Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:17
Static task
static1
Behavioral task
behavioral1
Sample
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe
-
Size
3.8MB
-
MD5
4e98e878bdcd6d9e77fabf2e1c2f780b
-
SHA1
e4986c4993006ce32858bd11a4e97969138d0fe0
-
SHA256
630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def
-
SHA512
f61e81d183aa4ebe37a1060424beffa66425819cc5ccb09e945be76c3370136583c02a941b6eb003632856af536901ed92b18008ba4919fbd6a37600434282fe
-
SSDEEP
98304:ITcOeIdcUP6wg45kHjObfMSDzbF7jo7t1a/l+6n:IceP5kHqN7joR0/l5
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5100-86-0x0000000002430000-0x00000000025D1000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/memory/5100-86-0x0000000002430000-0x00000000025D1000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation MSIB441.tmp Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation MSIB452.tmp -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe cmd.exe -
Executes dropped EXE 3 IoCs
pid Process 4344 MSIB452.tmp 2548 MSIB441.tmp 5100 NtHandleCallback.exe -
Loads dropped DLL 8 IoCs
pid Process 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 5100 NtHandleCallback.exe -
Enumerates connected drives 3 TTPs 45 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: NtHandleCallback.exe File opened (read-only) \??\T: NtHandleCallback.exe File opened (read-only) \??\Z: NtHandleCallback.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: NtHandleCallback.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: NtHandleCallback.exe File opened (read-only) \??\P: NtHandleCallback.exe File opened (read-only) \??\R: NtHandleCallback.exe File opened (read-only) \??\U: NtHandleCallback.exe File opened (read-only) \??\W: NtHandleCallback.exe File opened (read-only) \??\B: NtHandleCallback.exe File opened (read-only) \??\Q: NtHandleCallback.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: NtHandleCallback.exe File opened (read-only) \??\L: NtHandleCallback.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: NtHandleCallback.exe File opened (read-only) \??\N: NtHandleCallback.exe File opened (read-only) \??\O: NtHandleCallback.exe File opened (read-only) \??\V: NtHandleCallback.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: NtHandleCallback.exe File opened (read-only) \??\X: NtHandleCallback.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: NtHandleCallback.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: NtHandleCallback.exe File opened (read-only) \??\K: NtHandleCallback.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e57b0a3.msi msiexec.exe File opened for modification C:\Windows\Installer\e57b0a3.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB1CC.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{11B1998D-F898-4E7D-919D-90442C456A2E} msiexec.exe File opened for modification C:\Windows\Installer\MSIB23B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB2B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB356.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB441.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB15E.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB452.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NtHandleCallback.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIB452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIB441.tmp -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NtHandleCallback.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NtHandleCallback.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1768 msiexec.exe 1768 msiexec.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe 5100 NtHandleCallback.