Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03/02/2023, 06:41
Behavioral task
behavioral1
Sample
54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe
Resource
win10-20220812-en
General
-
Target
54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe
-
Size
1.3MB
-
MD5
25d46b1e562b6c6e6cc6962e469d250a
-
SHA1
c8e3af1006c8179f8c5a6fdcf2ab78994745c943
-
SHA256
54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89
-
SHA512
2bd50adac22201fdcdda6bef600cee9c878ff6452c7afab71f1e911fe02794cf5f7edd0187ab454890e45c7a078292a9cc47ee74f8e020fe426c94267ad6c653
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4828 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4488 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4540 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3388 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4556 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4296 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3380 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 4900 schtasks.exe 70 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 4900 schtasks.exe 70 -
resource yara_rule behavioral1/files/0x000800000001ac26-284.dat dcrat behavioral1/files/0x000800000001ac26-285.dat dcrat behavioral1/memory/3728-286-0x00000000007D0000-0x00000000008E0000-memory.dmp dcrat behavioral1/files/0x000600000001ac38-472.dat dcrat behavioral1/files/0x000600000001ac38-473.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 3728 DllCommonsvc.exe 4920 System.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\0a1fd5f707cd16 DllCommonsvc.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\OCR\en-us\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Windows\PLA\ShellExperienceHost.exe DllCommonsvc.exe File created C:\Windows\PLA\f8c8f1285d826b DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4492 schtasks.exe 4788 schtasks.exe 3388 schtasks.exe 4112 schtasks.exe 4828 schtasks.exe 4488 schtasks.exe 4296 schtasks.exe 3380 schtasks.exe 3988 schtasks.exe 4808 schtasks.exe 4540 schtasks.exe 4556 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings 54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe Key created \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3728 DllCommonsvc.exe 3728 DllCommonsvc.exe 3728 DllCommonsvc.exe 5076 powershell.exe 5060 powershell.exe 5000 powershell.exe 5048 powershell.exe 5060 powershell.exe 5028 powershell.exe 5000 powershell.exe 5048 powershell.exe 5076 powershell.exe 5028 powershell.exe 5060 powershell.exe 5000 powershell.exe 5048 powershell.exe 5076 powershell.exe 5028 powershell.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe 4920 System.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4920 System.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3728 DllCommonsvc.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 5000 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeIncreaseQuotaPrivilege 5000 powershell.exe Token: SeSecurityPrivilege 5000 powershell.exe Token: SeTakeOwnershipPrivilege 5000 powershell.exe Token: SeLoadDriverPrivilege 5000 powershell.exe Token: SeSystemProfilePrivilege 5000 powershell.exe Token: SeSystemtimePrivilege 5000 powershell.exe Token: SeProfSingleProcessPrivilege 5000 powershell.exe Token: SeIncBasePriorityPrivilege 5000 powershell.exe Token: SeCreatePagefilePrivilege 5000 powershell.exe Token: SeBackupPrivilege 5000 powershell.exe Token: SeRestorePrivilege 5000 powershell.exe Token: SeShutdownPrivilege 5000 powershell.exe Token: SeDebugPrivilege 5000 powershell.exe Token: SeSystemEnvironmentPrivilege 5000 powershell.exe Token: SeRemoteShutdownPrivilege 5000 powershell.exe Token: SeUndockPrivilege 5000 powershell.exe Token: SeManageVolumePrivilege 5000 powershell.exe Token: 33 5000 powershell.exe Token: 34 5000 powershell.exe Token: 35 5000 powershell.exe Token: 36 5000 powershell.exe Token: SeIncreaseQuotaPrivilege 5060 powershell.exe Token: SeSecurityPrivilege 5060 powershell.exe Token: SeTakeOwnershipPrivilege 5060 powershell.exe Token: SeLoadDriverPrivilege 5060 powershell.exe Token: SeSystemProfilePrivilege 5060 powershell.exe Token: SeSystemtimePrivilege 5060 powershell.exe Token: SeProfSingleProcessPrivilege 5060 powershell.exe Token: SeIncBasePriorityPrivilege 5060 powershell.exe Token: SeCreatePagefilePrivilege 5060 powershell.exe Token: SeBackupPrivilege 5060 powershell.exe Token: SeRestorePrivilege 5060 powershell.exe Token: SeShutdownPrivilege 5060 powershell.