Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 10:40
Behavioral task
behavioral1
Sample
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
Resource
win7-20220901-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe
-
Size
31KB
-
MD5
67fdcca3fe09b1661a34041301bc9df3
-
SHA1
adb88da8da8ad0fba805eaad75a3669eba7dbb15
-
SHA256
1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
-
SHA512
37bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
SSDEEP
768:8yw8PGQtd9Uq24SW6T6etI0L09KwE3/tu/IRXN7+qqAA0q:s81dUwS3DyA08EW1+qFnq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Common Files\\System\\lsasss.exe,C:\\Program Files\\Common Files\\System\\msadc\\system32.exe" 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" lsasss.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\SECdrv2.EXT 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Executes dropped EXE 1 IoCs
pid Process 3624 lsasss.exe -
resource yara_rule behavioral2/memory/3696-132-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3696-133-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0006000000022e49-135.dat upx behavioral2/files/0x0006000000022e49-136.dat upx behavioral2/memory/3696-137-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3624-142-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3624-148-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation lsasss.exe -
Loads dropped DLL 3 IoCs
pid Process 3624 lsasss.exe 3624 lsasss.exe 3624 lsasss.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\vsdertl32.DIG 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\WINDOWS\SysWOW64\vsdertl32.dig lsasss.exe File created C:\Windows\SysWOW64\logo.gif lsasss.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\Smars.sys 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\Smars.SYS 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File created C:\Program Files\Common Files\System\lsasss.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\lsasss.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File created C:\Program Files\Common Files\System\server32.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe File opened for modification C:\Program Files\Common Files\System\server32.exe 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\windows\inf\icuc32.dll lsasss.exe File opened for modification \??\c:\windows\inf\icuc32.dll lsasss.exe File created \??\c:\windows\inf\icucd32.dll lsasss.exe File opened for modification \??\c:\windows\inf\icucd32.dll lsasss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3624 lsasss.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe Token: SeDebugPrivilege 3624 lsasss.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 3624 lsasss.exe 3624 lsasss.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3696 wrote to memory of 3624 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 82 PID 3696 wrote to memory of 3624 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 82 PID 3696 wrote to memory of 3624 3696 1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe 82 PID 3624 wrote to memory of 4268 3624 lsasss.exe 83 PID 3624 wrote to memory of 4268 3624 lsasss.exe 83 PID 3624 wrote to memory of 4268 3624 lsasss.exe 83 PID 3624 wrote to memory of 1304 3624 lsasss.exe 85 PID 3624 wrote to memory of 1304 3624 lsasss.exe 85 PID 3624 wrote to memory of 1304 3624 lsasss.exe 85 PID 4268 wrote to memory of 664 4268 net.exe 87 PID 4268 wrote to memory of 664 4268 net.exe 87 PID 4268 wrote to memory of 664 4268 net.exe 87 PID 1304 wrote to memory of 224 1304 net.exe 88 PID 1304 wrote to memory of 224 1304 net.exe 88 PID 1304 wrote to memory of 224 1304 net.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe"C:\Users\Admin\AppData\Local\Temp\1c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files\Common Files\System\lsasss.exe"C:\Program Files\Common Files\System\lsasss.exe"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:664
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵PID:224
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD567fdcca3fe09b1661a34041301bc9df3
SHA1adb88da8da8ad0fba805eaad75a3669eba7dbb15
SHA2561c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
SHA51237bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
Filesize
31KB
MD567fdcca3fe09b1661a34041301bc9df3
SHA1adb88da8da8ad0fba805eaad75a3669eba7dbb15
SHA2561c155b8af3957cd0ffbdc47d810dc050cc23d3fb3a1d6e280cc739fe56fcb8d7
SHA51237bb6fa873aa317bbd02f8f71f5fb702dd268a30f9415458e7de90fa9284e146e0a4e39e84cc48949e86c7f2b90fcf096f32411f2758c453735cb7b5e4a92234
-
Filesize
102B
MD576fcf78881b0aee32e0c654a5be61964
SHA14525d3716fd7951d80f4963ee6fc94f486d7467c
SHA256a38b65dec45e19d6f7a168af9deb62f4d21c73d2ac9c3145fd0f5d11ad921ba2
SHA5121a78371768f247e37e5fbcb33a992d040ead67cede947bf314a72bac2c3211480109c51da0fcd0941f18ccad087836e7721a56cd5e975039dd649482f71cb8a5
-
Filesize
52KB
MD507aa7eb8ebe704cfede4fc28d175f60e
SHA1a6561c68ce10e942fadaa413d20a85f9d1674f54
SHA25638ecacce7c620951ebee92ab7355f6f2d9e61dc73dde19dccac8209c33cb0e60
SHA51256450428cc4e9e7db82d7d2d90945ab1872f63ced9d82fc65e833fd424ca143e0b2d111aa9ee8cd91553cfb2b23c055dce01d69f0f3e1baec76c60f335a36a33
-
Filesize
28KB
MD5e5c38f0505822aca902a38007fd5399e
SHA15abfb8ee3a01e357489b01ce8f82e88a45cee83c
SHA256968bab3cb2c284ff56cb51aadc14f588dc435a188080b7c4486ad9de7b5637fa
SHA512674e24d567bd2bdd51395c3bd8db33c90a3e452e132b9fc9d6010ac37140af831c2b8448b7cb7a548cb1a1e6573c8f30ee0282e801795e2626e5b7747d2235d3
-
Filesize
28KB
MD5e5c38f0505822aca902a38007fd5399e
SHA15abfb8ee3a01e357489b01ce8f82e88a45cee83c
SHA256968bab3cb2c284ff56cb51aadc14f588dc435a188080b7c4486ad9de7b5637fa
SHA512674e24d567bd2bdd51395c3bd8db33c90a3e452e132b9fc9d6010ac37140af831c2b8448b7cb7a548cb1a1e6573c8f30ee0282e801795e2626e5b7747d2235d3