Analysis
-
max time kernel
119s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
-
Size
3.8MB
-
MD5
4e98e878bdcd6d9e77fabf2e1c2f780b
-
SHA1
e4986c4993006ce32858bd11a4e97969138d0fe0
-
SHA256
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def
-
SHA512
f61e81d183aa4ebe37a1060424beffa66425819cc5ccb09e945be76c3370136583c02a941b6eb003632856af536901ed92b18008ba4919fbd6a37600434282fe
-
SSDEEP
98304:ITcOeIdcUP6wg45kHjObfMSDzbF7jo7t1a/l+6n:IceP5kHqN7joR0/l5
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3428-92-0x0000000002480000-0x0000000002621000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/3428-92-0x0000000002480000-0x0000000002621000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation MSIBD0C.tmp Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation MSIBD0B.tmp -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 3116 MSIBD0C.tmp 3628 MSIBD0B.tmp 3428 NtHandleCallback.exe -
Loads dropped DLL 8 IoCs
pid Process 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 2676 MsiExec.exe 2676 MsiExec.exe 2676 MsiExec.exe 2676 MsiExec.exe 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 3428 NtHandleCallback.exe -
Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: NtHandleCallback.exe File opened (read-only) \??\U: NtHandleCallback.exe File opened (read-only) \??\Y: NtHandleCallback.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: NtHandleCallback.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: NtHandleCallback.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: NtHandleCallback.exe File opened (read-only) \??\T: NtHandleCallback.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: NtHandleCallback.exe File opened (read-only) \??\L: NtHandleCallback.exe File opened (read-only) \??\N: NtHandleCallback.exe File opened (read-only) \??\Q: NtHandleCallback.exe File opened (read-only) \??\V: NtHandleCallback.exe File opened (read-only) \??\W: NtHandleCallback.exe File opened (read-only) \??\X: NtHandleCallback.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: NtHandleCallback.exe File opened (read-only) \??\J: NtHandleCallback.exe File opened (read-only) \??\S: NtHandleCallback.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: NtHandleCallback.exe File opened (read-only) \??\P: NtHandleCallback.exe File opened (read-only) \??\R: NtHandleCallback.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: NtHandleCallback.exe File opened (read-only) \??\M: NtHandleCallback.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{11B1998D-F898-4E7D-919D-90442C456A2E} msiexec.exe File opened for modification C:\Windows\Installer\MSIBA97.tmp msiexec.exe File created C:\Windows\Installer\e57b8d0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB9DB.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBAE7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBD0B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBD0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57b8d0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB97C.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIBD0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIBD0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NtHandleCallback.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NtHandleCallback.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NtHandleCallback.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1968 msiexec.exe 1968 msiexec.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe 3428 NtHandleCallback.