Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1100.exe
windows7-x64
8100.exe
windows10-2004-x64
10101.exe
windows7-x64
1101.exe
windows10-2004-x64
1102.exe
windows7-x64
8102.exe
windows10-2004-x64
5103.exe
windows7-x64
8103.exe
windows10-2004-x64
1105.exe
windows7-x64
10105.exe
windows10-2004-x64
10106.exe
windows7-x64
8106.exe
windows10-2004-x64
1107.exe
windows7-x64
6107.exe
windows10-2004-x64
6108.exe
windows7-x64
10108.exe
windows10-2004-x64
10109.exe
windows7-x64
10109.exe
windows10-2004-x64
5110.exe
windows7-x64
10110.exe
windows10-2004-x64
10111.exe
windows7-x64
10111.exe
windows10-2004-x64
10112.exe
windows7-x64
8112.exe
windows10-2004-x64
7113.exe
windows7-x64
10113.exe
windows10-2004-x64
10114.exe
windows7-x64
10114.exe
windows10-2004-x64
8115.exe
windows7-x64
10115.exe
windows10-2004-x64
10116.exe
windows7-x64
8116.exe
windows10-2004-x64
7Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
100.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
100.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
101.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
101.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
102.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
102.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
103.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
103.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
105.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
105.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
106.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
106.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
107.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
107.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
108.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
108.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
109.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
109.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
110.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
110.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
111.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
111.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
112.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
112.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
113.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
113.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
114.exe
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
114.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
115.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
115.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
116.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
116.exe
Resource
win10v2004-20221111-en
General
-
Target
105.exe
-
Size
555KB
-
MD5
6494681c2245762c201fb9d0168a400f
-
SHA1
eaf39ecfb2648ac66f8e60bf63558f3d72fd9928
-
SHA256
e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb
-
SHA512
7e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c
-
SSDEEP
12288:9rI128T22OA9bwbz8elTAOJlB1CrbFFXi:Vr8T2iJwbz80MOzurbfS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\file.exe" 105.exe -
Executes dropped EXE 2 IoCs
pid Process 3508 tmp.exe 3516 Sample .exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gipkhwvqs.exe tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gipkhwvqs.exe\DisableExceptionChainValidation tmp.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 105.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation tmp.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe cmd.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus tmp.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\ProgramData\taskmanagr\desktop.ini tmp.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 3068 105.exe 3068 105.exe 3068 105.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3068 set thread context of 3516 3068 105.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 4484 3516 WerFault.exe 86 988 4484 WerFault.exe 93 2680 2324 WerFault.exe 96 3096 1352 WerFault.exe 98 -
Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 cmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 timeout.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 105.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 cmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 timeout.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 105.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 105.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 timeout.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 444 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1352 timeout.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1}\57B80732\CG1 tmp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID tmp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1} tmp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1}\57B80732 tmp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1}\57B80732\CG1\HAL = 05ee0000 tmp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1}\57B80732\CG1\BID = 200008001b000b00e6070000140000001b00010037000d000000000081c38263 tmp.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\CLSID\{5963D861-8D74-B941-924D-DB25600CD3A1}\57B80732\CS1 105.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3068 105.exe 3068 105.exe 3068 105.exe 2324 cmd.exe 2324 cmd.exe 1352 timeout.exe 1352 timeout.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3508 tmp.exe 3508 tmp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3068 105.exe Token: 33 3068 105.exe Token: SeIncBasePriorityPrivilege 3068 105.exe Token: SeRestorePrivilege 3508 tmp.exe Token: SeBackupPrivilege 3508 tmp.exe Token: SeDebugPrivilege 3508 tmp.