Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe
-
Size
763KB
-
MD5
e7adb670e2c0b0ce83e465811664f5fe
-
SHA1
51cd23804193da3f2c705bddacea1941443c9c5b
-
SHA256
6df8049e09e985f799b2216e77f1e2e96e2f2e80bb93a2f929b406c8d21068fd
-
SHA512
51cf7c682520e2ca34a68337d9d5bc6b453b358ad1319374caf9ae02a7ec09fd026744c35e836e311cedb7308b5d59ce5ac069c2e73b5d44ec7f78696c32cd56
-
SSDEEP
12288:8wxcFXH/BJrLBO9UsEace+42RFz+WJ5vmmr31br5t7vv7LgRWDrm86sjDojjV8:pcFv9PP75vmWFbr/r7LVrr3jkjx8
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 14 600 msiexec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ctdownloader_4048 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe\" /afterreboot=\"C:\\Users\\Admin\\AppData\\Local\\ci-excel-add-in-v1.3.9_2023931346\"" 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Loads dropped DLL 8 IoCs
pid Process 4388 MsiExec.exe 2988 rundll32.exe 2988 rundll32.exe 2988 rundll32.exe 2988 rundll32.exe 2988 rundll32.exe 4388 MsiExec.exe 4388 MsiExec.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 600 msiexec.exe Token: SeIncreaseQuotaPrivilege 600 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeCreateTokenPrivilege 600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 600 msiexec.exe Token: SeLockMemoryPrivilege 600 msiexec.exe Token: SeIncreaseQuotaPrivilege 600 msiexec.exe Token: SeMachineAccountPrivilege 600 msiexec.exe Token: SeTcbPrivilege 600 msiexec.exe Token: SeSecurityPrivilege 600 msiexec.exe Token: SeTakeOwnershipPrivilege 600 msiexec.exe Token: SeLoadDriverPrivilege 600 msiexec.exe Token: SeSystemProfilePrivilege 600 msiexec.exe Token: SeSystemtimePrivilege 600 msiexec.exe Token: SeProfSingleProcessPrivilege 600 msiexec.exe Token: SeIncBasePriorityPrivilege 600 msiexec.exe Token: SeCreatePagefilePrivilege 600 msiexec.exe Token: SeCreatePermanentPrivilege 600 msiexec.exe Token: SeBackupPrivilege 600 msiexec.exe Token: SeRestorePrivilege 600 msiexec.exe Token: SeShutdownPrivilege 600 msiexec.exe Token: SeDebugPrivilege 600 msiexec.exe Token: SeAuditPrivilege 600 msiexec.exe Token: SeSystemEnvironmentPrivilege 600 msiexec.exe Token: SeChangeNotifyPrivilege 600 msiexec.exe Token: SeRemoteShutdownPrivilege 600 msiexec.exe Token: SeUndockPrivilege 600 msiexec.exe Token: SeSyncAgentPrivilege 600 msiexec.exe Token: SeEnableDelegationPrivilege 600 msiexec.exe Token: SeManageVolumePrivilege 600 msiexec.exe Token: SeImpersonatePrivilege 600 msiexec.exe Token: SeCreateGlobalPrivilege 600 msiexec.exe Token: SeCreateTokenPrivilege 600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 600 msiexec.exe Token: SeLockMemoryPrivilege 600 msiexec.exe Token: SeIncreaseQuotaPrivilege 600 msiexec.exe Token: SeMachineAccountPrivilege 600 msiexec.exe Token: SeTcbPrivilege 600 msiexec.exe Token: SeSecurityPrivilege 600 msiexec.exe Token: SeTakeOwnershipPrivilege 600 msiexec.exe Token: SeLoadDriverPrivilege 600 msiexec.exe Token: SeSystemProfilePrivilege 600 msiexec.exe Token: SeSystemtimePrivilege 600 msiexec.exe Token: SeProfSingleProcessPrivilege 600 msiexec.exe Token: SeIncBasePriorityPrivilege 600 msiexec.exe Token: SeCreatePagefilePrivilege 600 msiexec.exe Token: SeCreatePermanentPrivilege 600 msiexec.exe Token: SeBackupPrivilege 600 msiexec.exe Token: SeRestorePrivilege 600 msiexec.exe Token: SeShutdownPrivilege 600 msiexec.exe Token: SeDebugPrivilege 600 msiexec.exe Token: SeAuditPrivilege 600 msiexec.exe Token: SeSystemEnvironmentPrivilege 600 msiexec.exe Token: SeChangeNotifyPrivilege 600 msiexec.exe Token: SeRemoteShutdownPrivilege 600 msiexec.exe Token: SeUndockPrivilege 600 msiexec.exe Token: SeSyncAgentPrivilege 600 msiexec.exe Token: SeEnableDelegationPrivilege 600 msiexec.exe Token: SeManageVolumePrivilege 600 msiexec.exe Token: SeImpersonatePrivilege 600 msiexec.exe Token: SeCreateGlobalPrivilege 600 msiexec.exe Token: SeCreateTokenPrivilege 600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 600 msiexec.exe Token: SeLockMemoryPrivilege 600 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe 600 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4048 wrote to memory of 600 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe 85 PID 4048 wrote to memory of 600 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe 85 PID 4048 wrote to memory of 600 4048 2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe 85 PID 980 wrote to memory of 4388 980 msiexec.exe 88 PID 980 wrote to memory of 4388 980 msiexec.exe 88 PID 980 wrote to memory of 4388 980 msiexec.exe 88 PID 4388 wrote to memory of 2988 4388 MsiExec.exe 89 PID 4388 wrote to memory of 2988 4388 MsiExec.exe 89 PID 4388 wrote to memory of 2988 4388 MsiExec.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_e7adb670e2c0b0ce83e465811664f5fe_mafia_JC.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931346\SPGlobal.Platts.Excel.AddIn.Setup.msi"2⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:600
