Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/04/2024, 13:53
240409-q7av3sca71 1009/04/2024, 13:53
240409-q699jsgg35 1009/04/2024, 13:53
240409-q69ysaca7z 1009/04/2024, 13:53
240409-q69m1sca7y 1002/12/2023, 07:46
231202-jmdmxaaf8t 10Analysis
-
max time kernel
84s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02/12/2023, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
Resource
win10v2004-20231127-en
General
-
Target
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe
-
Size
301KB
-
MD5
d976e27be52536c60076fe9a3a646ad1
-
SHA1
9db98366d212bcd7e3926acb6505c45020604c61
-
SHA256
caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823
-
SHA512
9a44b70bd35a1467c0af014fa13f7ade42b708928511dced8c4ad6f0813e46e9bd5897d476b9ba3c09972bcb757648925453396796f515aaf03ebff651c3985e
-
SSDEEP
3072:uNg1miw2R2eRVMvRz3jYziACBbFvfy4zoV25kGpYUX35U:qMRnVGDiiJRFMAK
Malware Config
Extracted
Protocol: ftp- Host:
dayspa-am-altmarkt.de - Port:
21 - Username:
[email protected] - Password:
vincentt
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://legdfls2369.com/index.php
http://fpodsp0532xc.com/index.php
http://gucc352093520.com/index.php
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
smokeloader
autm
Extracted
smokeloader
pub1
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1276 Process not Found -
Executes dropped EXE 5 IoCs
pid Process 2732 B349.exe 2740 B637.exe 2760 BD88.exe 2136 CA26.exe 2524 BD88.exe -
Loads dropped DLL 3 IoCs
pid Process 2796 regsvr32.exe 2760 BD88.exe 2524 BD88.exe -
resource yara_rule behavioral1/memory/2524-71-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-73-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-93-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-89-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-126-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-128-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-137-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-138-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-152-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-169-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-170-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-171-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-172-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-173-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-174-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-177-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-180-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-179-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2524-175-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" BD88.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2732 set thread context of 2584 2732 B349.exe 31 PID 2760 set thread context of 2524 2760 BD88.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CA26.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CA26.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI B637.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI B637.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI B637.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CA26.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1824 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 1824 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 Process not Found -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 1824 caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe 1276 Process not Found 1276 Process not Found 1276 Process not Found 1276 Process not Found 2740 B637.exe 2136 CA26.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 AppLaunch.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2784 1276 Process not Found 28 PID 1276 wrote to memory of 2784 1276 Process not Found 28 PID 1276 wrote to memory of 2784 1276 Process not Found 28 PID 1276 wrote to memory of 2784 1276 Process not Found 28 PID 1276 wrote to memory of 2784 1276 Process not Found 28 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 2784 wrote to memory of 2796 2784 regsvr32.exe 29 PID 1276 wrote to memory of 2732 1276 Process not Found 30 PID 1276 wrote to memory of 2732 1276 Process not Found 30 PID 1276 wrote to memory of 2732 1276 Process not Found 30 PID 1276 wrote to memory of 2732 1276 Process not Found 30 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 2732 wrote to memory of 2584 2732 B349.exe 31 PID 1276 wrote to memory of 2740 1276 Process not Found 32 PID 1276 wrote to memory of 2740 1276 Process not Found 32 PID 1276 wrote to memory of 2740 1276 Process not Found 32 PID 1276 wrote to memory of 2740 1276 Process not Found 32 PID 1276 wrote to memory of 2760 1276 Process not Found 33 PID 1276 wrote to memory of 2760 1276 Process not Found 33 PID 1276 wrote