Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 01:51
Static task
static1
Behavioral task
behavioral1
Sample
c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe
Resource
win7-20240419-en
General
-
Target
c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe
-
Size
2.8MB
-
MD5
c313d79bb52d3dc1a0fdd298a6c47810
-
SHA1
0acb3c5b6a6bd568656c7dc9f2bebaf0ea01207a
-
SHA256
c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71
-
SHA512
c937b08e72578c71d79387dbb625436e7381b784a8a3977a50cc758de8badfc57e8c566db135aa1e6f1ea01b682c4675302ee25c4f74e60238ca2c4714834a08
-
SSDEEP
49152:VIf2lo986T2njmZHDIkduvYcg9/YyCBGQPDK2z3fANo7+VnAeRq8HBaegPzcxCnG:VIKdiZvdPf2DGQ7L3gR7HBaegPzcxCnG
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-67-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-69-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-68-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-72-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-76-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-75-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-74-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-73-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-70-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-66-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-65-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-77-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/1684-78-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-76-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-75-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-77-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/1684-78-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1644 powershell.exe 2180 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 5 IoCs
Processes:
123.exesvhost.exe4.exegfqyepapamry.exepid process 2648 123.exe 2700 svhost.exe 2788 4.exe 476 2228 gfqyepapamry.exe -
Loads dropped DLL 11 IoCs
Processes:
c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exepid process 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 476 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1684-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-76-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-75-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-77-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/1684-78-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
Processes:
powershell.exe123.exepowershell.exegfqyepapamry.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe 123.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe gfqyepapamry.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
gfqyepapamry.exedescription pid process target process PID 2228 set thread context of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 set thread context of 1684 2228 gfqyepapamry.exe svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
wusa.exewusa.exedescription ioc process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1348 sc.exe 1936 sc.exe 896 sc.exe 292 sc.exe 1624 sc.exe 852 sc.exe 2240 sc.exe 584 sc.exe 3048 sc.exe 3056 sc.exe 572 sc.exe 1512 sc.exe 1492 sc.exe 2292 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b08a65c921b6da01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4.exe123.exepowershell.exegfqyepapamry.exepowershell.exesvchost.exepid process 2788 4.exe 2648 123.exe 1644 powershell.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2648 123.exe 2228 gfqyepapamry.exe 2180 powershell.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 2228 gfqyepapamry.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
4.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeDebugPrivilege 2788 4.exe Token: SeBackupPrivilege 2788 4.exe Token: SeSecurityPrivilege 2788 4.exe Token: SeSecurityPrivilege 2788 4.exe Token: SeSecurityPrivilege 2788 4.exe Token: SeSecurityPrivilege 2788 4.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeShutdownPrivilege 2952 powercfg.exe Token: SeShutdownPrivilege 2880 powercfg.exe Token: SeShutdownPrivilege 2944 powercfg.exe Token: SeShutdownPrivilege 2748 powercfg.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeShutdownPrivilege 1148 powercfg.exe Token: SeShutdownPrivilege 2152 powercfg.exe Token: SeShutdownPrivilege 1632 powercfg.exe Token: SeShutdownPrivilege 2196 powercfg.exe Token: SeLockMemoryPrivilege 1684 svchost.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.execmd.execmd.exegfqyepapamry.exedescription pid process target process PID 2044 wrote to memory of 2648 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 123.exe PID 2044 wrote to memory of 2648 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 123.exe PID 2044 wrote to memory of 2648 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 123.exe PID 2044 wrote to memory of 2648 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 123.exe PID 2044 wrote to memory of 2700 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe svhost.exe PID 2044 wrote to memory of 2700 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe svhost.exe PID 2044 wrote to memory of 2700 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe svhost.exe PID 2044 wrote to memory of 2700 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe svhost.exe PID 2044 wrote to memory of 2788 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 4.exe PID 2044 wrote to memory of 2788 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 4.exe PID 2044 wrote to memory of 2788 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 4.exe PID 2044 wrote to memory of 2788 2044 c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe 4.exe PID 2864 wrote to memory of 1500 2864 cmd.exe wusa.exe PID 2864 wrote to memory of 1500 2864 cmd.exe wusa.exe PID 2864 wrote to memory of 1500 2864 cmd.exe wusa.exe PID 272 wrote to memory of 608 272 cmd.exe wusa.exe PID 272 wrote to memory of 608 272 cmd.exe wusa.exe PID 272 wrote to memory of 608 272 cmd.exe wusa.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 2584 2228 gfqyepapamry.exe conhost.exe PID 2228 wrote to memory of 1684 2228 gfqyepapamry.exe svchost.exe PID 2228 wrote to memory of 1684 2228 gfqyepapamry.exe svchost.exe PID 2228 wrote to memory of 1684 2228 gfqyepapamry.exe svchost.exe PID 2228 wrote to memory of 1684 2228 gfqyepapamry.exe svchost.exe PID 2228 wrote to memory of 1684 2228 gfqyepapamry.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe"C:\Users\Admin\AppData\Local\Temp\c54eb244078dcaf2472c85bcce337b152dc24154d6a03004a29e4f4069d49d71.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Roaming\123.exe"C:\Users\Admin\AppData\Roaming\123.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
- Drops file in Windows directory
PID:1500
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1624
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:1492
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:852
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:2292
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:1936
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "NUOIJWEW"3⤵
- Launches sc.exe
PID:2240
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "NUOIJWEW" binpath= "C:\ProgramData\rpsbjgoyhvql\gfqyepapamry.exe" start= "auto"3⤵
- Launches sc.exe
PID:584
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:3056
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "NUOIJWEW"3⤵
- Launches sc.exe
PID:3048
-
-
-
C:\Users\Admin\AppData\Roaming\svhost.exe"C:\Users\Admin\AppData\Roaming\svhost.exe"2⤵
- Executes dropped EXE
PID:2700
-
-
C:\Users\Admin\AppData\Roaming\4.exe"C:\Users\Admin\AppData\Roaming\4.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\ProgramData\rpsbjgoyhvql\gfqyepapamry.exeC:\ProgramData\rpsbjgoyhvql\gfqyepapamry.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
PID:608
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1512
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1348
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:292
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:896
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:572
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:2584
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538KB
MD5970679178944f2f1ab74d9fc317817b7
SHA100a14dcaa09462c29b210e0149e7945d87b88c1e
SHA2567061f3d97ac28687798831bc212a42f0d58bdf6e8a2d15646314f1ba3575d33c
SHA512049b8f16e8b3027ddd157dd35b7082f24263233d2ddc781378593725c1d096c6434bd84e6126a1ced1d7d581fdebd99d76df9cd0aa8fb96108fba17a2671e615
-
Filesize
2.5MB
MD5b0601c9443dd3b7a6b02ee764791c9ad
SHA18ed01f29022ce752408bae7ff961edc06872413a
SHA25652c8c92f79183a354c5ee59653426b0f97209c37eec39fe5077ef43666eaf8a1
SHA512130dac47eb656f37f0a0df20c193768590788279e785fda9d7a92717cecaae9cb57c4a4740060265e83154c9d853bb952da1a2af0d1a9fb355b1da0aaa8b9a9c
-
Filesize
530KB
MD590212c985d978d490e394a941976c5ee
SHA131f546d1390e53760515482ecd719b6b008aca91
SHA256ce51ed0339a350243bc1576fcfa76e1b589908055f24123c9816f0dc8bf8c22a
SHA51218476b006e5fd5f620215d245b02bb069eefe9fe1a4691a3476a17733a8f2b240e58961b6ce162cf16aa274d5507a634b486ff620ae0787af4e21e9163baf64f