Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-09-2024 11:00
Static task
static1
Behavioral task
behavioral1
Sample
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
Resource
win10v2004-20240802-en
windows10-2004-x64
27 signatures
150 seconds
General
-
Target
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js
-
Size
63KB
-
MD5
a0ca7b2e74a0a3cf5a8962c1325024ae
-
SHA1
81a45727e33fe1a557069cd77c092b0d29f8aaff
-
SHA256
de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43
-
SHA512
4272161dc9ea7995eee14fe4ed76534e3ab959e8a60add820924414ce30e0ba655c9d3a5ffe32eab4d4c1012bf22e7a2549d2b59eb9025d81c5277076a23fa77
-
SSDEEP
1536:DgzzUIs6n3rc/G/zCSYCXyN6IknpNcpRP6bM:DgzzUIg+LCSYCX2inpNcj64
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 1 2104 wscript.exe -
Loads dropped DLL 1 IoCs
pid Process 1484 MsiExec.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 804 ICACLS.EXE 3036 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBDB4.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\f76bd08.msi msiexec.exe File created C:\Windows\Installer\f76bd09.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76bd08.msi msiexec.exe File opened for modification C:\Windows\Installer\f76bd09.ipi msiexec.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 1 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2168 msiexec.exe 2168 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 2168 msiexec.exe Token: SeTakeOwnershipPrivilege 2168 msiexec.exe Token: SeSecurityPrivilege 2168 msiexec.exe Token: SeCreateTokenPrivilege 2276 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2276 msiexec.exe Token: SeLockMemoryPrivilege 2276 msiexec.exe Token: SeIncreaseQuotaPrivilege 2276 msiexec.exe Token: SeMachineAccountPrivilege 2276 msiexec.exe Token: SeTcbPrivilege 2276 msiexec.exe Token: SeSecurityPrivilege 2276 msiexec.exe Token: SeTakeOwnershipPrivilege 2276 msiexec.exe Token: SeLoadDriverPrivilege 2276 msiexec.exe Token: SeSystemProfilePrivilege 2276 msiexec.exe Token: SeSystemtimePrivilege 2276 msiexec.exe Token: SeProfSingleProcessPrivilege 2276 msiexec.exe Token: SeIncBasePriorityPrivilege 2276 msiexec.exe Token: SeCreatePagefilePrivilege 2276 msiexec.exe Token: SeCreatePermanentPrivilege 2276 msiexec.exe Token: SeBackupPrivilege 2276 msiexec.exe Token: SeRestorePrivilege 2276 msiexec.exe Token: SeShutdownPrivilege 2276 msiexec.exe Token: SeDebugPrivilege 2276 msiexec.exe Token: SeAuditPrivilege 2276 msiexec.exe Token: SeSystemEnvironmentPrivilege 2276 msiexec.exe Token: SeChangeNotifyPrivilege 2276 msiexec.exe Token: SeRemoteShutdownPrivilege 2276 msiexec.exe Token: SeUndockPrivilege 2276 msiexec.exe Token: SeSyncAgentPrivilege 2276 msiexec.exe Token: SeEnableDelegationPrivilege 2276 msiexec.exe Token: SeManageVolumePrivilege 2276 msiexec.exe Token: SeImpersonatePrivilege 2276 msiexec.exe Token: SeCreateGlobalPrivilege 2276 msiexec.exe Token: SeBackupPrivilege 2156 vssvc.exe Token: SeRestorePrivilege 2156 vssvc.exe Token: SeAuditPrivilege 2156 vssvc.exe Token: SeBackupPrivilege 2168 msiexec.exe Token: SeRestorePrivilege 2168 msiexec.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2608 DrvInst.exe Token: SeLoadDriverPrivilege 2608 DrvInst.exe Token: SeLoadDriverPrivilege 2608 DrvInst.exe Token: SeLoadDriverPrivilege 2608 DrvInst.exe Token: SeRestorePrivilege 2168 msiexec.exe Token: SeTakeOwnershipPrivilege 2168 msiexec.exe Token: SeRestorePrivilege 2168 msiexec.exe Token: SeTakeOwnershipPrivilege 2168 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2276 msiexec.exe 2276 msiexec.