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3068 wrote to memory of 4832 3068 105.exe 80 PID 3068 wrote to memory of 4832 3068 105.exe 80 PID 3068 wrote to memory of 4832 3068 105.exe 80 PID 4832 wrote to memory of 5060 4832 cmd.exe 82 PID 4832 wrote to memory of 5060 4832 cmd.exe 82 PID 4832 wrote to memory of 5060 4832 cmd.exe 82 PID 5060 wrote to memory of 3504 5060 wscript.exe 84 PID 5060 wrote to memory of 3504 5060 wscript.exe 84 PID 5060 wrote to memory of 3504 5060 wscript.exe 84 PID 3068 wrote to memory of 3508 3068 105.exe 83 PID 3068 wrote to memory of 3508 3068 105.exe 83 PID 3068 wrote to memory of 3508 3068 105.exe 83 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3068 wrote to memory of 3516 3068 105.exe 86 PID 3508 wrote to memory of 444 3508 tmp.exe 89 PID 3508 wrote to memory of 444 3508 tmp.exe 89 PID 3508 wrote to memory of 444 3508 tmp.exe 89 PID 3508 wrote to memory of 732 3508 tmp.exe 91 PID 3508 wrote to memory of 732 3508 tmp.exe 91 PID 3508 wrote to memory of 732 3508 tmp.exe 91 PID 3068 wrote to memory of 2324 3068 105.exe 96 PID 3068 wrote to memory of 2324 3068 105.exe 96 PID 3068 wrote to memory of 2324 3068 105.exe 96 PID 2324 wrote to memory of 1352 2324 cmd.exe 98 PID 2324 wrote to memory of 1352 2324 cmd.exe 98 PID 2324 wrote to memory of 1352 2324 cmd.exe 98 PID 3068 wrote to memory of 3840 3068 105.exe 99 PID 3068 wrote to memory of 3840 3068 105.exe 99 PID 3068 wrote to memory of 3840 3068 105.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\105.exe"C:\Users\Admin\AppData\Local\Temp\105.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat" "4⤵
- Drops startup file
PID:3504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x57B80732" /TR "C:\ProgramData\taskmanagr\gipkhwvqs.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:444
-
-
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵PID:732
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sample .exe"C:\Users\Admin\AppData\Local\Temp\Sample .exe"2⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 2203⤵
- Program crash
PID:4484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 10604⤵
- Program crash
PID:988
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\Sample.bat" "2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\timeout.exetimeout /t 603⤵
- Checks processor information in registry
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
PID:1352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 7444⤵
- Program crash
PID:3096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 7363⤵
- Program crash
PID:2680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderName\melt.bat2⤵PID:3840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3516 -ip 35161⤵PID:1340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4484 -ip 44841⤵PID:884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2324 -ip 23241⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1352 -ip 13521⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3096 -ip 30961⤵PID:4616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD5f8c040e23e296396fdf4cce9ee677d43
SHA13a575ef818fbfd1956029320ead8d9856f020ee9
SHA2569715cca86ed251841f2fb00c40fe14b91836389d47a2936afb938d1bc39d5616
SHA512b24b0ff7bef8fad791cf14fc8e2c3a74db3d4ab668ce13e10fa4a9964228020ca59b84455b81ef1800e1d816351b16198978289d3a395b69a2421769289d8422
-
Filesize
555KB
MD56494681c2245762c201fb9d0168a400f
SHA1eaf39ecfb2648ac66f8e60bf63558f3d72fd9928
SHA256e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb
SHA5127e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c
-
Filesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
Filesize
69B
MD5c96a3b31fc4a115c977ce5d8a3256f4f
SHA18c71b0d75099af30ac1fe33266e3970b47ba716d
SHA256a5b672a4863abcf46556d2e606b2833e8897a3206e554ad93043a82a792df49e
SHA512f4337e85ca0b3c0242c35a09f1ff7154c9e37ea3c7de3c2337385fb4b57e25a8550877ce2f37d023c94a3fa69b2b4e003207790297879d29a5bbe4856d0a0f48
-
Filesize
176B
MD5b77f8e41f69f39412b204cc781212baa
SHA138d70fce7d44d1935955cf4b519664c7969d5989
SHA25605ebddcab0758b634954345905825e611eed207bbbb989e6dded1e3476e5deab
SHA5128b404359b8c854822fb97262c55dad5293a75d353ba2a2210840c9fbbea96e3ff985856601bb6ca4d10bc21effb3af33558e0c2d9c90128133ae35fe09dccb61
-
Filesize
59B
MD5b0eb48a7f0a6aeddc2988b4a7537e3ed
SHA1f6a962a41cb488842090c382d50f38355d4f841b
SHA2561b2f0b3fb664bec03f4cefb1e5eaf62a783ce23634c1b5d32d2d4be5ef43337d
SHA5129342136bc75293ebcd5e57de754b2192605cb4ba782ae1c6519906955ff2d26cbad56804c251a7fcf8f683cb00af87839a8acc478fbc35d23791b7af0e9b4562
-
Filesize
555KB
MD56494681c2245762c201fb9d0168a400f
SHA1eaf39ecfb2648ac66f8e60bf63558f3d72fd9928
SHA256e9904b7bcc2f754d895f293be21430c96f8278a449f48a346cf68036782dbfbb
SHA5127e63b20e05fb894757505e99db8e43927e98bb5bcd0f84a5e035187536fedda5f5441711c5e22168fe59dbe5224cd7acf7836cb1e65a4dfd4b38e95dd8fce62c
-
Filesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
Filesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
Filesize
138KB
MD55cbe878aad90028cd68922cc9f68c944
SHA1aea8f03a9044383ba33a032b78a266bf90e7b4ea
SHA2566496b48f6fe928df02ed016e7d7394ff73ad111e69f8db5aaee8ff8e3e5eac38
SHA51277a183b80d40df596f9c264eeea8ae5c28592c52da59efc31330ead3b9330f74e4ccb5c00120208b35e2fea554456bf5728b45886da13e4daefac9f8c049cf74
-
Filesize
138KB
MD55cbe878aad90028cd68922cc9f68c944
SHA1aea8f03a9044383ba33a032b78a266bf90e7b4ea
SHA2566496b48f6fe928df02ed016e7d7394ff73ad111e69f8db5aaee8ff8e3e5eac38
SHA51277a183b80d40df596f9c264eeea8ae5c28592c52da59efc31330ead3b9330f74e4ccb5c00120208b35e2fea554456bf5728b45886da13e4daefac9f8c049cf74