Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2023, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe
Resource
win10v2004-20220812-en
General
-
Target
cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe
-
Size
725KB
-
MD5
3ce4460090581f857b90e4f8923ce1b7
-
SHA1
312edc9ce15f7bbd8db19c6eb83419f90d862b04
-
SHA256
cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3
-
SHA512
41089d4c8a4ea064e7eda2a8503b37518e29b1d6b7b1222f3b3160cf41f27507dbb694a5fa53cdb3f96bd20edb4edbe6665889842d2a7c51fe6dd1d61ebc53ad
-
SSDEEP
12288:cMrGy9038qOEsNpp1mPZzRZy+0oTsIoqdIm0hk92Wa6ioV:iyQ4tNpp1IzRg+06sCdIBIia
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Extracted
amadey
3.66
193.233.20.4/t6r48nSa/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" iAA07sv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" iAA07sv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" iAA07sv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" iAA07sv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" iAA07sv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection iAA07sv.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation nwi02gi.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 9 IoCs
pid Process 1540 sqt74Wq.exe 3148 srU14kt.exe 5000 iAA07sv.exe 4252 kPG58HR.exe 1440 ljY95hD.exe 4704 nwi02gi.exe 2320 mnolyk.exe 380 mnolyk.exe 3460 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 1864 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iAA07sv.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sqt74Wq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sqt74Wq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce srU14kt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" srU14kt.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2568 1440 WerFault.exe 86 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 396 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5000 iAA07sv.exe 5000 iAA07sv.exe 4252 kPG58HR.exe 4252 kPG58HR.exe 1440 ljY95hD.exe 1440 ljY95hD.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5000 iAA07sv.exe Token: SeDebugPrivilege 4252 kPG58HR.exe Token: SeDebugPrivilege 1440 ljY95hD.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4084 wrote to memory of 1540 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 80 PID 4084 wrote to memory of 1540 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 80 PID 4084 wrote to memory of 1540 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 80 PID 1540 wrote to memory of 3148 1540 sqt74Wq.exe 81 PID 1540 wrote to memory of 3148 1540 sqt74Wq.exe 81 PID 1540 wrote to memory of 3148 1540 sqt74Wq.exe 81 PID 3148 wrote to memory of 5000 3148 srU14kt.exe 82 PID 3148 wrote to memory of 5000 3148 srU14kt.exe 82 PID 3148 wrote to memory of 4252 3148 srU14kt.exe 83 PID 3148 wrote to memory of 4252 3148 srU14kt.exe 83 PID 3148 wrote to memory of 4252 3148 srU14kt.exe 83 PID 1540 wrote to memory of 1440 1540 sqt74Wq.exe 86 PID 1540 wrote to memory of 1440 1540 sqt74Wq.exe 86 PID 1540 wrote to memory of 1440 1540 sqt74Wq.exe 86 PID 4084 wrote to memory of 4704 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 90 PID 4084 wrote to memory of 4704 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 90 PID 4084 wrote to memory of 4704 4084 cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe 90 PID 4704 wrote to memory of 2320 4704 nwi02gi.exe 91 PID 4704 wrote to memory of 2320 4704 nwi02gi.exe 91 PID 4704 wrote to memory of 2320 4704 nwi02gi.exe 91 PID 2320 wrote to memory of 396 2320 mnolyk.exe 92 PID 2320 wrote to memory of 396 2320 mnolyk.exe 92 PID 2320 wrote to memory of 396 2320 mnolyk.exe 92 PID 2320 wrote to memory of 980 2320 mnolyk.exe 93 PID 2320 wrote to memory of 980 2320 mnolyk.exe 93 PID 2320 wrote to memory of 980 2320 mnolyk.exe 93 PID 980 wrote to memory of 2384 980 cmd.exe 96 PID 980 wrote to memory of 2384 980 cmd.exe 96 PID 980 wrote to memory of 2384 980 cmd.exe 96 PID 980 wrote to memory of 744 980 cmd.exe 97 PID 980 wrote to memory of 744 980 cmd.exe 97 PID 980 wrote to memory of 744 980 cmd.exe 97 PID 980 wrote to memory of 3020 980 cmd.exe 98 PID 980 wrote to memory of 3020 980 cmd.exe 98 PID 980 wrote to memory of 3020 980 cmd.exe 98 PID 980 wrote to memory of 2412 980 cmd.exe 99 PID 980 wrote to memory of 2412 980 cmd.exe 99 PID 980 wrote to memory of 2412 980 cmd.exe 99 PID 980 wrote to memory of 868 980 cmd.exe 100 PID 980 wrote to memory of 868 980 cmd.exe 100 PID 980 wrote to memory of 868 980 cmd.exe 100 PID 980 wrote to memory of 2276 980 cmd.exe 101 PID 980 wrote to memory of 2276 980 cmd.exe 101 PID 980 wrote to memory of 2276 980 cmd.exe 101 PID 2320 wrote to memory of 1864 2320 mnolyk.exe 103 PID 2320 wrote to memory of 1864 2320 mnolyk.exe 103 PID 2320 wrote to memory of 1864 2320 mnolyk.