Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 16:15
Behavioral task
behavioral1
Sample
8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Resource
win7-20240903-en
General
-
Target
8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
-
Size
2.3MB
-
MD5
273744044bbc6e49baffda91a9dd6b38
-
SHA1
1088749a1051fc3c909959cdcb8c8d6a1d8af316
-
SHA256
8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50
-
SHA512
e077864cebcc5305f1f5c7c4d6380a84b6cd304a8fda198609da77d1d19d2bb2298ee3a1861cd8854e10c48f9cf9d44612aa6ea6f98bd82a2bb5645e96683daf
-
SSDEEP
49152:M09XJt4HIN2H2tFvduySCpEWoxv8nsHyjtk2MYC5GDs:xZJt4HINy2LkCKZxknsmtk2aR
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
resource yara_rule behavioral1/memory/2332-7-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2332-9-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2312-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2332-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2312-60-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-76-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2216-77-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/memory/2332-7-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2332-9-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2312-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2332-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2312-60-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-76-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2216-77-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Xred family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
resource behavioral1/files/0x0007000000019c59-173.dat behavioral1/files/0x0006000000019cb9-186.dat -
Executes dropped EXE 7 IoCs
pid Process 2332 RVN.exe 2312 TXPlatforn.exe 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2216 TXPlatforn.exe 2792 ._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2648 Synaptics.exe 2024 ._cache_Synaptics.exe -
Loads dropped DLL 10 IoCs
pid Process 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2312 TXPlatforn.exe 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2648 Synaptics.exe 2648 Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe -
resource yara_rule behavioral1/memory/2332-5-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2332-7-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2332-9-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2312-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2332-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2312-60-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-76-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2216-77-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatforn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1028 cmd.exe 2848 PING.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2848 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2948 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2216 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2332 RVN.exe Token: SeLoadDriverPrivilege 2216 TXPlatforn.exe Token: 33 2216 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2216 TXPlatforn.exe Token: 33 2216 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2216 TXPlatforn.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 2948 EXCEL.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2344 wrote to memory of 2332 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 31 PID 2332 wrote to memory of 1028 2332 RVN.exe 33 PID 2332 wrote to memory of 1028 2332 RVN.exe 33 PID 2332 wrote to memory of 1028 2332 RVN.exe 33 PID 2332 wrote to memory of 1028 2332 RVN.exe 33 PID 2344 wrote to memory of 2672 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 36 PID 2344 wrote to memory of 2672 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 36 PID 2344 wrote to memory of 2672 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 36 PID 2344 wrote to memory of 2672 2344 8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 36 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 2312 wrote to memory of 2216 2312 TXPlatforn.exe 35 PID 1028 wrote to memory of 2848 1028 cmd.exe 37 PID 1028 wrote to memory of 2848 1028 cmd.exe 