Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe
-
Size
276KB
-
MD5
90c17b27ee224075d35101dfd7c6a960
-
SHA1
7960df78627fde4256f8e0b482b8d137359085f8
-
SHA256
039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436
-
SHA512
a44c1fff241531d79d074e2877f08f9a7f03fdc5dc3f8b04c954bc40c41034713261e0563a7356636a3a071197b45d61e065a3edf48e4b92e5a740249df02eba
-
SSDEEP
1536:5vC89v1DLFfHk/X6tnfknHzQ0X0WytH0uL2JPWNoSfrVrBrerdrMfUVx6YBQsPm4:Q+aisPm8HuQM+
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zmxev.exe -
Executes dropped EXE 1 IoCs
pid Process 3680 zmxev.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /s" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /v" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /t" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /l" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /C" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /q" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /Q" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /n" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /p" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /R" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /S" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /J" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /G" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /L" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /P" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /E" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /y" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /h" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /x" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /b" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /K" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /u" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /M" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /j" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /c" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /d" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /B" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /g" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /m" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /k" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /D" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /T" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /e" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /o" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /O" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /Z" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /a" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /W" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /f" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /Y" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /X" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /w" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /i" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /N" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /V" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /z" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /H" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /A" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /I" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /r" zmxev.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /F" zmxev.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zmxev = "C:\\Users\\Admin\\zmxev.exe /U" zmxev.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe 3680 zmxev.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3704 039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe 3680 zmxev.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 3680 3704 039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe 82 PID 3704 wrote to memory of 3680 3704 039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe 82 PID 3704 wrote to memory of 3680 3704 039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe 82 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81 PID 3680 wrote to memory of 3704 3680 zmxev.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe"C:\Users\Admin\AppData\Local\Temp\039f3f00e5922158eb9778e5477f4e74354bc87d8d1027d2e08ef97fa62eb436.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\zmxev.exe"C:\Users\Admin\zmxev.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5582120277b83811aca9a039d6de64301
SHA12028049b5f0206269bdb5bd5895253e17a20845b
SHA25672240f90d2961722ce4c4d63efce06d4acf856cbe7af554b9908bc5c99b15d4f
SHA512730c078e59684a72677fc613f135775d3f1cbda987b83fc5b064785c9de75ac2e277d66a98226f45fa969e79f46c8e5ebdb054ea524d71f0d7030893ceb47483
-
Filesize
276KB
MD5582120277b83811aca9a039d6de64301
SHA12028049b5f0206269bdb5bd5895253e17a20845b
SHA25672240f90d2961722ce4c4d63efce06d4acf856cbe7af554b9908bc5c99b15d4f
SHA512730c078e59684a72677fc613f135775d3f1cbda987b83fc5b064785c9de75ac2e277d66a98226f45fa969e79f46c8e5ebdb054ea524d71f0d7030893ceb47483