Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
-
Size
3.8MB
-
MD5
4e98e878bdcd6d9e77fabf2e1c2f780b
-
SHA1
e4986c4993006ce32858bd11a4e97969138d0fe0
-
SHA256
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def
-
SHA512
f61e81d183aa4ebe37a1060424beffa66425819cc5ccb09e945be76c3370136583c02a941b6eb003632856af536901ed92b18008ba4919fbd6a37600434282fe
-
SSDEEP
98304:ITcOeIdcUP6wg45kHjObfMSDzbF7jo7t1a/l+6n:IceP5kHqN7joR0/l5
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1876-90-0x0000000002140000-0x00000000022E1000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1876-90-0x0000000002140000-0x00000000022E1000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 2380 MSI62FD.tmp 2392 MSI62FE.tmp 1876 NtHandleCallback.exe -
Loads dropped DLL 10 IoCs
pid Process 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 2560 MsiExec.exe 2560 MsiExec.exe 2560 MsiExec.exe 2560 MsiExec.exe 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 2380 MSI62FD.tmp 2380 MSI62FD.tmp 1876 NtHandleCallback.exe -
Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: NtHandleCallback.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: NtHandleCallback.exe File opened (read-only) \??\L: NtHandleCallback.exe File opened (read-only) \??\M: NtHandleCallback.exe File opened (read-only) \??\Q: NtHandleCallback.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: NtHandleCallback.exe File opened (read-only) \??\S: NtHandleCallback.exe File opened (read-only) \??\V: NtHandleCallback.exe File opened (read-only) \??\X: NtHandleCallback.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: NtHandleCallback.exe File opened (read-only) \??\T: NtHandleCallback.exe File opened (read-only) \??\W: NtHandleCallback.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: NtHandleCallback.exe File opened (read-only) \??\R: NtHandleCallback.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: NtHandleCallback.exe File opened (read-only) \??\O: NtHandleCallback.exe File opened (read-only) \??\H: NtHandleCallback.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: NtHandleCallback.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: NtHandleCallback.exe File opened (read-only) \??\Z: NtHandleCallback.exe File opened (read-only) \??\Y: NtHandleCallback.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: NtHandleCallback.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f765f9d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI600A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI61F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6201.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI62FE.tmp msiexec.exe File opened for modification C:\Windows\Installer\f765fa0.ipi msiexec.exe File created C:\Windows\Installer\f765f9d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6098.tmp msiexec.exe File created C:\Windows\Installer\f765fa0.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI6231.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI62FD.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI62FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI62FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NtHandleCallback.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NtHandleCallback.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NtHandleCallback.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2664 msiexec.exe 2664 msiexec.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe 1876 NtHandleCallback.