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 1088 msiexec.exe Token: SeIncreaseQuotaPrivilege 1088 msiexec.exe Token: SeSecurityPrivilege 1968 msiexec.exe Token: SeCreateTokenPrivilege 1088 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1088 msiexec.exe Token: SeLockMemoryPrivilege 1088 msiexec.exe Token: SeIncreaseQuotaPrivilege 1088 msiexec.exe Token: SeMachineAccountPrivilege 1088 msiexec.exe Token: SeTcbPrivilege 1088 msiexec.exe Token: SeSecurityPrivilege 1088 msiexec.exe Token: SeTakeOwnershipPrivilege 1088 msiexec.exe Token: SeLoadDriverPrivilege 1088 msiexec.exe Token: SeSystemProfilePrivilege 1088 msiexec.exe Token: SeSystemtimePrivilege 1088 msiexec.exe Token: SeProfSingleProcessPrivilege 1088 msiexec.exe Token: SeIncBasePriorityPrivilege 1088 msiexec.exe Token: SeCreatePagefilePrivilege 1088 msiexec.exe Token: SeCreatePermanentPrivilege 1088 msiexec.exe Token: SeBackupPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1088 msiexec.exe Token: SeShutdownPrivilege 1088 msiexec.exe Token: SeDebugPrivilege 1088 msiexec.exe Token: SeAuditPrivilege 1088 msiexec.exe Token: SeSystemEnvironmentPrivilege 1088 msiexec.exe Token: SeChangeNotifyPrivilege 1088 msiexec.exe Token: SeRemoteShutdownPrivilege 1088 msiexec.exe Token: SeUndockPrivilege 1088 msiexec.exe Token: SeSyncAgentPrivilege 1088 msiexec.exe Token: SeEnableDelegationPrivilege 1088 msiexec.exe Token: SeManageVolumePrivilege 1088 msiexec.exe Token: SeImpersonatePrivilege 1088 msiexec.exe Token: SeCreateGlobalPrivilege 1088 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: SeRestorePrivilege 1968 msiexec.exe Token: SeTakeOwnershipPrivilege 1968 msiexec.exe Token: 33 3428 NtHandleCallback.exe Token: SeIncBasePriorityPrivilege 3428 NtHandleCallback.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4280 wrote to memory of 1088 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 4280 wrote to memory of 1088 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 4280 wrote to memory of 1088 4280 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 1968 wrote to memory of 2676 1968 msiexec.exe 86 PID 1968 wrote to memory of 2676 1968 msiexec.exe 86 PID 1968 wrote to memory of 2676 1968 msiexec.exe 86 PID 1968 wrote to memory of 3116 1968 msiexec.exe 87 PID 1968 wrote to memory of 3116 1968 msiexec.exe 87 PID 1968 wrote to memory of 3116 1968 msiexec.exe 87 PID 1968 wrote to memory of 3628 1968 msiexec.exe 88 PID 1968 wrote to memory of 3628 1968 msiexec.exe 88 PID 1968 wrote to memory of 3628 1968 msiexec.exe 88 PID 3116 wrote to memory of 3172 3116 MSIBD0C.tmp 89 PID 3116 wrote to memory of 3172 3116 MSIBD0C.tmp 89 PID 3116 wrote to memory of 3172 3116 MSIBD0C.tmp 89 PID 3628 wrote to memory of 3428 3628 MSIBD0B.tmp 90 PID 3628 wrote to memory of 3428 3628 MSIBD0B.tmp 90 PID 3628 wrote to memory of 3428 3628 MSIBD0B.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\Windows.msi" /quiet /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B285E1285D84A9A7F63EA893439784AD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2676
-
-
C:\Windows\Installer\MSIBD0C.tmp"C:\Windows\Installer\MSIBD0C.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData cmd.exe /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3172
-
-
-
C:\Windows\Installer\MSIBD0B.tmp"C:\Windows\Installer\MSIBD0B.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5fb18f422141f2f7d758605b8dd9b1185
SHA16a682958f9c98b45c44c820617abf36c83c685a1
SHA2560469b01fa3caf59fcc9bebfecb82260953d3ae7843402c1c5875ed70b018ab2f
SHA5124d9a861bab6724025aba2fc92e769f5eefbec9bec97ae54f04a23943224150f009b95a00f64a978261f4fc2e477230e9a217372246e3d74f4ceed80965a18590
