Resubmissions
26/09/2024, 03:06
240926-dlyc2atfqp 919/09/2024, 03:30
240919-d2hyaayfqk 919/09/2024, 03:22
240919-dwwl7ayble 919/09/2024, 03:15
240919-drxnpaxhpa 919/09/2024, 03:14
240919-drgbpsxhmf 918/09/2024, 21:46
240918-1mv1mavcje 9Analysis
-
max time kernel
13s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:14
Behavioral task
behavioral1
Sample
183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe
-
Size
581KB
-
MD5
8b70ba0f3b9818b5e2909e370254ea48
-
SHA1
56ffda57fd9161b441f0715d848cbcc0c0ccf5bf
-
SHA256
183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b
-
SHA512
53e8a9319f9cb58b2de4069c8a579cb0ad49408ba93f052d58eb5fb7e8996953fb8569babf5b6853f89d054309c457162277a360947972e9e4e8f0ec67f0cb28
-
SSDEEP
12288:N9C7oO/76BYSuTDqymSutZLcTra3qxsOeNMzrTKcJmVcgrdC:N94DmSuteagsUzXJmmgrdC
Score
9/10
Malware Config
Signatures
-
Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Loads dropped DLL 1 IoCs
pid Process 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x0000000000676000-memory.dmp upx behavioral1/memory/2512-349-0x0000000000400000-0x0000000000676000-memory.dmp upx behavioral1/memory/2512-362-0x0000000000400000-0x0000000000676000-memory.dmp upx -
Drops desktop.ini file(s) 6 IoCs
description ioc Process File created C:\Users\Admin\Favorites\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Users\Admin\Desktop\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Users\Admin\Documents\desktop.ini 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\MAGNETOB.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\AGENCYB.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ARLRDBD.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\cga40866.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\constan.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\LSANSD.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\calibri.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\comic.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\daunpenh.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\Gabriola.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\cga80737.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ELEPHNT.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\FRADM.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\8514oemg.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BOD_BLAI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BOD_CBI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BOD_CR.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\ega80869.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ERASLGHT.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\angsaub.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BKANT.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BRUSHSCI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\consola.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\himalaya.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\KhmerUIb.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BELL.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BSSYM7.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\CALIFB.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\FREESCPT.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\GOUDOSB.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\LBRITEI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\Candarai.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\cga80866.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\dos869.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\gautamib.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\cga40850.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\ebrimabd.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\GOUDYSTO.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\l_10646.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\8514oem.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\app852.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ARIALN.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\BOOKOSI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\GLECB.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\GOTHIC.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\meiryo.ttc 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\85f1257.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\angsaui.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\ega40869.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\ega80852.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\cga80852.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\kokilabi.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\LTYPEO.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\MISTRAL.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\8514fixe.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\8514sysg.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ALGER.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\Candara.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\courfg.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\estre.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\j8514oem.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\kalingab.ttf 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File created C:\Windows\Fonts\app932.fon 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe File opened for modification C:\Windows\Fonts\ARIALNBI.TTF 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 576 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 31 PID 2512 wrote to memory of 576 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 31 PID 2512 wrote to memory of 576 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 31 PID 2512 wrote to memory of 576 2512 183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe"C:\Users\Admin\AppData\Local\Temp\183cd5f034f18b0a5ed3a56f0b058da06b992c024c01f514326768ac9688747b.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe2⤵
- System Location Discovery: System Language Discovery
PID:576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD56bf1d5d255a107cb4fab6303374a8d1d
SHA1cda293fdd257127f2378a7925a92ba0bfe70ee26
SHA256f154681d0474568b2a63ff34688c9f973b916de6616b13b80214d2059260cc9a
SHA51276c472d5062423902f42f14c34de54ded76f0b208ca4f2992776144c038bdc2dabbaddf6ce29c5ec319f5b72d7da4bd95279b157a0405b6d752ea462c7255f16
-
Filesize
91KB
MD5e473f639723972758004181c216e7654
SHA1b99232cdee41a86599861a882d8a92c71509f803
SHA256df96be89403fed5ca5fc815dca978c85a03064e24ccf9df15df1c99cc8aa491e
SHA51210b1a515850e24ddfe3aa389f40bded1552f2525179b350b58cc057342d6ef97b5a764a74643ea5afbd25608f524661c93d1e204689a05a7a4567b5f308a656a
