Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 19:11
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
6KB
-
MD5
06303600a3a44eb2fbce248eb0fe9fc1
-
SHA1
ccfb720a50808469da5d67eea306d08f51e11538
-
SHA256
db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
-
SHA512
b135f23760aba312cb0c0cab697d2ec4f735f5cad9011d3b11310eb9cc59f65c4ffdc757e4f39bdcf6c8abb3badb6865301ffd5ed817c1251b6ecabe21f17df9
-
SSDEEP
192:DfaOBqbo/qmA2LEnrtDINynT+vCgcJXB:OOY8tLqltJXB
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 1.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 2.exe -
Drops startup file 9 IoCs
description ioc Process File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe 4.exe File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe 4.exe File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe 4.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk wic.exe File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_240635640 4.exe File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe 4.exe File opened for modification C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe 4.exe File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe 4.exe File created C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk wic.exe -
Executes dropped EXE 9 IoCs
pid Process 3964 1.exe 4308 ._cache_1.exe 2760 Synaptics.exe 2252 ._cache_Synaptics.exe 3276 2.exe 3128 3.exe 2304 ._cache_2.exe 5008 4.exe 4100 wic.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 1.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini LogonUI.exe -
resource yara_rule behavioral2/memory/2260-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x0007000000023caa-22.dat upx behavioral2/memory/4308-53-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2252-153-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/files/0x0007000000023cb9-233.dat upx behavioral2/memory/3128-244-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2260-278-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2260-297-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2252-307-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/4308-309-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/3128-312-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\1.exe file.exe File created C:\Program Files (x86)\2.exe file.exe File created C:\Program Files (x86)\3.exe file.exe File created C:\Program Files (x86)\4.exe file.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2229298842\3177373409.pri LogonUI.exe File created C:\Windows\wic.exe file.exe File created C:\Windows\cbas.exe wic.exe File created C:\Windows\msslac.dll wic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000} LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000}\MaxCapacity = "14116" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{62c5c1e3-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f7a980434a5ddb01 LogonUI.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1916 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4824 shutdown.exe Token: SeRemoteShutdownPrivilege 4824 shutdown.exe Token: SeShutdownPrivilege 1552 LogonUI.exe Token: SeCreatePagefilePrivilege 1552 LogonUI.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2260 file.exe 1916 EXCEL.EXE 1916 EXCEL.EXE 1916 EXCEL.EXE 1916 EXCEL.EXE 2304 ._cache_2.exe 2304 ._cache_2.exe 4100 wic.exe 4100 wic.exe 1552 LogonUI.exe 1916 EXCEL.EXE 1916 EXCEL.EXE 1552 LogonUI.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2260 wrote to memory of 3964 2260 file.exe 82 PID 2260 wrote to memory of 3964 2260 file.exe 82 PID 2260 wrote to memory of 3964 2260 file.exe 82 PID 3964 wrote to memory of 4308 3964 1.exe 83 PID 3964 wrote to memory of 4308 3964 1.exe 83 PID 3964 wrote to memory of 4308 3964 1.exe 83 PID 3964 wrote to memory of 2760 3964 1.exe 84 PID 3964 wrote to memory of 2760 3964 1.exe 84 PID 3964 wrote to memory of 2760 3964 1.exe 84 PID 2760 wrote to memory of 2252 2760 Synaptics.exe 85 PID 2760 wrote to memory of 2252 2760 Synaptics.exe 85 PID 2760 wrote to memory of 2252 2760 Synaptics.exe 85 PID 2260 wrote to memory of 3276 2260 file.exe 88 PID 2260 wrote to memory of 3276 2260 file.exe 88 PID 2260 wrote to memory of 3276 2260 file.exe 88 PID 2260 wrote to memory of 3128 2260 file.exe 89 PID 2260 wrote to memory of 3128 2260 file.exe 89 PID 2260 wrote to memory of 3128 2260 file.exe 89 PID 3276 wrote to memory of 2304 3276 2.exe 92 PID 3276 wrote to memory