Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/07/2023, 02:52
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp.exe
-
Size
801KB
-
MD5
55bf28cbd852233ddf8de2f24dad5787
-
SHA1
98a8794770fc469bf03c0c9d2a49230146add536
-
SHA256
2dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
-
SHA512
339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
SSDEEP
12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MMAj:GnsJ39LyjbJkQFMhmC+6GD993
Malware Config
Signatures
-
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 17 IoCs
resource yara_rule behavioral1/files/0x0009000000012023-58.dat family_runningrat behavioral1/files/0x0009000000012023-60.dat family_runningrat behavioral1/files/0x0009000000012023-61.dat family_runningrat behavioral1/files/0x0009000000012023-64.dat family_runningrat behavioral1/files/0x0028000000013461-70.dat family_runningrat behavioral1/files/0x0028000000013461-80.dat family_runningrat behavioral1/files/0x0028000000013461-83.dat family_runningrat behavioral1/memory/1528-88-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/files/0x0028000000013461-87.dat family_runningrat behavioral1/files/0x0028000000013461-94.dat family_runningrat behavioral1/files/0x0028000000013461-93.dat family_runningrat behavioral1/files/0x0007000000015cd5-95.dat family_runningrat behavioral1/files/0x0007000000015cd5-97.dat family_runningrat behavioral1/files/0x0007000000015cd5-100.dat family_runningrat behavioral1/memory/2424-136-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/2424-138-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat behavioral1/memory/2424-168-0x0000000000400000-0x00000000004CE000-memory.dmp family_runningrat -
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remocte4\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259425435.dll" ._cache_tmp.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remocte4\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259427182.dll" ._cache_Synaptics.exe -
Executes dropped EXE 4 IoCs
pid Process 1304 ._cache_tmp.exe 2424 Synaptics.exe 1788 ._cache_Synaptics.exe 760 Remocte4.exe -
Loads dropped DLL 15 IoCs
pid Process 1528 tmp.exe 1528 tmp.exe 1304 ._cache_tmp.exe 2172 svchost.exe 1528 tmp.exe 1528 tmp.exe 2424 Synaptics.exe 2424 Synaptics.exe 2424 Synaptics.exe 1788 ._cache_Synaptics.exe 2172 svchost.exe 760 Remocte4.exe 760 Remocte4.exe 760 Remocte4.exe 760 Remocte4.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" tmp.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remocte4.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remocte4.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Remocte4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Remocte4.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Remocte4.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Remocte4.exe Key created \REGISTRY\USER\.DEFAULT\Software Remocte4.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2964 PING.EXE 1952 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 584 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1304 ._cache_tmp.exe 1788 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1304 ._cache_tmp.exe Token: SeIncBasePriorityPrivilege 1788 ._cache_Synaptics.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1304 ._cache_tmp.exe 1788 ._cache_Synaptics.exe 584 EXCEL.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1304 1528 tmp.exe 28 PID 1528 wrote to memory of 1304 1528 tmp.exe 28 PID 1528 wrote to memory of 1304 1528 tmp.exe 28 PID 1528 wrote to memory of 1304 1528 tmp.exe 28 PID 1528 wrote to memory of 2424 1528 tmp.exe 31 PID 1528 wrote to memory of 2424 1528 tmp.exe 31 PID 1528 wrote to memory of 2424 1528 tmp.exe 31 PID 1528 wrote to memory of 2424 1528 tmp.exe 31 PID 1304 wrote to memory of 2740 1304 ._cache_tmp.exe 32 PID 1304 wrote to memory of 2740 1304 ._cache_tmp.exe 32 PID 1304 wrote to memory of 2740 1304 ._cache_tmp.exe 32 PID 1304 wrote to memory of 2740 1304 ._cache_tmp.exe 32 PID 2740 wrote to memory of 2964 2740 cmd.exe 34 PID 2740 wrote to memory of 2964 2740 cmd.exe 34 PID 2740 wrote to memory of 2964 2740 cmd.exe 34 PID 2740 wrote to memory of 2964 2740 cmd.exe 34 PID 2424 wrote to memory of 1788 2424 Synaptics.exe 35 PID 2424 wrote to memory of 1788 2424 Synaptics.exe 35 PID 2424 wrote to memory of 1788 2424 Synaptics.exe 35 PID 2424 wrote to memory of 1788 2424 Synaptics.exe 35 PID 1788 wrote to memory of 1568 1788 ._cache_Synaptics.exe 38 PID 1788 wrote to memory of 1568 1788 ._cache_Synaptics.exe 38 PID 1788 wrote to memory of 1568 1788 ._cache_Synaptics.exe 38 PID 1788 wrote to memory of 1568 1788 ._cache_Synaptics.exe 38 PID 1568 wrote to memory of 1952 1568 cmd.exe 39 PID 1568 wrote to memory of 1952 1568 cmd.exe 39 PID 1568 wrote to memory of 1952 1568 cmd.exe 39 PID 1568 wrote to memory of 1952 1568 cmd.exe 39 PID 2172 wrote to memory of 760 2172 svchost.exe 40 PID 2172 wrote to memory of 760 2172 svchost.exe 40 PID 2172 wrote to memory of 760 2172 svchost.exe 40 PID 2172 wrote to memory of 760 2172 svchost.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 14⤵
- Runs ping.exe
PID:2964
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 15⤵
- Runs ping.exe
PID:1952
-
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte4"1⤵PID:2824
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remocte4"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\Remocte4.exeC:\Windows\system32\Remocte4.exe "c:\users\admin\appdata\local\temp\259425435.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:760
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
801KB
MD555bf28cbd852233ddf8de2f24dad5787
SHA198a8794770fc469bf03c0c9d2a49230146add536
SHA2562dc388e62caa2497c4ba6a3a17b39a82a9f0cb9ec21921f893381215d82f073f
SHA512339b33fc1fd2dc8cee2f5b223a18af993781e3c164344023b6b14724d6d86704200af40ab46307b19507c0309f057e6ec1269363ad7252bce91a75aa5a320b06
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
48KB
MD5b5c1093105c64255b496c73b41105a2d
SHA1222eb6df5009b93341a53a8c02212315b68a4ef4
SHA2562df8338dd020d2d2fdb734d2c9a463fe6e2a0dc5e45d4c2426e5336f1f29f328
SHA512aa0188f823190c5825261ac35ec38b1fd4abb1e3b1e8c3908467dc7b1bc5110fe19ac6f71a5ffb42afdceb1795bf860bfbf0b2307251c3e4f56b570b031a46bf
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
25KB
MD5bd104dbf1faf517017be79792c5b2a26
SHA1b811c6aa66e9bd81a309cdd251b7f90e9c7c876f
SHA2561e818ad49f2b4fd9c0de3886c1d0fffd006ba1ae4021e7b17b896cc3dfaa591b
SHA5122047235525c0b72dbf70c19480df5fcc6fcd99bebc404b90bc7d646f5a12680eb04aecb7a85022f419f1d268470550b5b7ce2c971d131950759a32e68c4416f9
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d