Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
87c8af44c306986e5a6cfa90d0b5a456.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
87c8af44c306986e5a6cfa90d0b5a456.exe
Resource
win10v2004-20240226-en
General
-
Target
87c8af44c306986e5a6cfa90d0b5a456.exe
-
Size
1.6MB
-
MD5
87c8af44c306986e5a6cfa90d0b5a456
-
SHA1
36a5bcd8dbebe601394279575c5f683d2b2c118a
-
SHA256
b8f68894ce47842f2b2971225933f262fb3cab2065c71361db21813fa772a302
-
SHA512
d2067845e2a5e1a8a83d369918c92b79ae76f7986a96e201f2af0b84cf32d47b95d0c44cefa1dfa7e150282412627d5882dfc4dfba9c313a5d576b611dffb897
-
SSDEEP
24576:cTIwOpLcj9lYsuTb9Bvju0D+KZQUiI2Xu6ivfH:UOpL0lYlH9tPDi+ZvfH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 87c8af44c306986e5a6cfa90d0b5a456.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 4 IoCs
pid Process 5040 acrotray.exe 596 acrotray.exe 2944 acrotray .exe 3820 acrotray .exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe" 87c8af44c306986e5a6cfa90d0b5a456.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\acrotray .exe 87c8af44c306986e5a6cfa90d0b5a456.exe File created C:\Program Files (x86)\Adobe\acrotray.exe 87c8af44c306986e5a6cfa90d0b5a456.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F22B28C5-F6C4-11EE-87B8-EA08C850D01B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000055176c4ced34542856d0f29947515a5000000000200000000001066000000010000200000005edfca52bfb570bba4054f4d7f2b52c6f1c09084588426a553a7365a08c8c562000000000e8000000002000020000000cfe823f07a4b74661b58d3a5967881e6a83b87e3d7337a271bcfc2e3160bf4572000000081df6e41af12bda505ec42c374d8ad5d607157a5b7936f3b504e6de227bb959340000000184ae7435a1bc3f1fb47e82310701bcd6dbf3d29a5468d09085ca0f8f0bcd5bbaaec9fb73a9775caa84c5f762e509430ea31462dcfb566d023108bd3cc6bf9dd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b245b6d18ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d015bfd1d18ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9081f3c1d18ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3332091960" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31099601" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31099601" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000055176c4ced34542856d0f29947515a5000000000200000000001066000000010000200000004a2f5ac01a7e74ea955b137f62a63171b1ee707f5e06adb714fd76424e1e6263000000000e80000000020000200000009b155380b57c4030588b4e24a6e2079202082f2dbd7c2efcf223f8364361ce5320000000ff5452662485040a3df747b3c80d6849953ee08d5448dee782e0b483e9031f1b400000005839559e0ba1a2ca47069bc42734baea5094e71d22209b4683c39346de45ce2d5a08abc65a511351f044923466c3ce5099c985ffaa12a152cb2e24a96fc580bb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000055176c4ced34542856d0f29947515a5000000000200000000001066000000010000200000001b2fb0c4081d67486217793a35cec302826c90596ff49f64e7889e353a4b0fa0000000000e8000000002000020000000f258bcb0b6e64b8e6e1f8163247be5cd4fd6daa05994fa47340145919f463b9d200000008857a0f2a018739d177baf9d5f279ffd1b2846ed1c59cb462a4ed4fc3ce61f4e40000000431dfd8a31bd7801d8337fbdcc7ea2d30d66f4e92184ee76281e0b8c906e9471a124abd4facde9609727e122103fe382d9abc2824fcc69015a40066ea5b044b8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3332091960" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000055176c4ced34542856d0f29947515a5000000000200000000001066000000010000200000003ed5387065f66604555d7cd643c571daa83c9cd3c9a98b4aba60134b64a2dd0f000000000e800000000200002000000004faeb858767b434bf96eb66da43e11bcd6dbacbf6d26a5dcf5410f82266c0792000000078e8e898bb5a63aa687a52e71db54b5a16549d2d29b72b243d67a018b185a44440000000ab4fd59d87d5450c3da72f4d276102439b3591ac6ba3c8ec6cbfd933ff7594895beff6bed5a43a0ff9e7931e491390d44da0e94052bdc6e87ede74417024a0e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70feb1b5d18ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 