Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2023, 19:11
Static task
static1
General
-
Target
f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe
-
Size
582KB
-
MD5
bb2625881d3493d7eebe3abcabe9503c
-
SHA1
74a6b22f57e2d9652f3a642ee138d8f192f80a68
-
SHA256
f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87
-
SHA512
7951263446ac0baf2a48196a38daaa686b2a3195e8bfd66c39db089709f828ddfbcf4dfd23c223e2078738e3214f7f948ff780430f4381ccd4c7ad105e014ae7
-
SSDEEP
12288:+Mr+y90YYOwaMAhN4pis8fjM0YOnvo+PZhvbG+J4twoK:kydYFDiDfjXA+PHK+1
Malware Config
Extracted
redline
dedo
83.97.73.130:19061
-
auth_value
ac76f7438fbe49011f900c651cb85e26
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Extracted
redline
grega
83.97.73.130:19061
-
auth_value
16e2fbc2847b2270b3f0679e2dd76c8d
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g2959014.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection g2959014.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g2959014.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g2959014.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g2959014.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g2959014.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation h2796452.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation rugen.exe -
Executes dropped EXE 9 IoCs
pid Process 5040 x6201821.exe 1924 x4032871.exe 1556 f6480441.exe 4064 g2959014.exe 1420 h2796452.exe 3068 rugen.exe 4100 i9050119.exe 4752 rugen.exe 3096 rugen.exe -
Loads dropped DLL 1 IoCs
pid Process 3832 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g2959014.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x4032871.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x6201821.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x6201821.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x4032871.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5088 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1556 f6480441.exe 1556 f6480441.exe 4064 g2959014.exe 4064 g2959014.exe 4100 i9050119.exe 4100 i9050119.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1556 f6480441.exe Token: SeDebugPrivilege 4064 g2959014.exe Token: SeDebugPrivilege 4100 i9050119.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1420 h2796452.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4280 wrote to memory of 5040 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 83 PID 4280 wrote to memory of 5040 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 83 PID 4280 wrote to memory of 5040 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 83 PID 5040 wrote to memory of 1924 5040 x6201821.exe 84 PID 5040 wrote to memory of 1924 5040 x6201821.exe 84 PID 5040 wrote to memory of 1924 5040 x6201821.exe 84 PID 1924 wrote to memory of 1556 1924 x4032871.exe 85 PID 1924 wrote to memory of 1556 1924 x4032871.exe 85 PID 1924 wrote to memory of 1556 1924 x4032871.exe 85 PID 1924 wrote to memory of 4064 1924 x4032871.exe 90 PID 1924 wrote to memory of 4064 1924 x4032871.exe 90 PID 5040 wrote to memory of 1420 5040 x6201821.exe 93 PID 5040 wrote to memory of 1420 5040 x6201821.exe 93 PID 5040 wrote to memory of 1420 5040 x6201821.exe 93 PID 1420 wrote to memory of 3068 1420 h2796452.exe 94 PID 1420 wrote to memory of 3068 1420 h2796452.exe 94 PID 1420 wrote to memory of 3068 1420 h2796452.exe 94 PID 4280 wrote to memory of 4100 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 95 PID 4280 wrote to memory of 4100 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 95 PID 4280 wrote to memory of 4100 4280 f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe 95 PID 3068 wrote to memory of 5088 3068 rugen.exe 97 PID 3068 wrote to memory of 5088 3068 rugen.exe 97 PID 3068 wrote to memory of 5088 3068 rugen.exe 97 PID 3068 wrote to memory of 4240 3068 rugen.exe 99 PID 3068 wrote to memory of 4240 3068 rugen.exe 99 PID 3068 wrote to memory of 4240 3068 rugen.exe 99 PID 4240 wrote to memory of 5084 4240 cmd.exe 101 PID 4240 wrote to memory of 5084 4240 cmd.exe 101 PID 4240 wrote to memory of 5084 4240 cmd.exe 101 PID 4240 wrote to memory of 4648 4240 cmd.exe 102 PID 4240 wrote to memory of 4648 4240 cmd.exe 102 PID 4240 wrote to memory of 4648 4240 cmd.exe 102 PID 4240 wrote to memory of 1928 4240 cmd.exe 103 PID 4240 wrote to memory of 1928 4240 cmd.exe 103 PID 4240 wrote to memory of 1928 4240 cmd.exe 103 PID 4240 wrote to memory of 3320 4240 cmd.exe 104 PID 4240 wrote to memory of 3320 4240 cmd.exe 104 PID 4240 wrote to memory of 3320 4240 cmd.exe 104 PID 4240 wrote to memory of 5112 4240 cmd.exe 105 PID 4240 wrote to memory of 5112 4240 cmd.exe 105 PID 4240 wrote to memory of 5112 4240 cmd.exe 105 PID 4240 wrote to memory of 1712 4240 cmd.exe 106 PID 4240 wrote to memory of 1712 4240 cmd.exe 106 PID 4240 wrote to memory of 1712 4240 cmd.exe 106 PID 3068 wrote to memory of 3832 3068 rugen.exe 109 PID 3068 wrote to memory of 3832 3068 rugen.exe 109 PID 3068 wrote to memory of 3832 3068 rugen.