Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 02:56
Behavioral task
behavioral1
Sample
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe
Resource
win10v2004-20240709-en
General
-
Target
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe
-
Size
3.3MB
-
MD5
af4cd8f5b99d7e371a6ddd880aec1079
-
SHA1
caba9083a0128266b477330c2e5d8874646a915d
-
SHA256
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec32903c15fd7576fcac20
-
SHA512
c0fbb42b516c4a83a3dbeab47199fb603330929788008a314c222ec1585845a40538cd2f2b18ace200436beeed2b7428fe23fd9e19bb2f5a3f48939ab93432ff
-
SSDEEP
98304:PbD91o0GWLMJo5sZB8MDJ2RZeeD+Gvl/ndA:PXbnGWLMTZyjnCg/i
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
reviewcommon.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Surrogatewebref\\System.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Surrogatewebref\\System.exe\", \"C:\\Users\\Admin\\3D Objects\\fontdrvhost.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Surrogatewebref\\System.exe\", \"C:\\Users\\Admin\\3D Objects\\fontdrvhost.exe\", \"C:\\Windows\\Resources\\Themes\\aero\\en-US\\sihost.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Surrogatewebref\\System.exe\", \"C:\\Users\\Admin\\3D Objects\\fontdrvhost.exe\", \"C:\\Windows\\Resources\\Themes\\aero\\en-US\\sihost.exe\", \"C:\\Windows\\Vss\\Writers\\System\\services.exe\"" reviewcommon.exe -
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1492 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4388 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5104 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 676 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4164 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4436 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4840 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 1752 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 1752 schtasks.exe -
Processes:
resource yara_rule C:\Surrogatewebref\reviewcommon.exe dcrat behavioral2/memory/1676-17-0x0000000000EE0000-0x00000000011EA000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 540 powershell.exe 2176 powershell.exe 4772 powershell.exe 3040 powershell.exe 3636 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exeWScript.exereviewcommon.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation reviewcommon.exe -
Executes dropped EXE 2 IoCs
Processes:
reviewcommon.exefontdrvhost.exepid process 1676 reviewcommon.exe 2912 fontdrvhost.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
reviewcommon.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\3D Objects\\fontdrvhost.exe\"" reviewcommon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Resources\\Themes\\aero\\en-US\\sihost.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\Resources\\Themes\\aero\\en-US\\sihost.exe\"" reviewcommon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Vss\\Writers\\System\\services.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Vss\\Writers\\System\\services.exe\"" reviewcommon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Surrogatewebref\\System.exe\"" reviewcommon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Surrogatewebref\\System.exe\"" reviewcommon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\3D Objects\\fontdrvhost.exe\"" reviewcommon.exe -
Drops file in Windows directory 4 IoCs
Processes:
reviewcommon.exedescription ioc process File created C:\Windows\Resources\Themes\aero\en-US\sihost.exe reviewcommon.exe File created C:\Windows\Resources\Themes\aero\en-US\66fc9ff0ee96c2 reviewcommon.exe File created C:\Windows\Vss\Writers\System\services.exe reviewcommon.exe File created C:\Windows\Vss\Writers\System\c5b4cb5e9653cc reviewcommon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4388 schtasks.exe 4444 schtasks.exe 2496 schtasks.exe 4840 schtasks.exe 1504 schtasks.exe 1492 schtasks.exe 5104 schtasks.exe 676 schtasks.exe 4164 schtasks.exe 4436 schtasks.exe 4764 schtasks.exe 3892 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
reviewcommon.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefontdrvhost.exepid process 1676 reviewcommon.exe 2176 powershell.exe 2176 powershell.exe 4772 powershell.exe 4772 powershell.exe 540 powershell.exe 540 powershell.exe 3040 powershell.exe 3040 powershell.exe 3636 powershell.exe 3636 powershell.exe 2176 powershell.exe 540 powershell.exe 3040 powershell.exe 4772 powershell.exe 3636 powershell.exe 2912 fontdrvhost.exe 2912 fontdrvhost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