184 87c8af44c306986e5a6cfa90d0b5a456.exe 184 87c8af44c306986e5a6cfa90d0b5a456.exe 184 87c8af44c306986e5a6cfa90d0b5a456.exe 184 87c8af44c306986e5a6cfa90d0b5a456.exe 184 87c8af44c306986e5a6cfa90d0b5a456.exe 184 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 5040 acrotray.exe 5040 acrotray.exe 5040 acrotray.exe 5040 acrotray.exe 5040 acrotray.exe 5040 acrotray.exe 596 acrotray.exe 596 acrotray.exe 596 acrotray.exe 596 acrotray.exe 2944 acrotray .exe 2944 acrotray .exe 2944 acrotray .exe 2944 acrotray .exe 2944 acrotray .exe 2944 acrotray .exe 3820 acrotray .exe 3820 acrotray .exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe 3820 acrotray .exe 3820 acrotray .exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 820 87c8af44c306986e5a6cfa90d0b5a456.exe 596 acrotray.exe 596 acrotray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 184 87c8af44c306986e5a6cfa90d0b5a456.exe Token: SeDebugPrivilege 820 87c8af44c306986e5a6cfa90d0b5a456.exe Token: SeDebugPrivilege 5040 acrotray.exe Token: SeDebugPrivilege 596 acrotray.exe Token: SeDebugPrivilege 2944 acrotray .exe Token: SeDebugPrivilege 3820 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 2280 iexplore.exe 2280 iexplore.exe 2468 IEXPLORE.EXE 2468 IEXPLORE.EXE 2280 iexplore.exe 2280 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 184 wrote to memory of 820 184 87c8af44c306986e5a6cfa90d0b5a456.exe 89 PID 184 wrote to memory of 820 184 87c8af44c306986e5a6cfa90d0b5a456.exe 89 PID 184 wrote to memory of 820 184 87c8af44c306986e5a6cfa90d0b5a456.exe 89 PID 184 wrote to memory of 5040 184 87c8af44c306986e5a6cfa90d0b5a456.exe 97 PID 184 wrote to memory of 5040 184 87c8af44c306986e5a6cfa90d0b5a456.exe 97 PID 184 wrote to memory of 5040 184 87c8af44c306986e5a6cfa90d0b5a456.exe 97 PID 5040 wrote to memory of 596 5040 acrotray.exe 100 PID 5040 wrote to memory of 596 5040 acrotray.exe 100 PID 5040 wrote to memory of 596 5040 acrotray.exe 100 PID 5040 wrote to memory of 2944 5040 acrotray.exe 101 PID 5040 wrote to memory of 2944 5040 acrotray.exe 101 PID 5040 wrote to memory of 2944 5040 acrotray.exe 101 PID 2280 wrote to memory of 1856 2280 iexplore.exe 102 PID 2280 wrote to memory of 1856 2280 iexplore.exe 102 PID 2280 wrote to memory of 1856 2280 iexplore.exe 102 PID 2944 wrote to memory of 3820 2944 acrotray .exe 103 PID 2944 wrote to memory of 3820 2944 acrotray .exe 103 PID 2944 wrote to memory of 3820 2944 acrotray .exe 103 PID 2280 wrote to memory of 2468 2280 iexplore.exe 105 PID 2280 wrote to memory of 2468 2280 iexplore.exe 105 PID 2280 wrote to memory of 2468 2280 iexplore.exe 105 PID 2280 wrote to memory of 2548 2280 iexplore.exe 106 PID 2280 wrote to memory of 2548 2280 iexplore.exe 106 PID 2280 wrote to memory of 2548 2280 iexplore.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe" C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:596
-
-
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\87c8af44c306986e5a6cfa90d0b5a456.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4056
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:82954 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD587c0b004a7d8b3c43fcc332f667caf46
SHA18408313c192f9a65b52c08a6b34ec823cd381096
SHA256c51434e2d2c502f2692c855aebf8a795f798099460b59d4a2bea99248c55d7f0
SHA512a9422f5a42b4bb781150a99110ff87ed8739f329a4b2ed09ee15195ec8b5c3ca837aa84f39591ed5245a3dae16f4d97daaa83d5ce58df980ad819fa57c4a2dba
-
Filesize
1.6MB
MD5c02acd526baa4cd3c4916255dca7fad9
SHA15ebb8a8f8947f57588710cd8f98e7aba4fa3dd32
SHA25662896284fa29a60b33e8eb97810c64b0421b7889ea3ddde0648b803f684ee394
SHA51260898d2f131da7ff380e583ce071a4a3fd06ecb086a1410957e8a4ef905529ac8e7d74e008f3051980159e42d736ac5cebcd86287089061c0defd6cebb01c83a