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2276 2104 wscript.exe 30 PID 2104 wrote to memory of 2276 2104 wscript.exe 30 PID 2104 wrote to memory of 2276 2104 wscript.exe 30 PID 2104 wrote to memory of 2276 2104 wscript.exe 30 PID 2104 wrote to memory of 2276 2104 wscript.exe 30 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 2168 wrote to memory of 1484 2168 msiexec.exe 35 PID 1484 wrote to memory of 804 1484 MsiExec.exe 36 PID 1484 wrote to memory of 804 1484 MsiExec.exe 36 PID 1484 wrote to memory of 804 1484 MsiExec.exe 36 PID 1484 wrote to memory of 804 1484 MsiExec.exe 36 PID 1484 wrote to memory of 2892 1484 MsiExec.exe 38 PID 1484 wrote to memory of 2892 1484 MsiExec.exe 38 PID 1484 wrote to memory of 2892 1484 MsiExec.exe 38 PID 1484 wrote to memory of 2892 1484 MsiExec.exe 38 PID 1484 wrote to memory of 2148 1484 MsiExec.exe 40 PID 1484 wrote to memory of 2148 1484 MsiExec.exe 40 PID 1484 wrote to memory of 2148 1484 MsiExec.exe 40 PID 1484 wrote to memory of 2148 1484 MsiExec.exe 40 PID 1484 wrote to memory of 1156 1484 MsiExec.exe 43 PID 1484 wrote to memory of 1156 1484 MsiExec.exe 43 PID 1484 wrote to memory of 1156 1484 MsiExec.exe 43 PID 1484 wrote to memory of 1156 1484 MsiExec.exe 43 PID 1484 wrote to memory of 3036 1484 MsiExec.exe 45 PID 1484 wrote to memory of 3036 1484 MsiExec.exe 45 PID 1484 wrote to memory of 3036 1484 MsiExec.exe 45 PID 1484 wrote to memory of 3036 1484 MsiExec.exe 45 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\de8fb6c7ed0b575a5e05b191643751c1d0c89c542a34c00cfcdaf99a6de98f43.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\setup.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2276
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F8B286C94ECFE9C79651712EBBBADB272⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-19fd036f-057c-4ef1-bdeb-5d8cbb31cf6b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:804
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start msedge https://www.docusign.com/sites/default/files/Signature_Appliance_Client_Guide_8.0.pdf3⤵
- System Location Discovery: System Language Discovery
PID:2148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-19fd036f-057c-4ef1-bdeb-5d8cbb31cf6b\files"3⤵
- System Location Discovery: System Language Discovery
PID:1156
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-19fd036f-057c-4ef1-bdeb-5d8cbb31cf6b\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:3036
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D4" "00000000000004CC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5645763c0faf86b715dee6d1e6d50fd82
SHA1a6b466d5a71e3326d295ee7a2a2fc8c5bb79fd23
SHA25612e6b630509b37f2948ffb0f5719dd00dd5934e19aa8d9301247025c1c6d7a43
SHA512b98b9d1f43b8c011b54095756fb865b4781d1890b8842370ff26dcc992d8ac340ed97057011a165be9eea0620e68ca1d0960394ab51316f81721de5370ceb9d3
-
Filesize
380B
MD57abb1b1d0b922a3fc2319ba7190afa53
SHA1e011829a01fd2251eadbed2ad56c95c5aae0ab35
SHA256d13a7e9dcf7dc056aa25f22b36c4dbe1fc8a4d4a08b38015e8f30954673a9695
SHA512f3f84bb3507f2d388b35fd37ae5dfea26d6d51c068b319842b5a89f483082c4e270fd33502efe0ecaba1df1f2e2e6743f3062600336a06941e7f4d4e22c52c10
-
Filesize
1KB
MD57af956e9460473593b50d17ed1dce524
SHA114fafd60c2524a31d9ab15d98d529c9ac4d27972
SHA256ce852a19257a9e69c3744098b983d3e593ccba490d7832cec3406aca4df7a11f
SHA512eb19e566af90a0043712ecccda97108d62f6d43643361f3450e78af98b38f07e5d3442bbaebb5f94fbcc1d68589b62ce65ca4a85fff5bf03311ec1b3dd3a5085
-
Filesize
1KB
MD574cc572c6425fad0c7a755ec37dad33c
SHA158bbb8f33e917808e0ef4cd071c65e5033b57e18
SHA2569988031ea3f5278ca130ed67157b8c90b035c964f426aa6b09dd10c83d1e1ce0
SHA512d51c1ee2b8b58f06381f19caec73a0f76f0b173a6578ca63584040bd2d41f506cd86830b336bdde011304476a48c365556988e895bff61a74c224be3f6cc2833
-
Filesize
2.0MB
MD59bc2607944098921c27665592491abb8
SHA10721d8d7d6e667e291d71be03106c8087fa38d8f
SHA25639619645275a452099434559fc0663b26d10516c25e7a8c57e1311cdc26c8c80
SHA51236b7e281f96e71f401d2ab2ce80f808947889c18bd5585a3bf00db98c384d6c9da882db96d36b75eb2238b1edf8ea04323858758d7d721618d5f01252f465038
-
Filesize
208KB
MD50c8921bbcc37c6efd34faf44cf3b0cb5
SHA1dcfa71246157edcd09eecaf9d4c5e360b24b3e49
SHA256fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
SHA512ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108