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe"C:\Users\Admin\AppData\Local\Temp\cfb984abd65a35ec345267f2fc02848637b6703b9b8f28942d889c29098d86f3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sqt74Wq.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sqt74Wq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\srU14kt.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\srU14kt.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iAA07sv.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\iAA07sv.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kPG58HR.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kPG58HR.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ljY95hD.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ljY95hD.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 15804⤵
- Program crash
PID:2568
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwi02gi.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwi02gi.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2384
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:744
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:3020
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:2412
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:868
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:2276
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1864
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1440 -ip 14401⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:380
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:3460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
236KB
MD5812b8d76e0cf1e825bbfcf787ebdd902
SHA19f981c60bb4195657340519e13f1422e5cc8967b
SHA2566513d8b8a66e7fe3a4d82164f24b61757dae9bc11db25517edc8bf0d00502f34
SHA5129a2b4081cdc46bcbede11a1933515d73577941d8878ac912f2ab5a699bcf3d0700a99f00791d95fd8e9a7e28e50e5ec96d47214b99eb597f92cf5be089f57bc7
-
Filesize
538KB
MD5db0c8f300777af7645d4e57a48241178
SHA11e179ac94b26db0446c263c567b4b901d053e6db
SHA256e2274638f1cea23c2f2bf94758287548cc7426aed3231e789f9caf4857defc2a
SHA5120102a7b43551afb81d638fd09581eb13071315bf8ad087e204ad268f2652c11fc97e3fe598393f9095b2d9c8438c718c3005d96674aa1e740bab282003d66475
-
Filesize
538KB
MD5db0c8f300777af7645d4e57a48241178
SHA11e179ac94b26db0446c263c567b4b901d053e6db
SHA256e2274638f1cea23c2f2bf94758287548cc7426aed3231e789f9caf4857defc2a
SHA5120102a7b43551afb81d638fd09581eb13071315bf8ad087e204ad268f2652c11fc97e3fe598393f9095b2d9c8438c718c3005d96674aa1e740bab282003d66475
-
Filesize
315KB
MD5f294797a611f6dee63a6fcad56fa3e5a
SHA1b526f47e46b96c55059660891d1260ee0b51d5e7
SHA256ee8c1327dd23846c9c6fdd9eb6930e7bc91b18c31a9291c01fa0e2a6dc462ff2
SHA51215ca26c8bb2affac72d413973d5639ac045c73b1b49c5728a611b5d7624e8d19b0c2b42f24fddd23168da2c60b1b6452dc3454e9799c8c8c284a2ec05343e828
-
Filesize
315KB
MD5f294797a611f6dee63a6fcad56fa3e5a
SHA1b526f47e46b96c55059660891d1260ee0b51d5e7
SHA256ee8c1327dd23846c9c6fdd9eb6930e7bc91b18c31a9291c01fa0e2a6dc462ff2
SHA51215ca26c8bb2affac72d413973d5639ac045c73b1b49c5728a611b5d7624e8d19b0c2b42f24fddd23168da2c60b1b6452dc3454e9799c8c8c284a2ec05343e828
-
Filesize
202KB
MD552d6dbfd46080c7462235493ad368aa3
SHA1094ce7d6c376ebbcb767aa10e77ed87adc35c1c3
SHA2560849bd0144e49b8cdf652a50feffdc17af8334f9d97b1f0de8c0e807fec7e614
SHA51288c29ebacb193b3682bc9a0a32d3fd01ff8781c8b5a97aded8a4eee0737f47dbb2f663322b1b564785329bb923d7156eac202809c14faa0d80c59cb61d640f37
-
Filesize
202KB
MD552d6dbfd46080c7462235493ad368aa3
SHA1094ce7d6c376ebbcb767aa10e77ed87adc35c1c3
SHA2560849bd0144e49b8cdf652a50feffdc17af8334f9d97b1f0de8c0e807fec7e614
SHA51288c29ebacb193b3682bc9a0a32d3fd01ff8781c8b5a97aded8a4eee0737f47dbb2f663322b1b564785329bb923d7156eac202809c14faa0d80c59cb61d640f37
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38
-
Filesize
89KB
MD54cf63b9a3e4bc0910af4d8baa5939238
SHA1361eea9bb65071ebf09d9598fe7a482e487b919f
SHA256dd82c0954f9047eb2a601aefa58eec94c79f71cab58f980a663ae3b8a54a63f9
SHA512177f101609bbdb7a3e423ecb2914b21d3fb91bf1e6267c4a30313b8ae0b5bc49659fc6ce1f1715649b8ee774022a9b045d886f2ba658ef065eefceedeaf7ee38