-
Filesize
120KB
MD58c00a53e94bf9571f6fea2b36bfa526c
SHA1090bb8ff15e4277c9c85a402a4726179e9bf696d
SHA256333bb1ac355835f781edf467b3ba35ed9a78d9ae658047aab7203e7980fcf060
SHA512313ea8c2634b66147690876fd0af4acb34fe5b15be6450bdb05c1687b58891c32778d41546c042d5861509ffa61a98bddd1bc0b6c94be5812ab7f91936a41bab
-
Filesize
203KB
MD54abc463313ad03288e790ce129494aa7
SHA171f8150d675fc5b3d5aae8e5ec0418546acc616a
SHA256eea967af09622e78ad0b9fc4476b3a22a8122b98e4e8e7a3d65e6c8fefd6ccad
SHA5125d4d7b1a53fcbbfb14bfaa51e93bb15cc2523d9c0a7183f7bcf8515818ec6575580a1a298893777f9fe8d42eb086dc9f8602258b473cb73fb9470b99b5c31258
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\NtHandleCallback.exe
Filesize150KB
MD5157b89f140fcdc2fa6d0990a3cf29560
SHA1bcdfb7aaf53ca6cea2b5a75e6c398efe6eb0dab9
SHA25663a34aaf8e991e67032e02de652f1f7a8f746a7bff5f196c507732192b6dcaf1
SHA51226c893e50f6cade2148413ff552418c8f9fac685152b6f1916a74bd8a333cb85026a56afe1cd47e518fdc014f29779372e036a63fe102077b684ec8e6ef3341b
-
Filesize
1.3MB
MD5c6703f866da4ca446cdd53d4a0d2beac
SHA1108f17b8315e8c45db9b7db67426e817025410c5
SHA25686e20be845f0b5945f1f6a486ca549df13ed456775a198b2424ee9ba53cedfc3
SHA51275139e1e7ee202e5600af15e6225590f3d04c8f043a9ef9f9a764a00a06fa638b9d1db7529cbe53f7a1d04a2477c26c3930e08586fd00255bfde63a93c4df352
-
Filesize
538KB
MD5c553a949a5a26e180f02a9d8eb143ddc
SHA13050b837322540458dc55891244af33179c9a438
SHA256b7ad8fc8160d1c303f1bf72644e6a9f4bb4e4af0114e8af2c17e68eca76f341c
SHA51231673bf7b13a05c980a8129fdcc49043eaa31efcc7100fa7a3f8490b4b749334f406a2ea1429ca0c101c465b802a91ba2d036b65596f39d5141319065a54c077
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\WindowsPowerShell WbemScripting.SWbemLocator.vbe
Filesize1KB
MD5889fca15a3b0c88f5ceec9bb0ed06c80
SHA1ed825a783bf7c7847b30deb182e1c44379148c0b
SHA25646fa50a35bd2336f757504e84cfd0528f424a00efdfbff45b24aadf9760f8164
SHA512bdf81081e4a8d5250916e6da0406ec6c8ab8a48866a61622338f097a651ddf203da844ead8ffeb886d722be315c492fb6163da139aab26abad124c01bb0b300f
-
Filesize
181KB
MD5ba594acdeeb6d6b6ac64c6fc94270000
SHA1033ad086afd3d1e448ff2ab85fded86184718f77
SHA25636b89921104a1d9a8521349974f48a426b170a0bdc69017c18c7020f18fba58d
SHA512e577d77346167924678257ae6adf4d4a6f435a2c2ba1e4d875aebb842b17c8d378d8953770a1a9e4cac3e74d833f3fc0474549f7c6231d901c4c141f52805009
-
Filesize
1.0MB
MD54b220adbc7b838e225cc006be33a86ad
SHA1b9c461da3ada4666413ce7db700e682ca97b14c0
SHA256045e4730e98f713ba89f95bb460b09304f18b47b1d6f3aba0d3cf05b0bd32d93
SHA512b863ba8a797f2637c6f3cd81c076131c5468eaf470c01bf86909afc7a6a4c3bbaa051a83dc731babbabb008c611f1a2cad05507d71da396afa765ff68a81f4c6
-
Filesize
79KB
MD59a4968fe67c177850163deafec64d0a6
SHA115b3f837c4f066cface8b3535a88523d20e5ca5c
SHA256441d8c2ee1b434e21b7a8547f3c9e8b5b654ed7c790372d7870c8071d3a9b6ab
SHA512256d1173b794bda93adece3bf2689c6875a67a8690139587c271f5c7a45f2a397caf164a4a05f34c9710ce65c7f473243c05be35155d130406999a834fc7643f
-
Filesize
287KB
MD530ee500e69f06a463f668522fc789945
SHA1c67a201b59ca2388e8ef060de287a678f1fae705
SHA256849131d9b648070461d0fa90cbf094e3c149643ceab43d0c834b82f48a2ef277
SHA51287a0b5aa28a426a156041f050ac9abce2d25efc70570a829fce3831827dc2a426ca5a85acf672519c3c88b463dcdfa9f20ccef46f0eb07e8d04c4e0d9673246d
-
Filesize
9KB
MD50979cea9804fbcd758f60649f29d01ea
SHA1999627113e93cdd3bedcde3cd86a0f010fddfe9f
SHA256e5df917742012911d358dcde17a38ff4999020557fee4f1bbffd1db04994e1cf
SHA512bbef1dccde7062c686b6f0018856b2b008bb8af2f68724b9f052cfaa33dec66ae16aabf0df5bf20e94b7ce18ecdb75e71125caa8707e282e2da47ae55b0b936f