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 2852 msiexec.exe Token: SeIncreaseQuotaPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeSecurityPrivilege 2664 msiexec.exe Token: SeCreateTokenPrivilege 2852 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2852 msiexec.exe Token: SeLockMemoryPrivilege 2852 msiexec.exe Token: SeIncreaseQuotaPrivilege 2852 msiexec.exe Token: SeMachineAccountPrivilege 2852 msiexec.exe Token: SeTcbPrivilege 2852 msiexec.exe Token: SeSecurityPrivilege 2852 msiexec.exe Token: SeTakeOwnershipPrivilege 2852 msiexec.exe Token: SeLoadDriverPrivilege 2852 msiexec.exe Token: SeSystemProfilePrivilege 2852 msiexec.exe Token: SeSystemtimePrivilege 2852 msiexec.exe Token: SeProfSingleProcessPrivilege 2852 msiexec.exe Token: SeIncBasePriorityPrivilege 2852 msiexec.exe Token: SeCreatePagefilePrivilege 2852 msiexec.exe Token: SeCreatePermanentPrivilege 2852 msiexec.exe Token: SeBackupPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2852 msiexec.exe Token: SeShutdownPrivilege 2852 msiexec.exe Token: SeDebugPrivilege 2852 msiexec.exe Token: SeAuditPrivilege 2852 msiexec.exe Token: SeSystemEnvironmentPrivilege 2852 msiexec.exe Token: SeChangeNotifyPrivilege 2852 msiexec.exe Token: SeRemoteShutdownPrivilege 2852 msiexec.exe Token: SeUndockPrivilege 2852 msiexec.exe Token: SeSyncAgentPrivilege 2852 msiexec.exe Token: SeEnableDelegationPrivilege 2852 msiexec.exe Token: SeManageVolumePrivilege 2852 msiexec.exe Token: SeImpersonatePrivilege 2852 msiexec.exe Token: SeCreateGlobalPrivilege 2852 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: SeRestorePrivilege 2664 msiexec.exe Token: SeTakeOwnershipPrivilege 2664 msiexec.exe Token: 33 1876 NtHandleCallback.exe Token: SeIncBasePriorityPrivilege 1876 NtHandleCallback.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2824 wrote to memory of 2852 2824 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 30 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2560 2664 msiexec.exe 32 PID 2664 wrote to memory of 2380 2664 msiexec.exe 33 PID 2664 wrote to memory of 2380 2664 msiexec.exe 33 PID 2664 wrote to memory of 2380 2664 msiexec.exe 33 PID 2664 wrote to memory of 2380 2664 msiexec.exe 33 PID 2664 wrote to memory of 2392 2664 msiexec.exe 34 PID 2664 wrote to memory of 2392 2664 msiexec.exe 34 PID 2664 wrote to memory of 2392 2664 msiexec.exe 34 PID 2664 wrote to memory of 2392 2664 msiexec.exe 34 PID 2380 wrote to memory of 1876 2380 MSI62FD.tmp 36 PID 2380 wrote to memory of 1876 2380 MSI62FD.tmp 36 PID 2380 wrote to memory of 1876 2380 MSI62FD.tmp 36 PID 2380 wrote to memory of 1876 2380 MSI62FD.tmp 36 PID 2392 wrote to memory of 1564 2392 MSI62FE.tmp 35 PID 2392 wrote to memory of 1564 2392 MSI62FE.tmp 35 PID 2392 wrote to memory of 1564 2392 MSI62FE.tmp 35 PID 2392 wrote to memory of 1564 2392 MSI62FE.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\Windows.msi" /quiet /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9624FCDC12F4A022A34346990EE9C2DC2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Windows\Installer\MSI62FD.tmp"C:\Windows\Installer\MSI62FD.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
-
C:\Windows\Installer\MSI62FE.tmp"C:\Windows\Installer\MSI62FE.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData cmd.exe /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1564
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD52d31a63151fe130272360cb5570123ec
SHA1368cce3e763c5493676cf94592b000211b10e96c
SHA256cc1b81389c833787d6ffc45599201cb18b630f69254c86b140d10a9ccb7f3688
SHA512826811b51281a57971751a29fa2b2d5750235e21322b6cced474e9cc635e1dbdbf6ada70b579faeefd8a3a6f8cb3c593777a00a9a1df844bf1692d4021a92b4c