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe"C:\Users\Admin\AppData\Local\Temp\f20df15c49e9660a125a740e82b9591014f7e11b0676dc409e53ab208525cf87.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6201821.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4032871.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6480441.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g2959014.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h2796452.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F5⤵
- Creates scheduled task(s)
PID:5088
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5084
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:N"6⤵PID:4648
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:R" /E6⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3320
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:N"6⤵PID:5112
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:R" /E6⤵PID:1712
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3832
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9050119.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:4752
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:3096
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
267KB
MD52cb3aa66517988b50f997418f9a4c362
SHA13b5bd879a9223aa8d36a524087aa10545e70eb7a
SHA25694a25fca893444cb23a553921cc12f2b498870414ca6958a00bd178a93a82166
SHA51287910f35882e18715118d86c46b7178d3ec4e8264eeb5d123b6befbb717a94925da6b0c6351f8eeabb56fef7b7d699a2d19881659b1fd11cbecdab120a5e2aec
-
Filesize
267KB
MD52cb3aa66517988b50f997418f9a4c362
SHA13b5bd879a9223aa8d36a524087aa10545e70eb7a
SHA25694a25fca893444cb23a553921cc12f2b498870414ca6958a00bd178a93a82166
SHA51287910f35882e18715118d86c46b7178d3ec4e8264eeb5d123b6befbb717a94925da6b0c6351f8eeabb56fef7b7d699a2d19881659b1fd11cbecdab120a5e2aec
-
Filesize
377KB
MD5ecbbc005d9a3d45ea2cfaba13b5530f2
SHA119487487b0ecb1932a9c6c7c7717869c603fd297
SHA25640239b16bc3a759b565651296de7fed86ef61ae505edd37549fdf32c104db482
SHA512d45a186947e0c6adc07f935cccfb883e2ee696953a91b7e871db630c706626f86561a7946e7b738502f747e8cd5ee0d79706c20a8ce0c068dd28e0fd8baa44bd
-
Filesize
377KB
MD5ecbbc005d9a3d45ea2cfaba13b5530f2
SHA119487487b0ecb1932a9c6c7c7717869c603fd297
SHA25640239b16bc3a759b565651296de7fed86ef61ae505edd37549fdf32c104db482
SHA512d45a186947e0c6adc07f935cccfb883e2ee696953a91b7e871db630c706626f86561a7946e7b738502f747e8cd5ee0d79706c20a8ce0c068dd28e0fd8baa44bd
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
Filesize
205KB
MD575c64fb9537164edb124e4a208fbd44a
SHA1d488638e8431d5c7c670bc53c4c1fda48f2b3c65
SHA2564bb318bb4935dbe5bb423afcf968a6570427c5d7fe780c9ecf42d7914388ba38
SHA512f1a7d324d24cb8148c58e6e2984a143ce071d63c7f8e4f491836c36a59b057ed03d7009a9719e07b419e6b0f4c213980baa086a6bc5c36944d33fb08d6a8a069
-
Filesize
205KB
MD575c64fb9537164edb124e4a208fbd44a
SHA1d488638e8431d5c7c670bc53c4c1fda48f2b3c65
SHA2564bb318bb4935dbe5bb423afcf968a6570427c5d7fe780c9ecf42d7914388ba38
SHA512f1a7d324d24cb8148c58e6e2984a143ce071d63c7f8e4f491836c36a59b057ed03d7009a9719e07b419e6b0f4c213980baa086a6bc5c36944d33fb08d6a8a069
-
Filesize
172KB
MD549038638c23ea3d9cbd17c8179b798af
SHA15788e447aa77bba06f6139d074e37730972ad559
SHA256b79ba334f75484966321aecdda26b667250105928d465f7d6775e5713803a578
SHA512666f8f366968e151abbfa2ea572a3460e618a3cb9e5d7715ebb51da3afc8ccfc7ff15c573c2026801ce3864129d8990df39b6d46c36898158e1ace9030fcda7f
-
Filesize
172KB
MD549038638c23ea3d9cbd17c8179b798af
SHA15788e447aa77bba06f6139d074e37730972ad559
SHA256b79ba334f75484966321aecdda26b667250105928d465f7d6775e5713803a578
SHA512666f8f366968e151abbfa2ea572a3460e618a3cb9e5d7715ebb51da3afc8ccfc7ff15c573c2026801ce3864129d8990df39b6d46c36898158e1ace9030fcda7f
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5