Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe
-
Size
18.3MB
-
MD5
766570ee2d440ad20d9c66db404aed77
-
SHA1
edcc78d12e0db840d0bba98f32e55d5bb6705f73
-
SHA256
7a066da4ee12ee941bf942f798ab84828c09f60e05f948dc97dff85d4eac4deb
-
SHA512
d1e6d22cfa1c7a6bf9807f2da3d688beae4c2394ef26a13608a5d5046afc9d18253810a35576d924b166f47136e7cd0acdc3957f8e3468a41288cef1e5689264
-
SSDEEP
98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMJ:9nwngnwnO
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 2260 HelpMe.exe -
Loads dropped DLL 2 IoCs
pid Process 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\B: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\E: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\Q: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\Y: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\M: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\Z: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\T: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\W: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\X: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\R: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\S: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\K: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\L: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\V: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\N: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\G: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\H: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\J: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\O: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\U: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\A: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\I: 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened (read-only) \??\V: HelpMe.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File opened for modification F:\AUTORUN.INF HelpMe.exe File opened for modification C:\AUTORUN.INF 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2260 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe 28 PID 2184 wrote to memory of 2260 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe 28 PID 2184 wrote to memory of 2260 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe 28 PID 2184 wrote to memory of 2260 2184 2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.3MB
MD590aae091fa5bdfdce5086c18aff6d2fd
SHA12f6a80ad8d9c03ecf2a27d035af4437daebd99d4
SHA256339b526388063d6c081be1a52d7e5cb53cd37b9f5e8a8cfa642b486101798ee4
SHA512289b2d49bcfe9594403a27393609a4638c87f0cf36973c00d3b674af3f1d0d654731fa08bd1c004247cf5da7bde741093c978d3cba62240505742618c4a6af6b
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
1KB
MD5ff7b730672f8bce93a4f345913008fd6
SHA146ece055875c9548f6959c4d3b662d96be5b6558
SHA25602998aa1ccc7bfd8e638802d8e30a6bf3b49d18d4ff9bb33d9312fb8f9fca816
SHA5123e95fa467c571f8bc66b31fec771254e54696164003066e7dae8b93a382159b0c91d49bba0ed0a989690b6b86469a2cdcad682b7f5018b56480bdf0c2e97d5c7
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
1KB
MD57a79e25a8fbdaaf7d21a74db049caa50
SHA18a5842644359cd32beaf00a97b7eaf1436f439e8
SHA256077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3
SHA512acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0
-
Filesize
954B
MD5568585c2c9d63194fff7d71ec8d2a4db
SHA11b1bed89ae21854e5791e55279f59f7874b9f1b6
SHA25632408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b
SHA51205ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584
-
Filesize
18.3MB
MD5701eeda0ac2b02bb8ee81a7ae0c231ea
SHA114d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e
SHA2566a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9
SHA512caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a
-
Filesize
18.3MB
MD5701eeda0ac2b02bb8ee81a7ae0c231ea
SHA114d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e
SHA2566a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9
SHA512caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a
-
Filesize
18.3MB
MD5701eeda0ac2b02bb8ee81a7ae0c231ea
SHA114d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e
SHA2566a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9
SHA512caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
18.3MB
MD5766570ee2d440ad20d9c66db404aed77
SHA1edcc78d12e0db840d0bba98f32e55d5bb6705f73
SHA2567a066da4ee12ee941bf942f798ab84828c09f60e05f948dc97dff85d4eac4deb
SHA512d1e6d22cfa1c7a6bf9807f2da3d688beae4c2394ef26a13608a5d5046afc9d18253810a35576d924b166f47136e7cd0acdc3957f8e3468a41288cef1e5689264
-
Filesize
18.3MB
MD5701eeda0ac2b02bb8ee81a7ae0c231ea
SHA114d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e
SHA2566a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9
SHA512caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a
-
Filesize
18.3MB
MD5701eeda0ac2b02bb8ee81a7ae0c231ea
SHA114d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e
SHA2566a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9
SHA512caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a