Analysis
-
max time kernel
94s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
248125461f3e13564def00bdb94f7c30N.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
248125461f3e13564def00bdb94f7c30N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
248125461f3e13564def00bdb94f7c30N.exe
-
Size
492KB
-
MD5
248125461f3e13564def00bdb94f7c30
-
SHA1
a1522ca73407c91f09e2075e5b0585331fb5889a
-
SHA256
1ba6e527b4edce30ac6bf00050950fb2f59d392971dbd764be39e70d045de2e8
-
SHA512
459281cccba0a13110c9a630172159d58d44a0c21cb0fe1e877f9a4788c873f85499e43e152cbed1b20738abf576771f559ceadcd96e58a09c6c4c83e88d4f8b
-
SSDEEP
6144:VwkhMv87Q9EFEc8FaSgbHtBxVRvYV7zL1uSb6VWi8FBo95qIGK3q0FtZyFPp4jWA:pPil6vRvYlzL1uSz/W5GC
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\gfiark.sys MsiExec.exe File opened for modification C:\Windows\system32\drivers\sbapifs.sys MsiExec.exe File opened for modification C:\Windows\system32\drivers\sbaphd.sys MsiExec.exe File opened for modification C:\Windows\system32\drivers\SBREDrv.sys MsiExec.exe -
Loads dropped DLL 1 IoCs
pid Process 4920 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\R: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\W: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\V: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\N: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\P: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\S: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\Y: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\Z: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\O: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\U: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\I: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\T: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\X: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\B: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\E: 248125461f3e13564def00bdb94f7c30N.exe File opened (read-only) \??\H: 248125461f3e13564def00bdb94f7c30N.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\SBBD.EXE MsiExec.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248125461f3e13564def00bdb94f7c30N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 248125461f3e13564def00bdb94f7c30N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 248125461f3e13564def00bdb94f7c30N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 248125461f3e13564def00bdb94f7c30N.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeShutdownPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeIncreaseQuotaPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSecurityPrivilege 924 msiexec.exe Token: SeCreateTokenPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeAssignPrimaryTokenPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeLockMemoryPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeIncreaseQuotaPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeMachineAccountPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeTcbPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSecurityPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeTakeOwnershipPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeLoadDriverPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemProfilePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemtimePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeProfSingleProcessPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeIncBasePriorityPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreatePagefilePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreatePermanentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeBackupPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeRestorePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeShutdownPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeAuditPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemEnvironmentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeChangeNotifyPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeRemoteShutdownPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeUndockPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSyncAgentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeEnableDelegationPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeManageVolumePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeImpersonatePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreateGlobalPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreateTokenPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeAssignPrimaryTokenPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeLockMemoryPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeIncreaseQuotaPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeMachineAccountPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeTcbPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSecurityPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeTakeOwnershipPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeLoadDriverPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemProfilePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemtimePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeProfSingleProcessPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeIncBasePriorityPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreatePagefilePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeCreatePermanentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeBackupPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeRestorePrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeShutdownPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeDebugPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeAuditPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSystemEnvironmentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeChangeNotifyPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeRemoteShutdownPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeUndockPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe Token: SeSyncAgentPrivilege 3664 248125461f3e13564def00bdb94f7c30N.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3664 248125461f3e13564def00bdb94f7c30N.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe 3664 248125461f3e13564def00bdb94f7c30N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 924 wrote to memory of 4920 924 msiexec.exe 96 PID 924 wrote to memory of 4920 924 msiexec.exe 96 PID 924 wrote to memory of 4920 924 msiexec.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\248125461f3e13564def00bdb94f7c30N.exe"C:\Users\Admin\AppData\Local\Temp\248125461f3e13564def00bdb94f7c30N.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3664
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AA8FE1BCC6AF675968623DCDC7FBAC62 C2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5648212691fa53c7ee0896fcca371475e
SHA1c06638826dac66a8d9f3cad52c63f17865dcec81
SHA256d9c8a2cce149c40fb0414eb9268f7b23b18b2e89f982ed5fa913943df98d9898
SHA512fac1225e92e559eec7282d3183ea92df1094c55ddd598f6539cbac4a204f1988dde25272b56e9b836e861f2fcbc35a8a9d7963fcb7bdf172699960e81936aeb9
-
Filesize
31.1MB
MD5f2e40c8c6e1f8dc969a6ab537fa103dd
SHA1e566f158983e49db6482a14cc394d57d38470fc2
SHA256340503d914ce04f85d6a3f5ced3a85153f4be79f03aebe5a1dcea22276eb5c1d
SHA512012368089b6ada966fbe1b194cb468089314c2f227415de439c94098105bc848920ad3d5d2ee2eb0cdf1475921640ed79405d4727ab1a92652ae4d67f6b5d1ce