Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2023, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe
Resource
win10v2004-20230703-en
General
-
Target
705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe
-
Size
703KB
-
MD5
813ab31bc19323400ab2e83d90088548
-
SHA1
91395a8db58bcd52f4e9b9ee652ee1b3a044673e
-
SHA256
705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967
-
SHA512
78f45e5b8a10d8ff14c8c6ad75c10d05cfa11b50f1e36b530283b5bc6ab90755f8eedd835c7c480eeeee6f111e15ac87cf7d5b957a2f5eb0514cca85c619226d
-
SSDEEP
12288:MMrdy90BLVct5mYoOf4N3PJWIe9LJTPdpFg/y31s3pK+oSVUvXL:5y2dHOA4LJTPdo/0wpxoSVaXL
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
rota
77.91.124.73:19071
-
auth_value
320c7daa59eb9b82e20a15162392a756
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x0007000000023243-26.dat healer behavioral1/files/0x0007000000023243-27.dat healer behavioral1/memory/772-28-0x0000000000240000-0x000000000024A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g4327042.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection g4327042.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g4327042.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g4327042.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g4327042.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g4327042.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 3972 x1514543.exe 3776 x3645679.exe 2412 x0180645.exe 772 g4327042.exe 4536 h5303881.exe 800 saves.exe 1772 i6021099.exe 2848 saves.exe 636 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 1948 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" g4327042.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1514543.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x3645679.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x0180645.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 216 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2532 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 772 g4327042.exe 772 g4327042.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 772 g4327042.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1876 wrote to memory of 3972 1876 705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe 81 PID 1876 wrote to memory of 3972 1876 705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe 81 PID 1876 wrote to memory of 3972 1876 705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe 81 PID 3972 wrote to memory of 3776 3972 x1514543.exe 82 PID 3972 wrote to memory of 3776 3972 x1514543.exe 82 PID 3972 wrote to memory of 3776 3972 x1514543.exe 82 PID 3776 wrote to memory of 2412 3776 x3645679.exe 83 PID 3776 wrote to memory of 2412 3776 x3645679.exe 83 PID 3776 wrote to memory of 2412 3776 x3645679.exe 83 PID 2412 wrote to memory of 772 2412 x0180645.exe 84 PID 2412 wrote to memory of 772 2412 x0180645.exe 84 PID 2412 wrote to memory of 4536 2412 x0180645.exe 90 PID 2412 wrote to memory of 4536 2412 x0180645.exe 90 PID 2412 wrote to memory of 4536 2412 x0180645.exe 90 PID 4536 wrote to memory of 800 4536 h5303881.exe 91 PID 4536 wrote to memory of 800 4536 h5303881.exe 91 PID 4536 wrote to memory of 800 4536 h5303881.exe 91 PID 3776 wrote to memory of 1772 3776 x3645679.exe 92 PID 3776 wrote to memory of 1772 3776 x3645679.exe 92 PID 3776 wrote to memory of 1772 3776 x3645679.exe 92 PID 800 wrote to memory of 2532 800 saves.exe 93 PID 800 wrote to memory of 2532 800 saves.exe 93 PID 800 wrote to memory of 2532 800 saves.exe 93 PID 800 wrote to memory of 4860 800 saves.exe 95 PID 800 wrote to memory of 4860 800 saves.exe 95 PID 800 wrote to memory of 4860 800 saves.exe 95 PID 4860 wrote to memory of 4792 4860 cmd.exe 97 PID 4860 wrote to memory of 4792 4860 cmd.exe 97 PID 4860 wrote to memory of 4792 4860 cmd.exe 97 PID 4860 wrote to memory of 1804 4860 cmd.exe 98 PID 4860 wrote to memory of 1804 4860 cmd.exe 98 PID 4860 wrote to memory of 1804 4860 cmd.exe 98 PID 4860 wrote to memory of 4712 4860 cmd.exe 99 PID 4860 wrote to memory of 4712 4860 cmd.exe 99 PID 4860 wrote to memory of 4712 4860 cmd.exe 99 PID 4860 wrote to memory of 4796 4860 cmd.exe 100 PID 4860 wrote to memory of 4796 4860 cmd.exe 100 PID 4860 wrote to memory of 4796 4860 cmd.exe 100 PID 4860 wrote to memory of 1900 4860 cmd.exe 101 PID 4860 wrote to memory of 1900 4860 cmd.exe 101 PID 4860 wrote to memory of 1900 4860 cmd.exe 101 PID 4860 wrote to memory of 1400 4860 cmd.exe 102 PID 4860 wrote to memory of 1400 4860 cmd.exe 102 PID 4860 wrote to memory of 1400 4860 cmd.exe 102 PID 800 wrote to memory of 1948 800 saves.exe 109 PID 800 wrote to memory of 1948 800 saves.exe 109 PID 800 wrote to memory of 1948 800 saves.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe"C:\Users\Admin\AppData\Local\Temp\705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:772
