cbf457dbb5363889ce2fc7538fcb48bbf42bc97f61d93787e531c503
-
Filesize
128KB
MD55230ff4bab65d45658816473c840b42c
SHA18893c1591a12b29c1f04b39970c710aeaf90755b
SHA2568489bd42c4af2ddaf8fc23348f145dc7729b39eccffc1e1154805176854231c4
SHA51232a1053a68cce9f5ff3a31b4704a829e655c0a2a031dface75a86b54124a7fc0d4fc283c682f4456e5efb62b7ab8f7b4d38a734401a48e22995e75524b2ec472
-
Filesize
1.6MB
MD58d631fce8d59ccf0a6425e2f5992fc50
SHA1038a4c7e20ffb20bedc63bd1f6dc76ba8eeee66e
SHA2561278e37b56ce892401c80105e0e00e89a0d9bdf03716e06ea28ff35a9a74d82a
SHA512f8cc9c0dfb741eb993d109b9716e793dde583c1d0a5d6fcebc02c671dda73a8ab76fa5595617b994cbe4a2e1488f10eb21b1987038b9ff387f640c73646890f8
-
Filesize
3.0MB
MD581df1976f97b334794f3ab1782701215
SHA1338d051f59d028f7c9a89786d143405855e5288c
SHA2566a340a1e99ed774082033c8d9ba9aa0fb3b55b7fd3bed5c61a093f491b40f70b
SHA5126df325dd354e36533e322da22eabeeb29fd06f2d66f61ec229563b3cf391c6dcf052bd7b727e115054ed3e4446acac525336ed1560e51b777c110915f57d1344
-
Filesize
211KB
MD58498b21d1c4582162ae4e100822babe5
SHA17f4e05fe9eacbbb8a4fca9baf2fb0a5b732fd03e
SHA256160256d4687b59be6202de349e777aaeac5e93c037c41304f24d34883f2d5327
SHA5120b5e7afeb082a4cc76bd0284203ee635fc17f2a4163655b19bba7c8cb7642cfa61ec16b8b5be87557d051d89400a8b7fcd77e48b7618263221303401c6db2db1
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
MD529f9be62944155dbb6b0b4f07138ea96
SHA15095375e40047d1b0daa4527c5de271ab23cd2f0
SHA256168e5bbfcc47229ae0375ece11b7c9dabeb0a6bc820058fc2c86f4682cd0388f
SHA512fe9bf378c278986118a7e17d326c795796c6ff20e3c6770ceeffc5d3f948d552147e41d3364cb1e55919d1c54974d135e28fc0753fc555c56a6dd839e4b264fd