Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 10:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45249cfff0b7af97e8ed9805c958dfb9deac6e5c753515adedbc281fd9f5147eN.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
45249cfff0b7af97e8ed9805c958dfb9deac6e5c753515adedbc281fd9f5147eN.dll
-
Size
120KB
-
MD5
4e0c01ce0f7f22df85983fefb2210670
-
SHA1
7071c9798ee79bd0e727104c6dcc4d90eb486859
-
SHA256
45249cfff0b7af97e8ed9805c958dfb9deac6e5c753515adedbc281fd9f5147e
-
SHA512
653c6a07c7651666ad679619e246e55f635a49c87b03a4a4a98110096605dd5168e196efe0fd3b8bac727c5faa8872c3400152b633007273d9b7395e27dd2e8a
-
SSDEEP
3072:ESzGzuoOpu+W+nZo4fBJfuA8wIMCbrYAtUXmY:9GSoph+n+a7h8THYAgm
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77e466.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77e466.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77fff1.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77fff1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77e466.exe -
Executes dropped EXE 3 IoCs
pid Process 2452 f77e466.exe 2716 f77e61b.exe 2864 f77fff1.exe -
Loads dropped DLL 6 IoCs
pid Process 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe 2468 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77e466.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77e61b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77fff1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77fff1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77fff1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77fff1.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: f77e466.exe File opened (read-only) \??\M: f77e466.exe File opened (read-only) \??\O: f77e466.exe File opened (read-only) \??\E: f77e466.exe File opened (read-only) \??\J: f77e466.exe File opened (read-only) \??\K: f77e466.exe File opened (read-only) \??\N: f77e466.exe File opened (read-only) \??\P: f77e466.exe File opened (read-only) \??\R: f77e466.exe File opened (read-only) \??\Q: f77e466.exe File opened (read-only) \??\G: f77e466.exe File opened (read-only) \??\H: f77e466.exe File opened (read-only) \??\I: f77e466.exe File opened (read-only) \??\S: f77e466.exe File opened (read-only) \??\T: f77e466.exe -
resource yara_rule behavioral1/memory/2452-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-24-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-22-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-62-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-63-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-67-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-69-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-70-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-84-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-87-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-88-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2452-153-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2716-165-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2716-188-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f77e4e3 f77e466.exe File opened for modification C:\Windows\SYSTEM.INI f77e466.exe File created C:\Windows\f783488 f77e61b.exe File created C:\Windows\f784e4f f77fff1.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77e466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77e61b.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2452 f77e466.exe 2452 f77e466.exe 2716 f77e61b.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2452 f77e466.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe Token: SeDebugPrivilege 2716 f77e61b.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 2468 wrote to memory of 2452 2468 rundll32.exe 29 PID 2468 wrote to memory of 2452 2468 rundll32.exe 29 PID 2468 wrote to memory of 2452 2468 rundll32.exe 29 PID 2468 wrote to memory of 2452 2468 rundll32.exe 29 PID 2452 wrote to memory of 1116 2452 f77e466.exe 18 PID 2452 wrote to memory of 1168 2452 f77e466.exe 19 PID 2452 wrote to memory of 1196 2452 f77e466.exe 20 PID 2452 wrote to memory of 1192 2452 f77e466.exe 22 PID 2452 wrote to memory of 848 2452 f77e466.exe 27 PID 2452 wrote to memory of 2468 2452 f77e466.exe 28 PID 2452 wrote to memory of 2468 2452 f77e466.exe 28 PID 2468 wrote to memory of 2716 2468 rundll32.exe 30 PID 2468 wrote to memory of 2716 2468 rundll32.exe 30 PID 2468 wrote to memory of 2716 2468 rundll32.exe 30 PID 2468 wrote to memory of 2716 2468 rundll32.exe 30 PID 2468 wrote to memory of 2864 2468 rundll32.exe 31 PID 2468 wrote to memory of 2864 2468 rundll32.exe 31 PID 2468 wrote to memory of 2864 2468 rundll32.exe 31 PID 2468 wrote to memory of 2864 2468 rundll32.exe 31 PID 2452 wrote to memory of 1116 2452 f77e466.exe 18 PID 2452 wrote to memory of 1168 2452 f77e466.exe 19 PID 2452 wrote to memory of 1196 2452 f77e466.exe 20 PID 2452 wrote to memory of 1192 2452 f77e466.exe 22 PID 2452 wrote to memory of 2716 2452 f77e466.exe 30 PID 2452 wrote to memory of 2716 2452 f77e466.exe 30 PID 2452 wrote to memory of 2864 2452 f77e466.exe 31 PID 2452 wrote to memory of 2864 2452 f77e466.exe 31 PID 2716 wrote to memory of 1116 2716 f77e61b.exe 18 PID 2716 wrote to memory of 1168 2716 f77e61b.exe 19 PID 2716 wrote to memory of 1196 2716 f77e61b.exe 20 PID 2716 wrote to memory of 1192 2716 f77e61b.exe 22 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e466.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77e61b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77fff1.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45249cfff0b7af97e8ed9805c958dfb9deac6e5c753515adedbc281fd9f5147eN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\45249cfff0b7af97e8ed9805c958dfb9deac6e5c753515adedbc281fd9f5147eN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\f77e466.exeC:\Users\Admin\AppData\Local\Temp\f77e466.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2452
-
-
C:\Users\Admin\AppData\Local\Temp\f77e61b.exeC:\Users\Admin\AppData\Local\Temp\f77e61b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\f77fff1.exeC:\Users\Admin\AppData\Local\Temp\f77fff1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2864
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1192
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5db50e84d7dd2e1b22e1ada9472fea2b4
SHA1f5c13418737e07415f7c2bd447cf68c6206f9f42
SHA25609e8e7e4f09efebb3b73ddf56220edb0ba29f01ec6597f44bd2a743cbefd434f
SHA5129b8776d67fcf5d3073128d883c7ea811a207f93cb85cf3aba9979ce01cade2eb8da2e39b56cb1bc92b1ad249956dd4d0fc2ab309ee83d7896c19ae650de4e92c
-
Filesize
97KB
MD588fdca956029e06643968fec39ba0d19
SHA16901569ba70c36024d4406df2755699cc2a49831
SHA25690ac969c8b9ff688db05820daf19f61585ff842cfbb2849e11f56d3ade1a03f3
SHA5120265ca8c5c1d4808233607821c4d28bafa8d429ebd5f960c96be99582ecbead3ad80ada502bec4e0a6ba88cbcb755c5927ec2fd6800a3844a4ece611b6a45304