Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2023, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe
Resource
win10v2004-20220812-en
General
-
Target
1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe
-
Size
728KB
-
MD5
1b7147ca2b5abd1181d227891a41b59f
-
SHA1
ebeb49367fd0b85217f5f061bb23f722e1336821
-
SHA256
1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43
-
SHA512
a05fbdeb817cd808dfb12f39afdb4fdc31937274cd5f4a15932d0461a2caa7cbe1904c9b1e0d2c251242f137c8812f2745b97dd9fa629a3b13e43bf66a1456e1
-
SSDEEP
12288:xMrDy90LJE5AiVZcHHWkfkB1IPS94LLjES+s88+qZIPKjgp4tFXGkJNt59rrooW6:Ky7AiUWnB1In7is88+qZIgFXzbUo+dzy
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection rci96Oz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" rci96Oz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" rci96Oz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" rci96Oz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rci96Oz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" rci96Oz.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mAt99.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 9 IoCs
pid Process 3960 sgr51BK.exe 4440 soj05Zm.exe 400 kts27Fb.exe 2588 mAt99.exe 2420 mnolyk.exe 1244 npo31uv.exe 1032 rci96Oz.exe 3792 mnolyk.exe 2512 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 3276 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rci96Oz.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sgr51BK.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sgr51BK.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce soj05Zm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" soj05Zm.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4404 1244 WerFault.exe 85 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 788 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 400 kts27Fb.exe 400 kts27Fb.exe 1244 npo31uv.exe 1244 npo31uv.exe 1032 rci96Oz.exe 1032 rci96Oz.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 400 kts27Fb.exe Token: SeDebugPrivilege 1244 npo31uv.exe Token: SeDebugPrivilege 1032 rci96Oz.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4808 wrote to memory of 3960 4808 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe 80 PID 4808 wrote to memory of 3960 4808 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe 80 PID 4808 wrote to memory of 3960 4808 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe 80 PID 3960 wrote to memory of 4440 3960 sgr51BK.exe 81 PID 3960 wrote to memory of 4440 3960 sgr51BK.exe 81 PID 3960 wrote to memory of 4440 3960 sgr51BK.exe 81 PID 4440 wrote to memory of 400 4440 soj05Zm.exe 82 PID 4440 wrote to memory of 400 4440 soj05Zm.exe 82 PID 4440 wrote to memory of 400 4440 soj05Zm.exe 82 PID 4440 wrote to memory of 2588 4440 soj05Zm.exe 83 PID 4440 wrote to memory of 2588 4440 soj05Zm.exe 83 PID 4440 wrote to memory of 2588 4440 soj05Zm.exe 83 PID 2588 wrote to memory of 2420 2588 mAt99.exe 84 PID 2588 wrote to memory of 2420 2588 mAt99.exe 84 PID 2588 wrote to memory of 2420 2588 mAt99.exe 84 PID 3960 wrote to memory of 1244 3960 sgr51BK.exe 85 PID 3960 wrote to memory of 1244 3960 sgr51BK.exe 85 PID 3960 wrote to memory of 1244 3960 sgr51BK.exe 85 PID 2420 wrote to memory of 788 2420 mnolyk.exe 86 PID 2420 wrote to memory of 788 2420 mnolyk.exe 86 PID 2420 wrote to memory of 788 2420 mnolyk.exe 86 PID 2420 wrote to memory of 1084 2420 mnolyk.exe 88 PID 2420 wrote to memory of 1084 2420 mnolyk.exe 88 PID 2420 wrote to memory of 1084 2420 mnolyk.exe 88 PID 1084 wrote to memory of 1132 1084 cmd.exe 90 PID 1084 wrote to memory of 1132 1084 cmd.exe 90 PID 1084 wrote to memory of 1132 1084 cmd.exe 90 PID 1084 wrote to memory of 2676 1084 cmd.exe 91 PID 1084 wrote to memory of 2676 1084 cmd.exe 91 PID 1084 wrote to memory of 2676 1084 cmd.exe 91 PID 1084 wrote to memory of 3204 1084 cmd.exe 92 PID 1084 wrote to memory of 3204 1084 cmd.exe 92 PID 1084 wrote to memory of 3204 1084 cmd.exe 92 PID 1084 wrote to memory of 1816 1084 cmd.exe 93 PID 1084 wrote to memory of 1816 1084 cmd.exe 93 PID 1084 wrote to memory of 1816 1084 cmd.exe 93 PID 1084 wrote to memory of 1460 1084 cmd.exe 94 PID 1084 wrote to memory of 1460 1084 cmd.exe 94 PID 1084 wrote to memory of 1460 1084 cmd.exe 94 PID 1084 wrote to memory of 3740 1084 cmd.exe 95 PID 1084 wrote to memory of 3740 1084 cmd.exe 95 PID 1084 wrote to memory of 3740 1084 cmd.exe 95 PID 4808 wrote to memory of 1032 4808 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe 103 PID 4808 wrote to memory of 1032 4808 1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe 103 PID 2420 wrote to memory of 3276 2420 mnolyk.exe 108 PID 2420 wrote to memory of 3276 2420 mnolyk.exe 108 PID 2420 wrote to memory of 3276 2420 mnolyk.