Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe
Resource
win7-20240903-en
General
-
Target
f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe
-
Size
2.9MB
-
MD5
5f10f34b3ef012f1db5f21755cad4ab1
-
SHA1
439ab3bd92cd515b092607291ac054f3fad1359f
-
SHA256
f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660
-
SHA512
7f6473adb10d878b8c9cb9360c04ed843401d6eb69ca1df546e956e18032598cbdd1fffbdc45c0fe7d3927a6fa54ef77b9d2e10175e3ca15c6421cfa678d59ce
-
SSDEEP
49152:ZtH86NYYGclfMk3iDPS6wcXLuankPBUJCBuB+zVma85E4xTz:ZtH8SHGc5MWiDdj7uakPBUJ1oV0EkTz
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 8 IoCs
resource yara_rule behavioral2/memory/3172-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-79-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-80-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-78-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-77-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-76-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3172-81-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2520 powershell.exe 448 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe -
Executes dropped EXE 2 IoCs
pid Process 4908 prog.exe 1924 svhost.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1516 powercfg.exe 3632 powercfg.exe 4344 powercfg.exe 3532 powercfg.exe 2572 powercfg.exe 244 powercfg.exe 4952 powercfg.exe 4596 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe prog.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe svhost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1924 set thread context of 4304 1924 svhost.exe 146 PID 1924 set thread context of 3172 1924 svhost.exe 148 -
resource yara_rule behavioral2/memory/3172-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-79-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-80-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-78-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-77-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-76-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3172-81-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1456 sc.exe 184 sc.exe 2748 sc.exe 5064 sc.exe 1748 sc.exe 3836 sc.exe 3600 sc.exe 2192 sc.exe 1660 sc.exe 1172 sc.exe 4708 sc.exe 4608 sc.exe 5012 sc.exe 4684 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4908 prog.exe 2520 powershell.exe 2520 powershell.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 4908 prog.exe 1924 svhost.exe 448 powershell.exe 448 powershell.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 1924 svhost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe 3172 svchost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 4908 prog.exe Token: SeShutdownPrivilege 4952 powercfg.exe Token: SeCreatePagefilePrivilege 4952 powercfg.exe Token: SeShutdownPrivilege 4596 powercfg.exe Token: SeCreatePagefilePrivilege 4596 powercfg.exe Token: SeShutdownPrivilege 244 powercfg.exe Token: SeCreatePagefilePrivilege 244 powercfg.exe Token: SeShutdownPrivilege 2572 powercfg.exe Token: SeCreatePagefilePrivilege 2572 powercfg.exe Token: SeDebugPrivilege 448 powershell.exe Token: SeDebugPrivilege 1924 svhost.exe Token: SeLockMemoryPrivilege 3172 svchost.exe Token: SeShutdownPrivilege 4344 powercfg.exe Token: SeCreatePagefilePrivilege 4344 powercfg.exe Token: SeShutdownPrivilege 1516 powercfg.exe Token: SeCreatePagefilePrivilege 1516 powercfg.exe Token: SeShutdownPrivilege 3532 powercfg.exe Token: SeCreatePagefilePrivilege 3532 powercfg.exe Token: SeShutdownPrivilege 3632 powercfg.exe Token: SeCreatePagefilePrivilege 3632 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4908 4556 f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe 91 PID 4556 wrote to memory of 4908 4556 f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe 91 PID 1004 wrote to memory of 3756 1004 cmd.exe 100 PID 1004 wrote to memory of 3756 1004 cmd.exe 100 PID 620 wrote to memory of 4264 620 cmd.exe 134 PID 620 wrote to memory of 4264 620 cmd.exe 134 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 4304 1924 svhost.exe 146 PID 1924 wrote to memory of 3172 1924 svhost.exe 148 PID 1924 wrote to memory of 3172 1924 svhost.exe 148 PID 1924 wrote to memory of 3172 1924 svhost.exe 148 PID 1924 wrote to memory of 3172 1924 svhost.exe 148 PID 1924 wrote to memory of 3172 1924 svhost.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe"C:\Users\Admin\AppData\Local\Temp\f161b56490087b75b15207598c6e0526afd184e3f8e76ab6eff8eaa6f573b660.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\prog.exe"C:\Users\Admin\AppData\Local\Temp\prog.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:3756
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1456
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4608
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:1748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:5012
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:3836
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "appdata"3⤵
- Launches sc.exe
PID:184
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "appdata" binpath= "C:\ProgramData\win32\svhost.exe" start= "auto"3⤵
- Launches sc.exe
PID:2748
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:3600
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "appdata"3⤵
- Launches sc.exe
PID:1660
-
-
-
C:\ProgramData\win32\svhost.exeC:\ProgramData\win32\svhost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4264
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:1172
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:5064
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4684
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2192
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:4708
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4304
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.5MB
MD5d3adc3ec7b76556b7fac591c33f31ea9
SHA1b7295fae70f550aa2963da196b08636094e26e93
SHA25625231ba6616c0c1bbc4dda82bdd46ad067577e16971bae412b1192b250b456dc
SHA5120edd9263191b82e525da655f76597bbd755174e8436e1e3a783a6a7f7064077e651a7d4dd36b3fd1b353bc435ff9d3ade466d43327ba086dee89b712cab73985