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 656 msiexec.exe Token: SeIncreaseQuotaPrivilege 656 msiexec.exe Token: SeSecurityPrivilege 1768 msiexec.exe Token: SeCreateTokenPrivilege 656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 656 msiexec.exe Token: SeLockMemoryPrivilege 656 msiexec.exe Token: SeIncreaseQuotaPrivilege 656 msiexec.exe Token: SeMachineAccountPrivilege 656 msiexec.exe Token: SeTcbPrivilege 656 msiexec.exe Token: SeSecurityPrivilege 656 msiexec.exe Token: SeTakeOwnershipPrivilege 656 msiexec.exe Token: SeLoadDriverPrivilege 656 msiexec.exe Token: SeSystemProfilePrivilege 656 msiexec.exe Token: SeSystemtimePrivilege 656 msiexec.exe Token: SeProfSingleProcessPrivilege 656 msiexec.exe Token: SeIncBasePriorityPrivilege 656 msiexec.exe Token: SeCreatePagefilePrivilege 656 msiexec.exe Token: SeCreatePermanentPrivilege 656 msiexec.exe Token: SeBackupPrivilege 656 msiexec.exe Token: SeRestorePrivilege 656 msiexec.exe Token: SeShutdownPrivilege 656 msiexec.exe Token: SeDebugPrivilege 656 msiexec.exe Token: SeAuditPrivilege 656 msiexec.exe Token: SeSystemEnvironmentPrivilege 656 msiexec.exe Token: SeChangeNotifyPrivilege 656 msiexec.exe Token: SeRemoteShutdownPrivilege 656 msiexec.exe Token: SeUndockPrivilege 656 msiexec.exe Token: SeSyncAgentPrivilege 656 msiexec.exe Token: SeEnableDelegationPrivilege 656 msiexec.exe Token: SeManageVolumePrivilege 656 msiexec.exe Token: SeImpersonatePrivilege 656 msiexec.exe Token: SeCreateGlobalPrivilege 656 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: SeRestorePrivilege 1768 msiexec.exe Token: SeTakeOwnershipPrivilege 1768 msiexec.exe Token: 33 5100 NtHandleCallback.exe Token: SeIncBasePriorityPrivilege 5100 NtHandleCallback.exe Token: 33 5100 NtHandleCallback.exe Token: SeIncBasePriorityPrivilege 5100 NtHandleCallback.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4420 wrote to memory of 656 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 4420 wrote to memory of 656 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 4420 wrote to memory of 656 4420 630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe 83 PID 1768 wrote to memory of 3824 1768 msiexec.exe 86 PID 1768 wrote to memory of 3824 1768 msiexec.exe 86 PID 1768 wrote to memory of 3824 1768 msiexec.exe 86 PID 1768 wrote to memory of 2548 1768 msiexec.exe 87 PID 1768 wrote to memory of 2548 1768 msiexec.exe 87 PID 1768 wrote to memory of 2548 1768 msiexec.exe 87 PID 1768 wrote to memory of 4344 1768 msiexec.exe 88 PID 1768 wrote to memory of 4344 1768 msiexec.exe 88 PID 1768 wrote to memory of 4344 1768 msiexec.exe 88 PID 2548 wrote to memory of 5100 2548 MSIB441.tmp 89 PID 2548 wrote to memory of 5100 2548 MSIB441.tmp 89 PID 2548 wrote to memory of 5100 2548 MSIB441.tmp 89 PID 4344 wrote to memory of 3956 4344 MSIB452.tmp 90 PID 4344 wrote to memory of 3956 4344 MSIB452.tmp 90 PID 4344 wrote to memory of 3956 4344 MSIB452.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\Windows.msi" /quiet /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\630155dd06b45e9d804b0e5112a1983cd2bfa590816a70c4a353cf21794e2def.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:656
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D24A7781DD7FDAC0A07BBFB1A911DE6B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Windows\Installer\MSIB441.tmp"C:\Windows\Installer\MSIB441.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"C:\Users\Public\Documents\WindowsData\NtHandleCallback.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
-
C:\Windows\Installer\MSIB452.tmp"C:\Windows\Installer\MSIB452.tmp" /HideWindow /dir C:\Users\Public\Documents\WindowsData cmd.exe /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Public\Documents\WindowsData\WindowsPowerShell WbemScripting.SWbemLocator.vbe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsPowerShell WbemScripting.SWbemLocator.vbe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3956
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5e257628601517d7a240b7434dd9cdc2d
