Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
MicrosoftEdge.msi
Resource
win7-20240708-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
MicrosoftEdge.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
MicrosoftEdge.msi
-
Size
436KB
-
MD5
6ff3f0a2f7f1ec8a71bed37496e2e6fa
-
SHA1
66a0ba30d846d65bd91b716e1226b15be42958ff
-
SHA256
455163bfa49326fb7787af85cb0decc84100533da38bbdcbf06b2bdb6f7f521a
-
SHA512
41641ec872adb885d483a8b229065caf860bde933f7883b158ad47ab0bdddd1a2e92c3d5cf9e7d6161fb251b0020467e5b4db8855fdaa202f0132c658267a2b2
-
SSDEEP
6144:etO9iRQYpgjpjew5DHyGxcqo8Cs+QVAnjOl4ieipV8VTGUpHN7UjjIU5ei:etVRQ+gjpjegDro8s48yee8VzHigUc
Malware Config
Signatures
-
Detects RPCBackdoor 1 IoCs
resource yara_rule behavioral1/files/0x0006000000016c88-74.dat family_rpcbackdoor -
RPCBackdoor
RPCBackdoor is written in C++ and first seen in 2021.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MicrosoftEdge.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 776 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76d9ac.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDAD5.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\f76d9ac.msi msiexec.exe File created C:\Windows\Installer\f76d9ad.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 2684 MicrosoftEdge.exe -
Loads dropped DLL 6 IoCs
pid Process 2628 MsiExec.exe 2628 MsiExec.exe 2628 MsiExec.exe 2628 MsiExec.exe 2628 MsiExec.exe 2684 MicrosoftEdge.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2140 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 MicrosoftEdge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier MicrosoftEdge.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS MicrosoftEdge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVENDOR MicrosoftEdge.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 112 msiexec.exe 112 msiexec.exe 2684 MicrosoftEdge.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2140 msiexec.exe Token: SeIncreaseQuotaPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeSecurityPrivilege 112 msiexec.exe Token: SeCreateTokenPrivilege 2140 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2140 msiexec.exe Token: SeLockMemoryPrivilege 2140 msiexec.exe Token: SeIncreaseQuotaPrivilege 2140 msiexec.exe Token: SeMachineAccountPrivilege 2140 msiexec.exe Token: SeTcbPrivilege 2140 msiexec.exe Token: SeSecurityPrivilege 2140 msiexec.exe Token: SeTakeOwnershipPrivilege 2140 msiexec.exe Token: SeLoadDriverPrivilege 2140 msiexec.exe Token: SeSystemProfilePrivilege 2140 msiexec.exe Token: SeSystemtimePrivilege 2140 msiexec.exe Token: SeProfSingleProcessPrivilege 2140 msiexec.exe Token: SeIncBasePriorityPrivilege 2140 msiexec.exe Token: SeCreatePagefilePrivilege 2140 msiexec.exe Token: SeCreatePermanentPrivilege 2140 msiexec.exe Token: SeBackupPrivilege 2140 msiexec.exe Token: SeRestorePrivilege 2140 msiexec.exe Token: SeShutdownPrivilege 2140 msiexec.exe Token: SeDebugPrivilege 2140 msiexec.exe Token: SeAuditPrivilege 2140 msiexec.exe Token: SeSystemEnvironmentPrivilege 2140 msiexec.exe Token: SeChangeNotifyPrivilege 2140 msiexec.exe Token: SeRemoteShutdownPrivilege 2140 msiexec.exe Token: SeUndockPrivilege 2140 msiexec.exe Token: SeSyncAgentPrivilege 2140 msiexec.exe Token: SeEnableDelegationPrivilege 2140 msiexec.exe Token: SeManageVolumePrivilege 2140 msiexec.exe Token: SeImpersonatePrivilege 2140 msiexec.exe Token: SeCreateGlobalPrivilege 2140 msiexec.exe Token: SeBackupPrivilege 536 vssvc.exe Token: SeRestorePrivilege 536 vssvc.exe Token: SeAuditPrivilege 536 vssvc.exe Token: SeBackupPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 2828 DrvInst.exe Token: SeLoadDriverPrivilege 2828 DrvInst.exe Token: SeLoadDriverPrivilege 2828 DrvInst.exe Token: SeLoadDriverPrivilege 2828 DrvInst.