Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4a923dddfd11cd8fb13976bf59689860.dll
Resource
win7-20231020-en
General
-
Target
NEAS.4a923dddfd11cd8fb13976bf59689860.dll
-
Size
120KB
-
MD5
4a923dddfd11cd8fb13976bf59689860
-
SHA1
c8f3f44b427038af1e25f762bff581d2b0185852
-
SHA256
5cbc78d517dea4c29b3d486e39806e8c96f13c0960f03ba12b9d11f039ac8c85
-
SHA512
749d07d6bb3a392e9bafcbc9969cd400c53aa08bc6745862cff32d7d3d9fc879a0e3a53237dcdf96dd8305f4a6a6e064fa73e1d1811958138b8010f1e17a6500
-
SSDEEP
3072:jK7YuNSrkEt4O6C6+IfXMWpLk3oEqvbdFFkbT:u7YuN57C6+mK35oFk
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e583fa4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583fa4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e583fa4.exe -
Executes dropped EXE 3 IoCs
pid Process 3116 e583fa4.exe 224 e5843bb.exe 1860 e584b1d.exe -
resource yara_rule behavioral2/memory/3116-6-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-20-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-24-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-25-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-26-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-41-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-31-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-43-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-44-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-46-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-47-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-58-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-59-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-60-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-62-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3116-65-0x00000000007B0000-0x000000000186A000-memory.dmp upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e583fa4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e583fa4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583fa4.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e583fa4.exe File opened (read-only) \??\G: e583fa4.exe File opened (read-only) \??\H: e583fa4.exe File opened (read-only) \??\I: e583fa4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e583fa4.exe File created C:\Windows\e58414a e583fa4.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3116 e583fa4.exe 3116 e583fa4.exe 3116 e583fa4.exe 3116 e583fa4.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe Token: SeDebugPrivilege 3116 e583fa4.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 3380 wrote to memory of 4436 3380 rundll32.exe 14 PID 3380 wrote to memory of 4436 3380 rundll32.exe 14 PID 3380 wrote to memory of 4436 3380 rundll32.exe 14 PID 4436 wrote to memory of 3116 4436 rundll32.exe 92 PID 4436 wrote to memory of 3116 4436 rundll32.exe 92 PID 4436 wrote to memory of 3116 4436 rundll32.exe 92 PID 3116 wrote to memory of 828 3116 e583fa4.exe 85 PID 3116 wrote to memory of 832 3116 e583fa4.exe 84 PID 3116 wrote to memory of 392 3116 e583fa4.exe 81 PID 3116 wrote to memory of 2316 3116 e583fa4.exe 56 PID 3116 wrote to memory of 2340 3116 e583fa4.exe 55 PID 3116 wrote to memory of 2420 3116 e583fa4.exe 52 PID 3116 wrote to memory of 3160 3116 e583fa4.exe 42 PID 3116 wrote to memory of 3464 3116 e583fa4.exe 41 PID 3116 wrote to memory of 3660 3116 e583fa4.exe 40 PID 3116 wrote to memory of 3856 3116 e583fa4.exe 39 PID 3116 wrote to memory of 3920 3116 e583fa4.exe 38 PID 3116 wrote to memory of 4072 3116 e583fa4.exe 37 PID 3116 wrote to memory of 4160 3116 e583fa4.exe 36 PID 3116 wrote to memory of 4484 3116 e583fa4.exe 34 PID 3116 wrote to memory of 564 3116 e583fa4.exe 24 PID 3116 wrote to memory of 2884 3116 e583fa4.exe 21 PID 3116 wrote to memory of 3732 3116 e583fa4.exe 