-
Filesize
120KB
MD58c00a53e94bf9571f6fea2b36bfa526c
SHA1090bb8ff15e4277c9c85a402a4726179e9bf696d
SHA256333bb1ac355835f781edf467b3ba35ed9a78d9ae658047aab7203e7980fcf060
SHA512313ea8c2634b66147690876fd0af4acb34fe5b15be6450bdb05c1687b58891c32778d41546c042d5861509ffa61a98bddd1bc0b6c94be5812ab7f91936a41bab
-
Filesize
203KB
MD54abc463313ad03288e790ce129494aa7
SHA171f8150d675fc5b3d5aae8e5ec0418546acc616a
SHA256eea967af09622e78ad0b9fc4476b3a22a8122b98e4e8e7a3d65e6c8fefd6ccad
SHA5125d4d7b1a53fcbbfb14bfaa51e93bb15cc2523d9c0a7183f7bcf8515818ec6575580a1a298893777f9fe8d42eb086dc9f8602258b473cb73fb9470b99b5c31258
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\NtHandleCallback.exe
Filesize150KB
MD5157b89f140fcdc2fa6d0990a3cf29560
SHA1bcdfb7aaf53ca6cea2b5a75e6c398efe6eb0dab9
SHA25663a34aaf8e991e67032e02de652f1f7a8f746a7bff5f196c507732192b6dcaf1
SHA51226c893e50f6cade2148413ff552418c8f9fac685152b6f1916a74bd8a333cb85026a56afe1cd47e518fdc014f29779372e036a63fe102077b684ec8e6ef3341b
-
Filesize
1.3MB
MD5c6703f866da4ca446cdd53d4a0d2beac
SHA1108f17b8315e8c45db9b7db67426e817025410c5
SHA25686e20be845f0b5945f1f6a486ca549df13ed456775a198b2424ee9ba53cedfc3
SHA51275139e1e7ee202e5600af15e6225590f3d04c8f043a9ef9f9a764a00a06fa638b9d1db7529cbe53f7a1d04a2477c26c3930e08586fd00255bfde63a93c4df352
-
Filesize
538KB
MD5c553a949a5a26e180f02a9d8eb143ddc
SHA13050b837322540458dc55891244af33179c9a438
SHA256b7ad8fc8160d1c303f1bf72644e6a9f4bb4e4af0114e8af2c17e68eca76f341c
SHA51231673bf7b13a05c980a8129fdcc49043eaa31efcc7100fa7a3f8490b4b749334f406a2ea1429ca0c101c465b802a91ba2d036b65596f39d5141319065a54c077
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\WindowsPowerShell WbemScripting.SWbemLocator.vbe
Filesize1KB
MD5889fca15a3b0c88f5ceec9bb0ed06c80
SHA1ed825a783bf7c7847b30deb182e1c44379148c0b
SHA25646fa50a35bd2336f757504e84cfd0528f424a00efdfbff45b24aadf9760f8164
SHA512bdf81081e4a8d5250916e6da0406ec6c8ab8a48866a61622338f097a651ddf203da844ead8ffeb886d722be315c492fb6163da139aab26abad124c01bb0b300f
-
Filesize
181KB
MD5ba594acdeeb6d6b6ac64c6fc94270000
SHA1033ad086afd3d1e448ff2ab85fded86184718f77
SHA25636b89921104a1d9a8521349974f48a426b170a0bdc69017c18c7020f18fba58d
SHA512e577d77346167924678257ae6adf4d4a6f435a2c2ba1e4d875aebb842b17c8d378d8953770a1a9e4cac3e74d833f3fc0474549f7c6231d901c4c141f52805009
-
Filesize
1.0MB
MD54b220adbc7b838e225cc006be33a86ad
SHA1b9c461da3ada4666413ce7db700e682ca97b14c0
SHA256045e4730e98f713ba89f95bb460b09304f18b47b1d6f3aba0d3cf05b0bd32d93
SHA512b863ba8a797f2637c6f3cd81c076131c5468eaf470c01bf86909afc7a6a4c3bbaa051a83dc731babbabb008c611f1a2cad05507d71da396afa765ff68a81f4c6
-
Filesize
287KB
MD530ee500e69f06a463f668522fc789945
SHA1c67a201b59ca2388e8ef060de287a678f1fae705
SHA256849131d9b648070461d0fa90cbf094e3c149643ceab43d0c834b82f48a2ef277
SHA51287a0b5aa28a426a156041f050ac9abce2d25efc70570a829fce3831827dc2a426ca5a85acf672519c3c88b463dcdfa9f20ccef46f0eb07e8d04c4e0d9673246d
-
Filesize
9KB
MD50979cea9804fbcd758f60649f29d01ea
SHA1999627113e93cdd3bedcde3cd86a0f010fddfe9f
SHA256e5df917742012911d358dcde17a38ff4999020557fee4f1bbffd1db04994e1cf
SHA512bbef1dccde7062c686b6f0018856b2b008bb8af2f68724b9f052cfaa33dec66ae16aabf0df5bf20e94b7ce18ecdb75e71125caa8707e282e2da47ae55b0b936f
-
Filesize
79KB
MD59a4968fe67c177850163deafec64d0a6
SHA115b3f837c4f066cface8b3535a88523d20e5ca5c
SHA256441d8c2ee1b434e21b7a8547f3c9e8b5b654ed7c790372d7870c8071d3a9b6ab
SHA512256d1173b794bda93adece3bf2689c6875a67a8690139587c271f5c7a45f2a397caf164a4a05f34c9710ce65c7f473243c05be35155d130406999a834fc7643f