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeSystemEnvironmentPrivilege 5060 powershell.exe Token: SeRemoteShutdownPrivilege 5060 powershell.exe Token: SeUndockPrivilege 5060 powershell.exe Token: SeManageVolumePrivilege 5060 powershell.exe Token: 33 5060 powershell.exe Token: 34 5060 powershell.exe Token: 35 5060 powershell.exe Token: 36 5060 powershell.exe Token: SeIncreaseQuotaPrivilege 5048 powershell.exe Token: SeSecurityPrivilege 5048 powershell.exe Token: SeTakeOwnershipPrivilege 5048 powershell.exe Token: SeLoadDriverPrivilege 5048 powershell.exe Token: SeSystemProfilePrivilege 5048 powershell.exe Token: SeSystemtimePrivilege 5048 powershell.exe Token: SeProfSingleProcessPrivilege 5048 powershell.exe Token: SeIncBasePriorityPrivilege 5048 powershell.exe Token: SeCreatePagefilePrivilege 5048 powershell.exe Token: SeBackupPrivilege 5048 powershell.exe Token: SeRestorePrivilege 5048 powershell.exe Token: SeShutdownPrivilege 5048 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe Token: SeSystemEnvironmentPrivilege 5048 powershell.exe Token: SeRemoteShutdownPrivilege 5048 powershell.exe Token: SeUndockPrivilege 5048 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2892 2780 54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe 66 PID 2780 wrote to memory of 2892 2780 54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe 66 PID 2780 wrote to memory of 2892 2780 54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe 66 PID 2892 wrote to memory of 3792 2892 WScript.exe 67 PID 2892 wrote to memory of 3792 2892 WScript.exe 67 PID 2892 wrote to memory of 3792 2892 WScript.exe 67 PID 3792 wrote to memory of 3728 3792 cmd.exe 69 PID 3792 wrote to memory of 3728 3792 cmd.exe 69 PID 3728 wrote to memory of 5076 3728 DllCommonsvc.exe 83 PID 3728 wrote to memory of 5076 3728 DllCommonsvc.exe 83 PID 3728 wrote to memory of 5060 3728 DllCommonsvc.exe 92 PID 3728 wrote to memory of 5060 3728 DllCommonsvc.exe 92 PID 3728 wrote to memory of 5000 3728 DllCommonsvc.exe 90 PID 3728 wrote to memory of 5000 3728 DllCommonsvc.exe 90 PID 3728 wrote to memory of 5028 3728 DllCommonsvc.exe 89 PID 3728 wrote to memory of 5028 3728 DllCommonsvc.exe 89 PID 3728 wrote to memory of 5048 3728 DllCommonsvc.exe 85 PID 3728 wrote to memory of 5048 3728 DllCommonsvc.exe 85 PID 3728 wrote to memory of 1788 3728 DllCommonsvc.exe 93 PID 3728 wrote to memory of 1788 3728 DllCommonsvc.exe 93 PID 1788 wrote to memory of 2860 1788 cmd.exe 95 PID 1788 wrote to memory of 2860 1788 cmd.exe 95 PID 1788 wrote to memory of 4920 1788 cmd.exe 97 PID 1788 wrote to memory of 4920 1788 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe"C:\Users\Admin\AppData\Local\Temp\54f19d4dd79f6c073574b87ef134450657c3af629f7f86162cdc1458c4f4eb89.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\ShellExperienceHost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wNTtu0xY4N.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:2860
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4920
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\ShellExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Windows\PLA\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\ShellExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
Filesize
1KB
MD52d116e8679fd5ff93604994021a5b201
SHA1b6c46a2765e3ca7e62c0461206b3639625008b8e
SHA256b43b8017c4fdfe92d452c68a2ae6725c6b92c9e2dbda8ac20472dd2bcf0d9391
SHA51266bdce95a5a7daf9a09c3eeb8747ff25ff40f15b30f108ddb63d3a24d7e2f1abf069193e68776582ff023737656fc452cbcd40f69f2e651182d911a724424e8b
-
Filesize
1KB
MD52d116e8679fd5ff93604994021a5b201
SHA1b6c46a2765e3ca7e62c0461206b3639625008b8e
SHA256b43b8017c4fdfe92d452c68a2ae6725c6b92c9e2dbda8ac20472dd2bcf0d9391
SHA51266bdce95a5a7daf9a09c3eeb8747ff25ff40f15b30f108ddb63d3a24d7e2f1abf069193e68776582ff023737656fc452cbcd40f69f2e651182d911a724424e8b
-
Filesize
1KB
MD5afd05e01b026fbdb5a9f50d21a07f1f1
SHA17411a9846e8b431efa59e2227a3b26534a7f0a6e
SHA2563a12a600b472f289640dc254824bd6038bd5102a89e47df6669fd5eac2f474b8
SHA512311d6b6d9baa12d11dfa8e6a99dc034637144587adb58e3faac81cd4e4ed7ff7148880474c1223e3faaca1ac16011a9ffe2c3a65a2aad1fe865a8b5b236d9b90
-
Filesize
1KB
MD5ffbb82bfd54680ea7d07469c31bbe5fd
SHA12553410b780cefec9f86920d84d04ad249e2b007
SHA256789c5762984fd461cfa19e5dc6cf2bc996d8d091c5b603bb259848ce8054656c
SHA512c2777e3f8dba2dc38c9c39c3ae72ab337c0cd2c384edc202b148ddd34d0e90de39a60de78703c073a52c23711e84d4f456ca4d924b210cddcae1bb05b9a0f7a3
-
Filesize
197B
MD5d60b6fc4330d3d8760d572cf12e7f018
SHA1cde8f91ff15a0e739ae91e5b746d2654a4c2d3b7
SHA256fffc86bb2e4b92bdae9723d599293e53051ab3f5ccd7cd852e24ff3bb1aa410e
SHA512e1f414ca8ffa40c5cca21a7ebfbad5085e9c3ab656f0102372208c1199b6d3e810301d0421f2704bd36fd3c1b6111ecdec8ab3564f347f2c4e825e70f7418c81
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478