of 2304 3276 2.exe 92 PID 3276 wrote to memory of 2304 3276 2.exe 92 PID 2260 wrote to memory of 5008 2260 file.exe 94 PID 2260 wrote to memory of 5008 2260 file.exe 94 PID 2260 wrote to memory of 5008 2260 file.exe 94 PID 2260 wrote to memory of 4100 2260 file.exe 95 PID 2260 wrote to memory of 4100 2260 file.exe 95 PID 2260 wrote to memory of 4100 2260 file.exe 95 PID 4100 wrote to memory of 5040 4100 wic.exe 99 PID 4100 wrote to memory of 5040 4100 wic.exe 99 PID 4100 wrote to memory of 5040 4100 wic.exe 99 PID 5040 wrote to memory of 4824 5040 cmd.exe 101 PID 5040 wrote to memory of 4824 5040 cmd.exe 101 PID 5040 wrote to memory of 4824 5040 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\1.exe"C:\Program Files (x86)\1.exe" 02⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\._cache_1.exe"C:\Users\Admin\AppData\Local\Temp\._cache_1.exe" 03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4308
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2252
-
-
-
-
C:\Program Files (x86)\2.exe"C:\Program Files (x86)\2.exe" 02⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\._cache_2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2.exe" 03⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
-
C:\Program Files (x86)\3.exe"C:\Program Files (x86)\3.exe" 02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128
-
-
C:\Program Files (x86)\4.exe"C:\Program Files (x86)\4.exe" 02⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5008
-
-
C:\Windows\wic.exe"C:\Windows\wic.exe" 02⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "shutdown /r /t 0"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\shutdown.exeshutdown /r /t 04⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1916
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b1055 /state1:0x41c64e6d1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
811KB
MD5d026cfe00b08da14b0a8b7f8860887d7
SHA108ef96351067f151c19b9cc21605ea018fb43a18
SHA256e261d309f30de33a1ba0aa43604db15f3326c6c8c5b291bdd52f18ea361fe3dd
SHA5124ef560ff8c6a9a143b9365884c0c999a1fbf5ee638f170ad96add2b8b56933038d573cb31f45724a7f1a7b6a35cd2557344bd55c746fc9e9da38ecd3bdd6361d
-
Filesize
9KB
MD51edb88f9ee745eaaee2cbd8219318eb0
SHA16561c12d51090972b6f866f38f8ed281c5c83313
SHA2560ac1125284e2600d3714c0226f800f4d8d9aa291fa299bb1d33b7d8984b5e1c0
SHA512a2a20a70c9e1db729f716706796027a5c9002ad000e75c0dced3ece6f26d76ee0803acc31d3a116266e711ec6a16d33c0668412238dfe0f128f3a841232ff4c5
-
Filesize
338KB
MD539e7be73c7531ac895f75834fdc1bcd6
SHA1646b88b488cf673c38b56fe7748c70b31bb29fc3
SHA256a176e32335d81e69906f1c062e62247e97b8863f2c6148a36713e5bed5d16195
SHA512e5c34ef2d309ef2071495a359999b9f8dbeb6d7db1daa67e82494d71b0f1e888d0958b5a503cb3b0e505b70f26cfefe362d6301599143bedb40a19fdb60ef072
-
C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-4089630652-1596403869-279772308-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg
Filesize220KB
MD580566f868b32e8759c408a7fd3147de0
SHA1775701a29d313f2b4e366eda4655ec699adce479
SHA256011506346f284f70c4b8423ce67cec69a1a61b93d95e0e516aa6347a916515b5
SHA5124db3627505d973c1ecd9f88fe1495bcb1b3d242550a5033def4d9c3312c12e2e7073b5a904cc50cae76d7bb19f77f83535f217e9e9f2b3c93008a756819d9853
-
Filesize
4.4MB
MD585a57509db3e9dfa7b4e451b8243220d
SHA1ee21f93372218959f8b3dcefaa2c680d857e9e52
SHA256fcd8d4592cf92fb9f9235a2774cdc8aff4265d4015269fb7aa995182f8ce26e1
SHA512104615f2366e06cbba58a87f2e01d6806c1871c29af8277e06fcdb385f4ae6beb37c3bafd861c320a01303a287a68ae9b5d8640f29a39c21fe38ad9803ebe00d
-
Filesize
58KB
MD5aed710082d6986c6dceed09d3a5edcc6
SHA102456d21cef29be4cb63004aea6aa225a90fd882
SHA2565cbe5888cd034b95b14f4ad7c63f84f9c9bc605558c5cc484e26c13f1978399e
SHA5124bccab62e816e296becd7318ff76d8fefa1f1cd25bdfcfb092c4424f3cc37e9edb46c90dae78d364c4406c954eaf75a6e18b7499d51b164d1ddf0136e4f52050
-
Filesize
3.7MB
MD5b7176450aebb9572b34e875984456ac1
SHA15d9d1824c5c235dcfc82e6e3af48b63d70016393
SHA256f78dcb1b389c99240befde490f8c74d9c9487f54e1f523397aa056072003a4c2
SHA5124c9aba9b92972312c87d2b875246b22dafcb49a0f519291fba823ce57dd9282e25489a7cddf7dfb432caa921602db6266b0e625aae780845824f91cf48d8f85d
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
3.3MB
MD56ad65b03e75bc5509ba3104510178ee6
SHA1dba73f97938d2dab4bf8fb8076b363db82ad3a16
SHA2564d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6
SHA512976c7aba50e17271f6aea4ab80e7bc89e68727164d98d99566e0752b4989d716a849b0cc53f0321a53dce6086ef4cab1604aae8456ce76bfeacf185137aa8ba8