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:2532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4792
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1804
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4796
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:1900
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:1400
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:1948
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exe4⤵
- Executes dropped EXE
PID:1772
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2848
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:636
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:216
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD54bcf8831b2b71731f301b3321cad85a4
SHA14a02d0e86a760884140358b122a3871a7f6304b9
SHA256e15f1b72674a327be49162ecbd1a30d6ce19b4e75e7835cf1e094a5963a66faf
SHA5120ab5f6f73af38bdf6a03bc0bbe6fa00d9f3c04e9f881254c3c587839e514c5a1167effc1069594699db90805249c68176b0dbfcee240ea2b856518c45f820175
-
Filesize
599KB
MD54bcf8831b2b71731f301b3321cad85a4
SHA14a02d0e86a760884140358b122a3871a7f6304b9
SHA256e15f1b72674a327be49162ecbd1a30d6ce19b4e75e7835cf1e094a5963a66faf
SHA5120ab5f6f73af38bdf6a03bc0bbe6fa00d9f3c04e9f881254c3c587839e514c5a1167effc1069594699db90805249c68176b0dbfcee240ea2b856518c45f820175
-
Filesize
433KB
MD58eb152d45ac805d906f9f25c4338155b
SHA1863659a06edeb56eb86e22bc7b354b543dfade7e
SHA2569ea175dacdbfe2d99d3632e277d2ef8b2cc3c1164b40e826fe3e0aa722bc9886
SHA51236f4cd6272a0bebafd554215a73731919be945ab35a2098a182abc9fee4e96eb0a18a6c521edad0942a2e3a4e36b537b62c37ade28b07ba036aa2fc02ba60eb5
-
Filesize
433KB
MD58eb152d45ac805d906f9f25c4338155b
SHA1863659a06edeb56eb86e22bc7b354b543dfade7e
SHA2569ea175dacdbfe2d99d3632e277d2ef8b2cc3c1164b40e826fe3e0aa722bc9886
SHA51236f4cd6272a0bebafd554215a73731919be945ab35a2098a182abc9fee4e96eb0a18a6c521edad0942a2e3a4e36b537b62c37ade28b07ba036aa2fc02ba60eb5
-
Filesize
174KB
MD553d5b5e4316f1f3a407969dd56ee6e10
SHA11d4677dd666b31f0bebf511158570b08812d6e74
SHA25631c255124806c4971c9ecde8a0e9dcf42246a50d356d73360e8c3ba71d034684
SHA5129063e4d39eff536fbd01984a5b29c5fab3e6da07591bc580ed88e9846e641943c924668805cd2c011fbcf4a906abf81e5ab095cf35222e969d450d34b2d43e4f
-
Filesize
174KB
MD553d5b5e4316f1f3a407969dd56ee6e10
SHA11d4677dd666b31f0bebf511158570b08812d6e74
SHA25631c255124806c4971c9ecde8a0e9dcf42246a50d356d73360e8c3ba71d034684
SHA5129063e4d39eff536fbd01984a5b29c5fab3e6da07591bc580ed88e9846e641943c924668805cd2c011fbcf4a906abf81e5ab095cf35222e969d450d34b2d43e4f
-
Filesize
277KB
MD560cadc2e0e76e4f4c93c02e9f3c87a05
SHA14be06232bcc0f29576cbf19179b62d55decfa031
SHA25603df9935890383470e1be5ef60aef7da9b534b3e68333089d34d0d808ec2eaeb
SHA51254faf0c2e1505ffdf5e1b979bba8d8b601f65154cccaa81921ae25c1b87cbac0f4bc738cd12939671a6c8742a47499bc3e88a5523da752a6e7e8110045c08b20
-
Filesize
277KB
MD560cadc2e0e76e4f4c93c02e9f3c87a05
SHA14be06232bcc0f29576cbf19179b62d55decfa031
SHA25603df9935890383470e1be5ef60aef7da9b534b3e68333089d34d0d808ec2eaeb
SHA51254faf0c2e1505ffdf5e1b979bba8d8b601f65154cccaa81921ae25c1b87cbac0f4bc738cd12939671a6c8742a47499bc3e88a5523da752a6e7e8110045c08b20
-
Filesize
12KB
MD5d9329c67516015f6c60fa97126d87e81
SHA1b487e2e0137c01b60f57a93f34a87934ed5561d8
SHA2561e8215b9c166914d206b8ae74919fae1f776a3f4aaaeaf648f269a484955c6fd
SHA512fef11428be61f386ef2290a6403f77664f9d8c2503631a10c86f2ea547d2ee09f260d5cacf37a75ff972451daba376e78fe4a2ccd0f996cb4cb35f17f3226e53
-
Filesize
12KB
MD5d9329c67516015f6c60fa97126d87e81
SHA1b487e2e0137c01b60f57a93f34a87934ed5561d8
SHA2561e8215b9c166914d206b8ae74919fae1f776a3f4aaaeaf648f269a484955c6fd
SHA512fef11428be61f386ef2290a6403f77664f9d8c2503631a10c86f2ea547d2ee09f260d5cacf37a75ff972451daba376e78fe4a2ccd0f996cb4cb35f17f3226e53
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
316KB
MD59aaed0adc96706b26a7908d0712cc82e
SHA1d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf
SHA2569d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4
SHA512a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7