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe"C:\Users\Admin\AppData\Local\Temp\1804b523cb5327dadc9031767cc26a9f039a61448a159006575b667381b33c43.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sgr51BK.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sgr51BK.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\soj05Zm.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\soj05Zm.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kts27Fb.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kts27Fb.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mAt99.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mAt99.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F6⤵
- Creates scheduled task(s)
PID:788
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"7⤵PID:2676
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E7⤵PID:3204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1816
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"7⤵PID:1460
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E7⤵PID:3740
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3276
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\npo31uv.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\npo31uv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 18964⤵
- Program crash
PID:4404
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rci96Oz.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rci96Oz.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1244 -ip 12441⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:3792
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:2512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
624KB
MD567eb291a7102b0d477ae348a259423e5
SHA140ba9952ed43d1d0b0cdae5d4747d0b21dfe4a8c
SHA2562bc8d2623c42451d39e1d56fdafa94ae17c1d9034cc341046e7ad288927d6e03
SHA512d680fc4f0e37a4fb726c375e5bc3c1bab35f279149dda5182e90c70a36e7f94da52988fd02631addde1eb9276e5da0d8d6c6c24e14bb30babd7785e1e2d15dbb
-
Filesize
624KB
MD567eb291a7102b0d477ae348a259423e5
SHA140ba9952ed43d1d0b0cdae5d4747d0b21dfe4a8c
SHA2562bc8d2623c42451d39e1d56fdafa94ae17c1d9034cc341046e7ad288927d6e03
SHA512d680fc4f0e37a4fb726c375e5bc3c1bab35f279149dda5182e90c70a36e7f94da52988fd02631addde1eb9276e5da0d8d6c6c24e14bb30babd7785e1e2d15dbb
-
Filesize
306KB
MD544aee1861e5f2d4f001fcc570dfb4468
SHA1a8341f8adabde95dc3465b23601052a7e1bd60e8
SHA256c0acee57b9df5bd9f0cdc471c05d5797c8df24f11b6ac21959781f3fe234a287
SHA51297a08b33f3ed6ceea8e12cd011bcda6c3316da2e0192e2d7db6464ae1843725e795f1559e05b48cbde32d008b4943c10f5c0957e5cd4dd10a4310ec10bb3fa1c
-
Filesize
306KB
MD544aee1861e5f2d4f001fcc570dfb4468
SHA1a8341f8adabde95dc3465b23601052a7e1bd60e8
SHA256c0acee57b9df5bd9f0cdc471c05d5797c8df24f11b6ac21959781f3fe234a287
SHA51297a08b33f3ed6ceea8e12cd011bcda6c3316da2e0192e2d7db6464ae1843725e795f1559e05b48cbde32d008b4943c10f5c0957e5cd4dd10a4310ec10bb3fa1c
-
Filesize
286KB
MD58c3ac945a8d41a0b91173520b9c3f3ed
SHA148f1bd98e0d4f01036e1d399f5dcca4e6670bec6
SHA256343f4c10505dae99cfc8e1ab348154014383db2fdc0c3c63eccdcdfce6c89a7a
SHA51210e1365c45b0d093b2b6281d4a7da0a41b62a494a1f3460e5fcdf3a9e43aea7dbc24ddeeab393dcf40265fc8f33c84ce18d2874e968fde11e6e05ebbc3023ca8
-
Filesize
286KB
MD58c3ac945a8d41a0b91173520b9c3f3ed
SHA148f1bd98e0d4f01036e1d399f5dcca4e6670bec6
SHA256343f4c10505dae99cfc8e1ab348154014383db2fdc0c3c63eccdcdfce6c89a7a
SHA51210e1365c45b0d093b2b6281d4a7da0a41b62a494a1f3460e5fcdf3a9e43aea7dbc24ddeeab393dcf40265fc8f33c84ce18d2874e968fde11e6e05ebbc3023ca8
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3