37 PID 1028 wrote to memory of 2848 1028 cmd.exe 37 PID 1028 wrote to memory of 2848 1028 cmd.exe 37 PID 2672 wrote to memory of 2792 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 38 PID 2672 wrote to memory of 2792 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 38 PID 2672 wrote to memory of 2792 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 38 PID 2672 wrote to memory of 2792 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 38 PID 2672 wrote to memory of 2648 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 39 PID 2672 wrote to memory of 2648 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 39 PID 2672 wrote to memory of 2648 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 39 PID 2672 wrote to memory of 2648 2672 HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe 39 PID 2648 wrote to memory of 2024 2648 Synaptics.exe 40 PID 2648 wrote to memory of 2024 2648 Synaptics.exe 40 PID 2648 wrote to memory of 2024 2648 Synaptics.exe 40 PID 2648 wrote to memory of 2024 2648 Synaptics.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"C:\Users\Admin\AppData\Local\Temp\8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\RVN.exeC:\Users\Admin\AppData\Local\Temp\\RVN.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exeC:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024
-
-
-
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2948
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Filesize89KB
MD5fd5137d1998bf8fcbab832123dd72256
SHA1155e5dd08ecbe6483167f596c927208f4cca8a39
SHA25686ee28923d4e7255762442fe93f220237197a756182ce320f5f6887b5c7147c5
SHA512fd9270902cec43a84048a0e90ded14e56c9bae46ef067081d10784c82ec1a0ef7dc605b11d8819c9c5d75dea342df8a419bdd61f8ef7411c25fee932038ea465
-
C:\Users\Admin\AppData\Local\Temp\HD_8bce0ecd1f7422ffac9920986b14355edda1822c4cb8e7141e5681faf6e2ee50.exe
Filesize843KB
MD5db06bd4b57933fb4dd26188ab9a013c7
SHA124fb49c4fbe2993e96595d1085dbae18d8a73db4
SHA2565d3ccb3cf874eed6dabe680217d17a22096711ddfe184ecb825cf66b46837600
SHA512cd20b5a3abc4b649ae490553e8ef4973a25b77cc6fc669f096928737eec359fdb53e00985314f14f94d3598bebf119ac17c760ece3cb45a0a56bc36c3521a784
-
Filesize
1.5MB
MD543a309d76c3bb4a91e3d464b2adb1a70
SHA1d12fc070e16edf51a1dbe8621fd3e1b2c4be60d3
SHA25610801369a0b307d0b9abf07dab6a92263b7c66fa6fc66bb6d0c86260d2fba649
SHA5126925d0cc83c2d8ca52fa58d49d98e94b667ec68d6e2de68d6bf3f3a406bc027a2db7f1aa3e5f4b13c84503d488b9d7392fcaf61e548dc27ddb102e45d327b9c4
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
23KB
MD5e0f32187d0953c2cfdb20face00e91bf
SHA1adb5a045eb8f1a9c03bde867d69aedf63e488638
SHA256931f48588d24f62975d0bfe7e7d1f15d5bf67a1f84deaac1eb7436ae75f2f600
SHA5127ba2d1e43e391d362c29705171c30cc4340b2b6a1cb5f4039d6239518966af5a75029914d46ba6a131e9f4fe9f6e78ff680c86f71cfd2adaeb41f4fa8f7e5b02
-
Filesize
26KB
MD5666578c564e1315b575e2d24ea94a141
SHA18f97dca5a7532a5dd32ae6a2f3cc61f6399162fc
SHA256be5b9f0e4e7853c18ed8724283187da9648f797b95f1a95ba74c4ae4b87d648f
SHA512665b8761943066c0fcfd8dc78be8eead672d2716f2f9e936468d942405af600226c82ef6d634959dd2db55a6ba175e080ab7028325e5c82c346ffbff80cd8c6b
-
Filesize
28KB
MD5c25c993b44d8e4325fa10daceab563bc
SHA16e2199526e04433edefe9db41563fc5ead4d43d6
SHA25662a4cc9bbc7aee09d02e1ad29a6efbb219a2d7076e2df49d4eaf0efbbf4157f9
SHA5123c967584a1090613b2dfa273343c45ffc2488a2c2bd897421b95e7e332d6e4658e5c23fdfcd22803473144e7b7ad4511e7bddbcab2256139668415961f4a4976
-
Filesize
26KB
MD5ce61b4f2be3bd15d73410170c5b8dfc4
SHA1f4ce0290d5b79507800a50f804ee7507d2390eb8
SHA2567136d686ccc80986e18d284599cef80c5e633d95df3629f233d36f4b69b942b2
SHA512fe81bfa7c3d6e5b45f1c30d835d60d67a38defa915d6a54023fa0cd21d0fd27774fac7085d9e2ca768ad7c962601afc40e04bb29c357f7c6ebf914f9e89906f4
-
Filesize
165B
MD5ff09371174f7c701e75f357a187c06e8
SHA157f9a638fd652922d7eb23236c80055a91724503
SHA256e4ba04959837c27019a2349015543802439e152ddc4baf4e8c7b9d2b483362a8
SHA512e4d01e5908e9f80b7732473ec6807bb7faa5425e3154d5642350f44d7220af3cffd277e0b67bcf03f1433ac26a26edb3ddd3707715b61d054b979fbb4b453882
-
Filesize
377KB
MD580ade1893dec9cab7f2e63538a464fcc
SHA1c06614da33a65eddb506db00a124a3fc3f5be02e
SHA25657a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
SHA512fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4