reviewcommon.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefontdrvhost.exedescription pid process Token: SeDebugPrivilege 1676 reviewcommon.exe Token: SeDebugPrivilege 2176 powershell.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeDebugPrivilege 540 powershell.exe Token: SeDebugPrivilege 3040 powershell.exe Token: SeDebugPrivilege 3636 powershell.exe Token: SeDebugPrivilege 2912 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exeWScript.execmd.exereviewcommon.exedescription pid process target process PID 3424 wrote to memory of 3108 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3424 wrote to memory of 3108 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3424 wrote to memory of 3108 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3424 wrote to memory of 1104 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3424 wrote to memory of 1104 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3424 wrote to memory of 1104 3424 cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe WScript.exe PID 3108 wrote to memory of 4036 3108 WScript.exe cmd.exe PID 3108 wrote to memory of 4036 3108 WScript.exe cmd.exe PID 3108 wrote to memory of 4036 3108 WScript.exe cmd.exe PID 4036 wrote to memory of 1676 4036 cmd.exe reviewcommon.exe PID 4036 wrote to memory of 1676 4036 cmd.exe reviewcommon.exe PID 1676 wrote to memory of 3636 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 3636 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 540 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 540 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 2176 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 2176 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 4772 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 4772 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 3040 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 3040 1676 reviewcommon.exe powershell.exe PID 1676 wrote to memory of 2912 1676 reviewcommon.exe fontdrvhost.exe PID 1676 wrote to memory of 2912 1676 reviewcommon.exe fontdrvhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe"C:\Users\Admin\AppData\Local\Temp\cdb363f810ebeea6e40abc725c14e9bf78a3014559ec3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Surrogatewebref\0OThNUtq.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Surrogatewebref\W7CNC.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Surrogatewebref\reviewcommon.exe"C:\Surrogatewebref\reviewcommon.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogatewebref\reviewcommon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogatewebref\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\3D Objects\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Themes\aero\en-US\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Users\Admin\3D Objects\fontdrvhost.exe"C:\Users\Admin\3D Objects\fontdrvhost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Surrogatewebref\file.vbs"2⤵PID:1104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Surrogatewebref\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Surrogatewebref\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Surrogatewebref\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\3D Objects\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\3D Objects\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Themes\aero\en-US\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\aero\en-US\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Themes\aero\en-US\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\Writers\System\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197B
MD5013e4068fecbf70a6305a10f4baac7d0
SHA1113ac6511cb6965dc872d284552ea129e1e41973
SHA256f087215bae0916b3575743a62c0d6722e6e78623f8046a53f8914661b3c6a10e
SHA512f50fb4b24aa8846c94fba07e07b0f5e71b7c67b9843c34951eb4b4fbb7de8309d1441c16359621402659b3c4a406dccc93ea79056030f63adf8a359934cd3940
-
Filesize
37B
MD5b0d15fb085639d7d63a9556af4bdfced
SHA18a5498b0d47fbeae2c9452ceb8f413f4b1d3ac0b
SHA2562e7b9e10897a9224a935716fbefe4c362d8a09ef9176a8ed794741e7418521b5
SHA512d88ab6f23c8e08dd82443239451b84de849a967d08d20b84894e8cf134ad2789c2e9c9e92d6d1c3da0b9e3e0bcecd4a86d5b24fe167f4f6f8a3a5ad8f5b0e146
-
Filesize
34B
MD5677cc4360477c72cb0ce00406a949c61
SHA1b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA5127cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
-
Filesize
3.0MB
MD52691a48220ece165313a2096d4be7788
SHA1bb9d65345c7aae09cd340e8b2eae8e3a8ff45f96
SHA25620a6875053a9b02e3dca4c650b698f5eb0f22119b6d51317043c5953aab00a55
SHA51213c70c3a44aa67a29e066d6c7e283574d165fa2a1e6bfc4be992ff6fcfc9c1a126b97fd64f18dfbe4e5d27eae75e8b6e6325f3ae96871afb2aef006e6589023f
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82