Analysis
-
max time kernel
69s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe
-
Size
247KB
-
MD5
ea039a854d20d7734c5add48f1a51c34
-
SHA1
9615dca4c0e46b8a39de5428af7db060399230b2
-
SHA256
69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169
-
SHA512
6718e54a59b91537c41ac913f9d8d6ad97b08cf6a61a4d174458738579a33471ef357173fd9eb4d4c9652ed2bf86c41f6da3cdd20fd7af643cd9f5ee6c9e30d5
-
SSDEEP
6144:Tz/LBBTHT+7oEf2ZstxQMSGToLoOhD2saLsW8fsmFBkObjD:PLBdy7FpQMlToThD+sW8fsmP7bj
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Process not Found -
Modifies security service 2 TTPs 22 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" Process not Found -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\etadpug\ImagePath = "\"C:\\Program Files (x86)\\Google\\Desktop\\Install\\{568593a3-ddda-e9c8-c724-dfe7808f99db}\\ \\...\\\u202eﯹ๛\\{568593a3-ddda-e9c8-c724-dfe7808f99db}\\GoogleUpdate.exe\" <" 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe -
Deletes itself 1 IoCs
pid Process 1548 cmd.exe -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{568593a3-ddda-e9c8-c724-dfe7808f99db}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{568593a3-ddda-e9c8-c724-dfe7808f99db}\\GoogleUpdate.exe\" >" 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini Process not Found File created \systemroot\assembly\GAC_32\Desktop.ini Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1968 set thread context of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30 -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\en-US:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File created C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\@ 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\@ Process not Found File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\de-DE:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File created C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\GoogleUpdate.exe 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
NTFS ADS 19 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\de-DE:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\en-US:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 472 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeRestorePrivilege 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Token: SeDebugPrivilege 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Token: SeDebugPrivilege 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Token: SeRestorePrivilege 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeBackupPrivilege 472 Process not Found Token: SeRestorePrivilege 472 Process not Found Token: SeSecurityPrivilege 472 Process not Found Token: SeTakeOwnershipPrivilege 472 Process not Found Token: SeDebugPrivilege 472 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1244 Process not Found 1244 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1244 Process not Found 1244 Process not Found -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30 PID 1968 wrote to memory of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30 PID 1968 wrote to memory of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30 PID 1968 wrote to memory of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30 PID 1968 wrote to memory of 1548 1968 69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe"C:\Users\Admin\AppData\Local\Temp\69e966e730557fde8fd84317cdef1ece00a8bb3470c0b58f3231e170168af169.exe"1⤵
- Modifies security service
- Sets service image path in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1548
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Desktop\Install\{568593a3-ddda-e9c8-c724-dfe7808f99db}\ \...\ﯹ๛\{568593a3-ddda-e9c8-c724-dfe7808f99db}\@
Filesize2KB
MD5de4695935fbc1c923d6a025b35818078
SHA176aedb18ba70190668a511a1c845be8e7622ba4e
SHA256623120186a003c0baf1ce4bd570b2597b0e673d6af73287e1e31ab391c245b31
SHA512003b3b011a34630cf612843f0862884d3bf9d8961c4c805fd3989b8cb8223a2688f1e01cd3f386e7bf0d0ab407dbc4b26bd04f8a6610042f0b5bb09d2fd5cab6