20 PID 3116 wrote to memory of 4256 3116 e583fa4.exe 10 PID 3116 wrote to memory of 2728 3116 e583fa4.exe 16 PID 3116 wrote to memory of 3864 3116 e583fa4.exe 15 PID 3116 wrote to memory of 3380 3116 e583fa4.exe 12 PID 3116 wrote to memory of 4436 3116 e583fa4.exe 14 PID 3116 wrote to memory of 4436 3116 e583fa4.exe 14 PID 4436 wrote to memory of 224 4436 rundll32.exe 93 PID 4436 wrote to memory of 224 4436 rundll32.exe 93 PID 4436 wrote to memory of 224 4436 rundll32.exe 93 PID 4436 wrote to memory of 1860 4436 rundll32.exe 94 PID 4436 wrote to memory of 1860 4436 rundll32.exe 94 PID 4436 wrote to memory of 1860 4436 rundll32.exe 94 PID 3116 wrote to memory of 828 3116 e583fa4.exe 85 PID 3116 wrote to memory of 832 3116 e583fa4.exe 84 PID 3116 wrote to memory of 392 3116 e583fa4.exe 81 PID 3116 wrote to memory of 2316 3116 e583fa4.exe 56 PID 3116 wrote to memory of 2340 3116 e583fa4.exe 55 PID 3116 wrote to memory of 2420 3116 e583fa4.exe 52 PID 3116 wrote to memory of 3160 3116 e583fa4.exe 42 PID 3116 wrote to memory of 3464 3116 e583fa4.exe 41 PID 3116 wrote to memory of 3660 3116 e583fa4.exe 40 PID 3116 wrote to memory of 3856 3116 e583fa4.exe 39 PID 3116 wrote to memory of 3920 3116 e583fa4.exe 38 PID 3116 wrote to memory of 4072 3116 e583fa4.exe 37 PID 3116 wrote to memory of 4160 3116 e583fa4.exe 36 PID 3116 wrote to memory of 4484 3116 e583fa4.exe 34 PID 3116 wrote to memory of 564 3116 e583fa4.exe 24 PID 3116 wrote to memory of 2884 3116 e583fa4.exe 21 PID 3116 wrote to memory of 3732 3116 e583fa4.exe 20 PID 3116 wrote to memory of 4256 3116 e583fa4.exe 10 PID 3116 wrote to memory of 2728 3116 e583fa4.exe 16 PID 3116 wrote to memory of 3864 3116 e583fa4.exe 15 PID 3116 wrote to memory of 224 3116 e583fa4.exe 93 PID 3116 wrote to memory of 224 3116 e583fa4.exe 93 PID 3116 wrote to memory of 1860 3116 e583fa4.exe 94 PID 3116 wrote to memory of 1860 3116 e583fa4.exe 94 PID 3116 wrote to memory of 696 3116 e583fa4.exe 95 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e583fa4.exe
Processes
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4256
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4a923dddfd11cd8fb13976bf59689860.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.4a923dddfd11cd8fb13976bf59689860.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\e583fa4.exeC:\Users\Admin\AppData\Local\Temp\e583fa4.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\e5843bb.exeC:\Users\Admin\AppData\Local\Temp\e5843bb.exe3⤵
- Executes dropped EXE
PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\e584b1d.exeC:\Users\Admin\AppData\Local\Temp\e584b1d.exe3⤵
- Executes dropped EXE
PID:1860
-
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3864
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2884
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:564
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4484
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4160
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3160
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2340
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2316
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:392
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:832
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:828
-
C:\Windows\System32\wuapihost.exeC:\Windows\System32\wuapihost.exe -Embedding1⤵PID:696
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3
-
Filesize
97KB
MD5e2be15de1dcc87b18b2bb639352ddd94
SHA127aa240b489b36e964031b3a9899aff7d8affd73
SHA256da90a993753f6a9cdf09ed16447e4c13bc7d51556acdd45f697b8c2f71656e03
SHA5123b04d2594ae248fcdec93e3d311d7b74db3472643a0388c9b94d85714e9afd2f58c9c9c31ee4bb98fc9003c042c6b0366361e874b3aed60aac8c5ec4476e8fc3