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe Token: SeRestorePrivilege 112 msiexec.exe Token: SeTakeOwnershipPrivilege 112 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2140 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 112 wrote to memory of 2628 112 msiexec.exe 35 PID 2628 wrote to memory of 776 2628 MsiExec.exe 36 PID 2628 wrote to memory of 776 2628 MsiExec.exe 36 PID 2628 wrote to memory of 776 2628 MsiExec.exe 36 PID 2628 wrote to memory of 776 2628 MsiExec.exe 36 PID 2628 wrote to memory of 1528 2628 MsiExec.exe 38 PID 2628 wrote to memory of 1528 2628 MsiExec.exe 38 PID 2628 wrote to memory of 1528 2628 MsiExec.exe 38 PID 2628 wrote to memory of 1528 2628 MsiExec.exe 38 PID 2628 wrote to memory of 2684 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2684 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2684 2628 MsiExec.exe 40 PID 2628 wrote to memory of 2684 2628 MsiExec.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MicrosoftEdge.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2140
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B63C156EDC5951E934963271A474E3882⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-57c8231a-51ff-415a-915e-ca935f8129d6\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:776
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\MW-57c8231a-51ff-415a-915e-ca935f8129d6\files\MicrosoftEdge.exe"C:\Users\Admin\AppData\Local\Temp\MW-57c8231a-51ff-415a-915e-ca935f8129d6\files\MicrosoftEdge.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2684
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:536
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A4" "00000000000003C8"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD5ea5e9cf992aa209fe006fb7ca4195b1c
SHA1270447b93d176e7f920a062a7a08eb7947c36163
SHA256cc50776e1e460cbe8f2d9ea083ccc273c79cdeefeef60c04946d759d1d0eb77d
SHA5120210453862c89a4f8e5d03f69bed3cd01a296bd3da31e200b2aefcc089734bdcd7720710643a8e4f58c150c55bced83bef05340c180e1d9ff303736fe11208fa
-
Filesize
147KB
MD5fc860959580c124e7e4781bb08437681
SHA1b551dd88a1d3d5f277dc174f5d9d11eeea0dafb0
SHA256eca127142a480fe51e7748159c8d219313a4730d60dc22c4dbbc1bd4d6a67b66
SHA512abab3d964d5e7b1bdf365a429cbc5b48614f4fb64281d5c0a4b0ce0ab3580fa539ca0f33bc4243dbbe5c6649fa0ce1a2a89de12725a78971001cd768aeb075d2
-
Filesize
279KB
MD5b1a8d000b6a66f272a5859c405c894b0
SHA167cd211ad46cf072ddf210631989713e52336789
SHA256c8b93075675b6b90cc5a2f58bdd1c52088a511485efd2f9bb6de54c9736e98e5
SHA5122dcd268e0840febd7eb3e06bc099c29ff3838b5e75cf0b0f21e65e246bb2be8e2508632488a3804dc0d5f4b2456bdf97fb815eadab9641e34fe62a937de9b94b
-
Filesize
1KB
MD592448a12f3fab1fd2c6743230123e9b3
SHA1fde4733afb5c9a64292be7adad688178d4e7b17d
SHA25651172549656bddc5acdf0c8269df960e8d0d12422fb5d6ae2ba69849e6a4a683
SHA5121c37574e4fb39a4320519e23c58bdae427d4352dd7a63d07b21065f759176323209327ab460497f41a0e3232d8a40db3b45828ea09a10c37b88f1caecef891b8
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108