Analysis
-
max time kernel
118s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 14:50
Behavioral task
behavioral1
Sample
exit-quiz-answers.pdf
Resource
win10v2004-20240704-en
Behavioral task
behavioral2
Sample
exit-quiz-questions.pdf
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
slide-deck.pptx
Resource
win10v2004-20240704-en
Behavioral task
behavioral4
Sample
worksheet-questions.pdf
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
worksheet-questions.pptx
Resource
win10v2004-20240704-en
General
-
Target
exit-quiz-answers.pdf
-
Size
390KB
-
MD5
bb206bd377698a15d94e3186bf5a7b99
-
SHA1
b4aafcdad0e3f5c5674f05a354594517898d264f
-
SHA256
68f8087b8e27a9428bfb94b2a4ec0f490d50cf2c79c7d943ffea722c63c1f6a7
-
SHA512
b22930db8fddecc3e06eeda754f2d614f85faec8d98878876fc233cffce7bde2944577d8208dcc164878402358edcb4cca1c89ffc486a67d294e5563978b8a54
-
SSDEEP
6144:2PIOtcY3dCCQjJMA668XG3uk0yi6dZQ77Ynb2kT4inkaqQwpyYNJyC7o4Z5:3EcY3dEiAX8XMc43Q7p6Ua/wnNJvo43
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3464 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3464 POWERPNT.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 2188 AcroRd32.exe 3464 POWERPNT.EXE 3464 POWERPNT.EXE 3464 POWERPNT.EXE 3464 POWERPNT.EXE 3464 POWERPNT.EXE 3464 POWERPNT.EXE 3464 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2872 2188 AcroRd32.exe 86 PID 2188 wrote to memory of 2872 2188 AcroRd32.exe 86 PID 2188 wrote to memory of 2872 2188 AcroRd32.exe 86 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 3084 2872 RdrCEF.exe 87 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 PID 2872 wrote to memory of 236 2872 RdrCEF.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\exit-quiz-answers.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=28B253D33451E194C3D5D1AD900A05A7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=28B253D33451E194C3D5D1AD900A05A7 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:13⤵PID:3084
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F7EB4AE93E996BF0704B1469BC0B140 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:236
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=16AEB83862503AA1DEE2F5B81DAB68BC --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1932
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F21D7743BD6DB2F24DFA56D9EB9AFE16 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F21D7743BD6DB2F24DFA56D9EB9AFE16 --renderer-client-id=5 --mojo-platform-channel-handle=2124 --allow-no-sandbox-job /prefetch:13⤵PID:1400
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A8E779775A56438DEE2DA02DA2F1567 --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2772
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=183B163629C01DC0E265CB5B428999B7 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3616
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2788
-
C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3464
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5028
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /p "C:\Users\Admin\Downloads\MergeBackup.odp"1⤵PID:1452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD596fdb75369d0dd5359584ed854f90fbc
SHA13fb054e3d13ace3971254e93824ea9c54222feff
SHA2566fb326f36df50f2ec68f4b925f71016ef4cf1e2920639e31805505f807c58d7e
SHA51235bf45e851c79519b58ff25c8e48cc2ddf0c365153cb8ea51a71e9232b0706c87ff1f893b27f4894ebc3627f8abd83ed315c118f591393c4e5a7cffd036fd176
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
76B
MD5e9ee9277b7f968e23ec57c8cc8545f23
SHA1b9611194de2c995f0ef55e3b97ed7ae6f8b0214e
SHA256b3235ec4ddecafb097825d004f8027d49f8de1e24bf1d8659a279ca0b5a9282f
SHA51278a4912fac517e8aabe7f390991a369ce096e111b04c0d386e4e5562b1cab9d27912896b942f144b66d0d4abd347e8950126539256382ca366cfc2bc101b7818