Analysis
-
max time kernel
92s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:01
Static task
static1
Behavioral task
behavioral1
Sample
323ec225b96e9713eb10ce54a42e78428d5612d499583665feb48879c8644a08N.dll
Resource
win7-20240708-en
General
-
Target
323ec225b96e9713eb10ce54a42e78428d5612d499583665feb48879c8644a08N.dll
-
Size
212KB
-
MD5
ca61c8adc6bf654eea5f1f9f48fcf960
-
SHA1
3dafc648d917b032851c9942c2dfa3fcc405b65e
-
SHA256
323ec225b96e9713eb10ce54a42e78428d5612d499583665feb48879c8644a08
-
SHA512
eb35e2138b707304cb2fb8076d061b92fdcffa377f51421d9512ee6cb26d6924eae07a23373cd6130591d01860e61ee053843dc6c68d54c11279108f40244fc6
-
SSDEEP
3072:an4cV8gf2u41Z5tKlwiIhKQGUppd4/nPxx:g4y8gOl2nIcNEdexx
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 1688 rundll32mgr.exe 4016 WaterMark.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/4016-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA0A5.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2036 3248 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3932756403" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150563" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3933069017" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150563" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3932912670" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31150563" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31150563" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3933069017" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150563" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31150563" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3935412644" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{160B7B47-BDD7-11EF-91C3-622000771059} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3935412644" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441356670" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1609189C-BDD7-11EF-91C3-622000771059} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe 4016 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4016 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2260 iexplore.exe 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2260 iexplore.exe 2260 iexplore.exe 4572 IEXPLORE.EXE 4572 IEXPLORE.EXE 4972 IEXPLORE.EXE 4972 IEXPLORE.EXE 4572 IEXPLORE.EXE 4572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1264 3336 rundll32.exe 83 PID 3336 wrote to memory of 1264 3336 rundll32.exe 83 PID 3336 wrote to memory of 1264 3336 rundll32.exe 83 PID 1264 wrote to memory of 1688 1264 rundll32.exe 84 PID 1264 wrote to memory of 1688 1264 rundll32.exe 84 PID 1264 wrote to memory of 1688 1264 rundll32.exe 84 PID 1688 wrote to memory of 4016 1688 rundll32mgr.exe 85 PID 1688 wrote to memory of 4016 1688 rundll32mgr.exe 85 PID 1688 wrote to memory of 4016 1688 rundll32mgr.exe 85 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 3248 4016 WaterMark.exe 86 PID 4016 wrote to memory of 2260 4016 WaterMark.exe 91 PID 4016 wrote to memory of 2260 4016 WaterMark.exe 91 PID 4016 wrote to memory of 1976 4016 WaterMark.exe 92 PID 4016 wrote to memory of 1976 4016 WaterMark.exe 92 PID 2260 wrote to memory of 4572 2260 iexplore.exe 94 PID 2260 wrote to memory of 4572 2260 iexplore.exe 94 PID 2260 wrote to memory of 4572 2260 iexplore.exe 94 PID 1976 wrote to memory of 4972 1976 iexplore.exe 95 PID 1976 wrote to memory of 4972 1976 iexplore.exe 95 PID 1976 wrote to memory of 4972 1976 iexplore.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\323ec225b96e9713eb10ce54a42e78428d5612d499583665feb48879c8644a08N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\323ec225b96e9713eb10ce54a42e78428d5612d499583665feb48879c8644a08N.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 2046⤵
- Program crash
PID:2036
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4572
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4972
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3248 -ip 32481⤵PID:3652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55e99ec80bb4e60401972729dff7db4f2
SHA1a68a2f47614d8afd1b7afd1e0620d32cd393e2c0
SHA2566ac6e0c6b415580d28c082f0e59f45289379890a167c088a557d3e2578b424e0
SHA5127670c7e91ae9555458275effc570e107c9ae43b02e65f9200b773f9139dfe228faf55f5c4ac5d9d713d0231e16c129baf1c289534b42ac7b4d042f370240c654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD542fe62504c564192e9b5f963b4ca9a49
SHA1d9b661722183ad53487aa4046bd6283ebf324e65
SHA256233f80d60dfe5c8bc4649b7a7e8d5dcba04fa0b7c6b43b930ef01ce65bb778ee
SHA512188873887bed40df7931bd5fa3c71cb1bf5442f4c0e1f6fcc793e6cc949b34b23800fb9eff30d29b9965827da1039a54ab4fc0acac013a6e3af22b1070d913e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD54378bb8101fe063d9a6b6db218f066cf
SHA18beb52f65ae0e1d536a98e43b4eba007b12b6d91
SHA256d02a0476e5cb0d28d6a5cb802ed84629b1f07ca85adfec22b0a1d53c596f30e9
SHA5121ba0c805a9db2920ba634f12fba1a2d86380ece1ba6904a4473ffcc7f2c37e94899bd0b0d307f937b6bcf8547f02c309a9aa6050b0823c24c67a6e4752ae476c
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1609189C-BDD7-11EF-91C3-622000771059}.dat
Filesize5KB
MD5b99fc68874c89d877c0a251b0e4674c6
SHA1703230fdd826d0658a6d1acaf44d9105cf474779
SHA256f598c72f45cd394b978471b2eab0d4043a1c7a2305039dc92ca934511b68245d
SHA512a386573a5e5427d45a0ce227a91a82f306e2322e7251aab33a577dea2e1da90b8188d87772843fec9ce58472b7889cdc0307efd33fdcc508d6fa271532adcde7
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{160B7B47-BDD7-11EF-91C3-622000771059}.dat
Filesize3KB
MD58bd3cd20c4361b1b018be836d1f2c49b
SHA14b8d1780dd16c59c4df0f6ed816189b5318ce8f3
SHA2566c68bab65b970eb99ceecffc963cf5e5ca956365fcfde351061959f6d12083c3
SHA51263d595309defe4375939265fcf09c252327a715d56c24540c49865bcd8791ac2d3c24f7e7dc1ec4da9b082bed31b19708230d9a68ad3678e12326c45097763bb
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
120KB
MD55c141e95c22363e31b6f25fcb6815d2d
SHA12eafcc1a58429a95548c33b3a081a361cea0456d
SHA25679a77eec3120d0d12ba3da622f3f837d05f74821881e08edce7f9496ff901103
SHA512ae0930b8a884643603307a27a6a5d219ab3ddb598ef58b7d74baaf10738b968d6a96c92c4f752f47e324930c2ed4cb6533d9ba140899ce051a8cb6f4ff637809