SHA122f424a42d382db18cb39e796dba2f66d942ea74
SHA25621bf669aa5521db0469bf307615c5d9db36c97df8599e3711280850aff002dbb
SHA5127710ae66a92a95e0004c613e0535abad1ca53c347f068dde9db0bf4fab901c5f7331694a4d137905e4a21201fe1618a8ba27fed82a37e61b3addadb2dfbc7453
-
Filesize
120KB
MD58c00a53e94bf9571f6fea2b36bfa526c
SHA1090bb8ff15e4277c9c85a402a4726179e9bf696d
SHA256333bb1ac355835f781edf467b3ba35ed9a78d9ae658047aab7203e7980fcf060
SHA512313ea8c2634b66147690876fd0af4acb34fe5b15be6450bdb05c1687b58891c32778d41546c042d5861509ffa61a98bddd1bc0b6c94be5812ab7f91936a41bab
-
Filesize
203KB
MD54abc463313ad03288e790ce129494aa7
SHA171f8150d675fc5b3d5aae8e5ec0418546acc616a
SHA256eea967af09622e78ad0b9fc4476b3a22a8122b98e4e8e7a3d65e6c8fefd6ccad
SHA5125d4d7b1a53fcbbfb14bfaa51e93bb15cc2523d9c0a7183f7bcf8515818ec6575580a1a298893777f9fe8d42eb086dc9f8602258b473cb73fb9470b99b5c31258
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\NtHandleCallback.exe
Filesize150KB
MD5157b89f140fcdc2fa6d0990a3cf29560
SHA1bcdfb7aaf53ca6cea2b5a75e6c398efe6eb0dab9
SHA25663a34aaf8e991e67032e02de652f1f7a8f746a7bff5f196c507732192b6dcaf1
SHA51226c893e50f6cade2148413ff552418c8f9fac685152b6f1916a74bd8a333cb85026a56afe1cd47e518fdc014f29779372e036a63fe102077b684ec8e6ef3341b
-
Filesize
1.3MB
MD5c6703f866da4ca446cdd53d4a0d2beac
SHA1108f17b8315e8c45db9b7db67426e817025410c5
SHA25686e20be845f0b5945f1f6a486ca549df13ed456775a198b2424ee9ba53cedfc3
SHA51275139e1e7ee202e5600af15e6225590f3d04c8f043a9ef9f9a764a00a06fa638b9d1db7529cbe53f7a1d04a2477c26c3930e08586fd00255bfde63a93c4df352
-
Filesize
538KB
MD5c553a949a5a26e180f02a9d8eb143ddc
SHA13050b837322540458dc55891244af33179c9a438
SHA256b7ad8fc8160d1c303f1bf72644e6a9f4bb4e4af0114e8af2c17e68eca76f341c
SHA51231673bf7b13a05c980a8129fdcc49043eaa31efcc7100fa7a3f8490b4b749334f406a2ea1429ca0c101c465b802a91ba2d036b65596f39d5141319065a54c077
-
C:\Users\Admin\AppData\Roaming\microsoft\Windows Installl 1.0.0\install\C456A2E\WindowsPowerShell WbemScripting.SWbemLocator.vbe
Filesize1KB
MD5889fca15a3b0c88f5ceec9bb0ed06c80
SHA1ed825a783bf7c7847b30deb182e1c44379148c0b
SHA25646fa50a35bd2336f757504e84cfd0528f424a00efdfbff45b24aadf9760f8164
SHA512bdf81081e4a8d5250916e6da0406ec6c8ab8a48866a61622338f097a651ddf203da844ead8ffeb886d722be315c492fb6163da139aab26abad124c01bb0b300f
-
Filesize
181KB
MD5ba594acdeeb6d6b6ac64c6fc94270000
SHA1033ad086afd3d1e448ff2ab85fded86184718f77
SHA25636b89921104a1d9a8521349974f48a426b170a0bdc69017c18c7020f18fba58d
SHA512e577d77346167924678257ae6adf4d4a6f435a2c2ba1e4d875aebb842b17c8d378d8953770a1a9e4cac3e74d833f3fc0474549f7c6231d901c4c141f52805009
-
Filesize
1.0MB
MD54b220adbc7b838e225cc006be33a86ad
SHA1b9c461da3ada4666413ce7db700e682ca97b14c0
SHA256045e4730e98f713ba89f95bb460b09304f18b47b1d6f3aba0d3cf05b0bd32d93
SHA512b863ba8a797f2637c6f3cd81c076131c5468eaf470c01bf86909afc7a6a4c3bbaa051a83dc731babbabb008c611f1a2cad05507d71da396afa765ff68a81f4c6
-
Filesize
79KB
MD59a4968fe67c177850163deafec64d0a6
SHA115b3f837c4f066cface8b3535a88523d20e5ca5c
SHA256441d8c2ee1b434e21b7a8547f3c9e8b5b654ed7c790372d7870c8071d3a9b6ab
SHA512256d1173b794bda93adece3bf2689c6875a67a8690139587c271f5c7a45f2a397caf164a4a05f34c9710ce65c7f473243c05be35155d130406999a834fc7643f
-
Filesize
287KB
MD530ee500e69f06a463f668522fc789945
SHA1c67a201b59ca2388e8ef060de287a678f1fae705
SHA256849131d9b648070461d0fa90cbf094e3c149643ceab43d0c834b82f48a2ef277
SHA51287a0b5aa28a426a156041f050ac9abce2d25efc70570a829fce3831827dc2a426ca5a85acf672519c3c88b463dcdfa9f20ccef46f0eb07e8d04c4e0d9673246d
-
Filesize
9KB
MD50979cea9804fbcd758f60649f29d01ea
SHA1999627113e93cdd3bedcde3cd86a0f010fddfe9f
SHA256e5df917742012911d358dcde17a38ff4999020557fee4f1bbffd1db04994e1cf
SHA512bbef1dccde7062c686b6f0018856b2b008bb8af2f68724b9f052cfaa33dec66ae16aabf0df5bf20e94b7ce18ecdb75e71125caa8707e282e2da47ae55b0b936f