Analysis
-
max time kernel
80s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 06:12
Static task
static1
Behavioral task
behavioral1
Sample
6dc517f58f112adcdd3cfae606a67964.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
6dc517f58f112adcdd3cfae606a67964.exe
Resource
win10v2004-20241007-en
General
-
Target
6dc517f58f112adcdd3cfae606a67964.exe
-
Size
6.2MB
-
MD5
6dc517f58f112adcdd3cfae606a67964
-
SHA1
b59f74642e963111027613ce0206ca77aec06fda
-
SHA256
2a559ce1ff609781226319d7f57d6c8cf32487bd87bb796ea43ee015aa104a73
-
SHA512
6f04ac98d9ea1eb203d2b93e9ff9f02a26b2ff61a4afc61b47f5d7f6260a80bc085fbc24c97c43407651c231156f468d4fe00cb152e64c6be948fed6b19f4ed8
-
SSDEEP
98304:cTiMEvjmzKewwsZ2XoCx7fR+Q6VCKrUk:iiMEaI24C1UQszrU
Malware Config
Extracted
vidar
https://t.me/asg7rd
https://steamcommunity.com/profiles/76561199794498376
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6
Signatures
-
Detect Vidar Stealer 7 IoCs
resource yara_rule behavioral1/memory/1436-2-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-1-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-5-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-144-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-163-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-241-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 behavioral1/memory/1436-260-0x0000000000400000-0x0000000000700000-memory.dmp family_vidar_v7 -
Vidar family
-
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1176 chrome.exe 1488 chrome.exe 1988 chrome.exe 1864 chrome.exe -
Loads dropped DLL 1 IoCs
pid Process 1436 BitLockerToGo.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1988 set thread context of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6dc517f58f112adcdd3cfae606a67964.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BitLockerToGo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BitLockerToGo.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1436 BitLockerToGo.exe 1436 BitLockerToGo.exe 1176 chrome.exe 1176 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe Token: SeShutdownPrivilege 1176 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe 1176 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1988 wrote to memory of 1436 1988 6dc517f58f112adcdd3cfae606a67964.exe 31 PID 1436 wrote to memory of 1176 1436 BitLockerToGo.exe 34 PID 1436 wrote to memory of 1176 1436 BitLockerToGo.exe 34 PID 1436 wrote to memory of 1176 1436 BitLockerToGo.exe 34 PID 1436 wrote to memory of 1176 1436 BitLockerToGo.exe 34 PID 1176 wrote to memory of 1780 1176 chrome.exe 35 PID 1176 wrote to memory of 1780 1176 chrome.exe 35 PID 1176 wrote to memory of 1780 1176 chrome.exe 35 PID 1176 wrote to memory of 824 1176 chrome.exe 36 PID 1176 wrote to memory of 824 1176 chrome.exe 36 PID 1176 wrote to memory of 824 1176 chrome.exe 36 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 324 1176 chrome.exe 37 PID 1176 wrote to memory of 596 1176 chrome.exe 38 PID 1176 wrote to memory of 596 1176 chrome.exe 38 PID 1176 wrote to memory of 596 1176 chrome.exe 38 PID 1176 wrote to memory of 1188 1176 chrome.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\6dc517f58f112adcdd3cfae606a67964.exe"C:\Users\Admin\AppData\Local\Temp\6dc517f58f112adcdd3cfae606a67964.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"3⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef60a9758,0x7fef60a9768,0x7fef60a97784⤵PID:1780
-
-
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:24⤵PID:324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:84⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:84⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1440 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:24⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1348 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:14⤵
- Uses browser remote debugging
PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:84⤵PID:1180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3648 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:84⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=976,i,13973202045101059019,329928733851985474,131072 /prefetch:84⤵PID:2680
-
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD52d728129ae694e1d1c2c9119ca79d9f6
SHA1aebf22a57261967e72f58404ca411571b4c209d4
SHA256f47424294b1380148f4eba02242f72ef86f8630653f6a2264c521eb3cb1afe45
SHA512530e910ff450f1db0ece3e91c2b49b5ed2a3bcb794ff68e75801487ed7dd91e3a0e1203b76bc79444cb0bce4e009e6404367d784cfe7c7d123ba02f716c7b620
-
Filesize
5KB
MD53eefe701b6d331064bcf75d7bafb93e9
SHA1e49e9732335a54523d2ccd50e5ed427419d36522
SHA2564d29350c2c6d41508d680b5d996f0ad1fa8fe75c5d405e40cdb418d1810005ca
SHA5120cc1eeca34af72b915b7339119cd74ae08715948102ae90461ab2529f54efb540393a21ae8d97dd8df4edff8b26291de1aa8ddfb1804f0d1cd644953dcdcf85a
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85