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C6D41CB5B9329590BF21D86EB8E762DE C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB045.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240628046 1 SPGlobal.Platts.Excel.AddIn.PlattsCustomAction!SPGlobal.Platts.Excel.AddIn.PlattsCustomAction.CustomActions.PluginInfo3⤵
- Loads dropped DLL
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD56c9009ef395c3b0029f592dc246947ec
SHA185e7625b35f8ea8b1de1da1924b2771257b9bc5b
SHA256938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d
SHA5127dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184
-
Filesize
252KB
MD56c9009ef395c3b0029f592dc246947ec
SHA185e7625b35f8ea8b1de1da1924b2771257b9bc5b
SHA256938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d
SHA5127dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184
-
Filesize
252KB
MD56c9009ef395c3b0029f592dc246947ec
SHA185e7625b35f8ea8b1de1da1924b2771257b9bc5b
SHA256938802ff7b5b7b4394eacb204ef2a4adc0a53bc00be1797dcb9f3bb1c5f1d86d
SHA5127dbfd9165a0e21cd9c2919805cf8625608ff89b1d35e08fdcc17a300896dfdd9d3afe381c3f140c5081dbd0f79d213f06b2a5fd5c277ebcbcf3c3f2c53d3f184
-
Filesize
179KB
MD57f75f7a71b290d7976a33093b75377b9
SHA106412ecd7e0709871bb8836357a0a46fc44744ee
SHA25685abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542
SHA512e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0
-
Filesize
179KB
MD57f75f7a71b290d7976a33093b75377b9
SHA106412ecd7e0709871bb8836357a0a46fc44744ee
SHA25685abc7a38eef2bdadb9e06de6406146decdb7c9a459a4a145629c6504deac542
SHA512e9c62f89b6044450e9033218f48f1f69979060092f6e0572fdcb66334ea5a3cfb03ecfaeafda9e57f534ac03f0e37f11fa38755cd85f7fc42a23f229d3e6b6a0
-
Filesize
20KB
MD596159ed9e09c51c8c1ea3c5014d5c767
SHA1983c4b119d39fbff68909d6875d34776578859a0
SHA256b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce
SHA51246480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226
-
Filesize
20KB
MD596159ed9e09c51c8c1ea3c5014d5c767
SHA1983c4b119d39fbff68909d6875d34776578859a0
SHA256b97729bb7be3ab903c046604052a40e6194a6a0b1eec1763e67428f0a2daf8ce
SHA51246480545be6818628ad1729ee0927dfd90e1059028360dcded5b4264813aa092c0eeac9d71b36fad45e2d56c07693b461aca3ac0aaa514af30bda31dcbccd226
-
Filesize
164KB
MD52002556e19b51e171ee7a29407c531c5
SHA14e5438b8defa9a9960705c1f25b989665dd9af53
SHA25603924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03
SHA512423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84
-
Filesize
164KB
MD52002556e19b51e171ee7a29407c531c5
SHA14e5438b8defa9a9960705c1f25b989665dd9af53
SHA25603924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03
SHA512423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84
-
Filesize
164KB
MD52002556e19b51e171ee7a29407c531c5
SHA14e5438b8defa9a9960705c1f25b989665dd9af53
SHA25603924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03
SHA512423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84
-
Filesize
164KB
MD52002556e19b51e171ee7a29407c531c5
SHA14e5438b8defa9a9960705c1f25b989665dd9af53
SHA25603924ae146c8d02bc746ac5cd3e2f995e76d768ccecca261a535aea8fef3fa03
SHA512423d487974c9f7725d3ad35e052cb40f01c3829692b4c7664545a7a70cccccccdf8e526d1d8cae8d616680a08129386b633b3d6ac8f6b6914e324c5d064b2f84
-
C:\Users\Admin\AppData\Local\ci-excel-add-in-v1.3.9_2023931346\SPGlobal.Platts.Excel.AddIn.Setup.msi
Filesize15.0MB
MD54874aa3db69a8a94cfd957c6e761db92
SHA1c9f0e102a4b86d8a5d7d111bc6321ebb6648b21b
SHA2561950172edcaaf0eefa20b20d81911d9907ff7e19a97f009bcb3b828f20246e9d
SHA512de1303d98fbb50cc8e153ccf0614ed8581c634fa304f5c6e0ebd2a7883312cce674b1091b25005c332751c001a43ea4b08ff4c31832b4d53821100529a955866
-
Filesize
15KB
MD5ad9ae654bbb119c13648c515883fd077
SHA1ae7f8f2e8ea874d82dbebbab8f544dcdecf8d5c6
SHA2562e5b14fe0ada3b8372020239b19739d47e885b633693365bb251ce7e290271c2
SHA51214a670d8957afbf089c239818710ddd83186343a7459804df166c24f69ce1538a5638a7671ca1678aad2be970427d6d05268709831f784ee3c788fcb2a9a2f48