Analysis
-
max time kernel
92s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
a74698c4f42c2cca66ff854076a2f673729e1da2b444a1f8f0f13c303b9e3960.dll
Resource
win7-20240903-en
General
-
Target
a74698c4f42c2cca66ff854076a2f673729e1da2b444a1f8f0f13c303b9e3960.dll
-
Size
211KB
-
MD5
6faa1af8c7077fa41d49973f939144bc
-
SHA1
61ab314d609249a6e109814a46d7c6f65a98d26d
-
SHA256
a74698c4f42c2cca66ff854076a2f673729e1da2b444a1f8f0f13c303b9e3960
-
SHA512
95f4196a6c16cb812194cbb862e0810f4ad687933b6acdded00f2290e23af30b93468da99aa86a1eaaad71f4d0fb3e5c9543f60ab0c809f6adfce1937efaaadb
-
SSDEEP
3072:TnMoFkOKCg3CXmSSZlzgeBTg4vRPo5NNFs+XNtUU/chmcFTulOVq5pNOV8SAkb85:TMJOWK4l0wqOVq1W8St8CUHF
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 2284 rundll32mgr.exe 4692 WaterMark.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/2284-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/2284-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4692-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4692-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4692-40-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\pxF107.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3012 3356 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "795631829" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151219" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5AF94D0B-C066-11EF-BDBF-DA61A5E71E4E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151219" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "797975463" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5AF6E989-C066-11EF-BDBF-DA61A5E71E4E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31151219" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "797975463" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "795631829" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151219" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441638107" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151219" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "795631829" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31151219" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "795788078" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe 4692 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4692 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5000 iexplore.exe 1096 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1096 iexplore.exe 1096 iexplore.exe 5000 iexplore.exe 5000 iexplore.exe 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE 4720 IEXPLORE.EXE 4720 IEXPLORE.EXE 2060 IEXPLORE.EXE 2060 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2284 rundll32mgr.exe 4692 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1928 wrote to memory of 3868 1928 rundll32.exe 83 PID 1928 wrote to memory of 3868 1928 rundll32.exe 83 PID 1928 wrote to memory of 3868 1928 rundll32.exe 83 PID 3868 wrote to memory of 2284 3868 rundll32.exe 84 PID 3868 wrote to memory of 2284 3868 rundll32.exe 84 PID 3868 wrote to memory of 2284 3868 rundll32.exe 84 PID 2284 wrote to memory of 4692 2284 rundll32mgr.exe 85 PID 2284 wrote to memory of 4692 2284 rundll32mgr.exe 85 PID 2284 wrote to memory of 4692 2284 rundll32mgr.exe 85 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 3356 4692 WaterMark.exe 86 PID 4692 wrote to memory of 1096 4692 WaterMark.exe 91 PID 4692 wrote to memory of 1096 4692 WaterMark.exe 91 PID 4692 wrote to memory of 5000 4692 WaterMark.exe 92 PID 4692 wrote to memory of 5000 4692 WaterMark.exe 92 PID 1096 wrote to memory of 4720 1096 iexplore.exe 94 PID 1096 wrote to memory of 4720 1096 iexplore.exe 94 PID 1096 wrote to memory of 4720 1096 iexplore.exe 94 PID 5000 wrote to memory of 2060 5000 iexplore.exe 95 PID 5000 wrote to memory of 2060 5000 iexplore.exe 95 PID 5000 wrote to memory of 2060 5000 iexplore.exe 95
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a74698c4f42c2cca66ff854076a2f673729e1da2b444a1f8f0f13c303b9e3960.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a74698c4f42c2cca66ff854076a2f673729e1da2b444a1f8f0f13c303b9e3960.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1926⤵
- Program crash
PID:3012
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4720
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5000 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3356 -ip 33561⤵PID:4424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD536ed732b90a27bd5f4716645a456ad34
SHA193caaf2e2b76b96142e3a9865eb12aa6aab4296e
SHA256a41bae0a57d70f030a24668e1e68cfec75c27ed94105d8ae895025edfef3132e
SHA512460f8f4e5bc5f445c7f175699c80e86e2f4c1822a4e7c3ecb07de224db0c7428f74058fa3e164b3fde0777af2818da0e9e831b869e8bd7b1ffb3b4abc794fbd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5975c5e210f016ab192d63e00edc5499f
SHA11e8961ea13c3c8ced91722b2371336a109dd9a6a
SHA2568cb94c206a9240c884f7446630f8ea06d41d5ac34d8082be28939b8fbbf3db5a
SHA512296f823f4181ae25a9248802ccc9affc064f63f0590c31b505f9dea44315e7868760e85982268fc2b74b2ab714402a02411c37c9f08094bfbd302cbf43a92249
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5AF6E989-C066-11EF-BDBF-DA61A5E71E4E}.dat
Filesize5KB
MD5091840d441532c71680725137760368f
SHA1aba7c1850878f78869da474be29e2d02190543bb
SHA256d2b40a74b8717ed1100f94352e8ed19facaeec8299f62789f730cb17384de83f
SHA512358c9e49e0678a9e5adf6682800adf0d03aa7a2f6add6da9fe1aede4f29f988692f2ff47f845beb963666dad1cdb0460083bf607bb5d2590adce74d97ab35e1f
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5AF94D0B-C066-11EF-BDBF-DA61A5E71E4E}.dat
Filesize5KB
MD5db81eca02d4b61c02eb8391ec8dde476
SHA1fbb44cf45327c2fff5ba7da05f5c680f40a692db
SHA256a133029d3a162b38c8c4c3a503cbe5b13b5ffa92a2cfeab078d62b885833288b
SHA512c1dae792e1527ecd0a32d81afa247933f44b9845de1f51dc9af3fcf4469c4dd9b90030fbb5c28fdd71f833092a73ae2ccc5ed150959aeb96ec00d0074d32ce4f
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350