to memory of 2760 1276 Process not Found 33 PID 1276 wrote to memory of 2760 1276 Process not Found 33 PID 1276 wrote to memory of 2136 1276 Process not Found 34 PID 1276 wrote to memory of 2136 1276 Process not Found 34 PID 1276 wrote to memory of 2136 1276 Process not Found 34 PID 1276 wrote to memory of 2136 1276 Process not Found 34 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 1276 wrote to memory of 368 1276 Process not Found 36 PID 1276 wrote to memory of 368 1276 Process not Found 36 PID 1276 wrote to memory of 368 1276 Process not Found 36 PID 1276 wrote to memory of 368 1276 Process not Found 36 PID 1276 wrote to memory of 368 1276 Process not Found 36 PID 2760 wrote to memory of 2524 2760 BD88.exe 35 PID 1276 wrote to memory of 2432 1276 Process not Found 37 PID 1276 wrote to memory of 2432 1276 Process not Found 37 PID 1276 wrote to memory of 2432 1276 Process not Found 37 PID 1276 wrote to memory of 2432 1276 Process not Found 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe"C:\Users\Admin\AppData\Local\Temp\caca493c10d47df328c029a270165a21afa50b350ec4f3dd3a6ea72ef2c54823.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1824
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\B165.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\B165.dll2⤵
- Loads dropped DLL
PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\B349.exeC:\Users\Admin\AppData\Local\Temp\B349.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\B637.exeC:\Users\Admin\AppData\Local\Temp\B637.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2740
-
C:\Users\Admin\AppData\Local\Temp\BD88.exeC:\Users\Admin\AppData\Local\Temp\BD88.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\BD88.exeC:\Users\Admin\AppData\Local\Temp\BD88.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2524
-
-
C:\Users\Admin\AppData\Local\Temp\CA26.exeC:\Users\Admin\AppData\Local\Temp\CA26.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2136
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:368
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59b068ee4cbe5d0d10fb1f7cde3cf00dd
SHA1fd8a76dcac8f0b8b06d7b3a1148bfbf8bf5b871e
SHA256596bd777aee6445dc5e5492e4324bae265b465cf8b197d7a8e90b0c86133969d
SHA512a276b43e339a5b76ac1be67c7802609601616b47615060c69e26048f8bbc3e678eb5d75c0d37b3888ff9addc322b167f5e6e655fd28ca2a919af1dbfad157816
-
Filesize
6.4MB
MD5c5c952692960fbb7e83320f5f7550c34
SHA1abc5cfc7b9335e9720195468c9bb6fbe2091b197
SHA256ae3c7fbd8b59f6ac884836c747e3222665a7462e88864e186681bfca9cb9bec3
SHA51224404449dfc7994e2083c2d23f2c59f29395b1186037bef9f63f7d635bcc57d6535eb0be223567f6da9b7a75ba53ca1f55c5df9e61e57c19da0f3335d42c235d
-
Filesize
2.4MB
MD57c8bfdee3c36b4a9222de69d79a1a841
SHA165e5ec73f95b0976ab19fb74a872072bca704f7b
SHA256e45c40410e9c94c3522e465d7dab52266e56d5f815dc4fc9c4d3f3cf18d877f4
SHA5128a574b7c6a6d4c398e738ecbb852ec04c22feae429dcf07ba66b52bfe16a6f6f8a32c30da6ad58021570eb22baf0da017557a6f4d3d3b8e10ec18f6e8b52e6db
-
Filesize
1.0MB
MD5d26b3f28d2687a79ced195ba9899b524
SHA1ecfa29d0d1a4577a822cafb67baa631e6a6ba01e
SHA256c8f9bfa859fc17e05a929289872e153807149e1313968a566ce6f74c1092e4e1
SHA512896bca3f17da88ce88ea60011f5a52fdc47dbd59de6bb9519ce569fd101e70e10c122fdee5aef30404ea3289e0d6a45503f34e98ac3e6c939dd51bd691034745
-
Filesize
304KB
MD533a60439e95f0dfc10016075f97aeb0c
SHA1fb3595f8a5f9c243e5ad108ff11bc5cb2400ec2b
SHA2560f6db13c0239ca113c19ebeaec8f3243572fd365c3396eff1777115bc08849a1
SHA512c08ff3d27eb92b369bbdcfb5ee3405e345bb3de3004b985ba48b4308d22851403cfc440b8242c1f4ccbbb75986feead1c800bddd58a225274386b878aaad9a90
-
Filesize
304KB
MD533a60439e95f0dfc10016075f97aeb0c
SHA1fb3595f8a5f9c243e5ad108ff11bc5cb2400ec2b
SHA2560f6db13c0239ca113c19ebeaec8f3243572fd365c3396eff1777115bc08849a1
SHA512c08ff3d27eb92b369bbdcfb5ee3405e345bb3de3004b985ba48b4308d22851403cfc440b8242c1f4ccbbb75986feead1c800bddd58a225274386b878aaad9a90
-
Filesize
1.9MB
MD557c833bfd5042e34bec23dfd711cd151
SHA16bcd1915173d57d369e209943be31eebebdd535a
SHA2569d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
SHA5123c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
Filesize
1.9MB
MD557c833bfd5042e34bec23dfd711cd151
SHA16bcd1915173d57d369e209943be31eebebdd535a
SHA2569d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
SHA5123c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
Filesize
1.9MB
MD557c833bfd5042e34bec23dfd711cd151
SHA16bcd1915173d57d369e209943be31eebebdd535a
SHA2569d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
SHA5123c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
Filesize
1.9MB
MD557c833bfd5042e34bec23dfd711cd151
SHA16bcd1915173d57d369e209943be31eebebdd535a
SHA2569d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
SHA5123c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
Filesize
298KB
MD55789e759c1b7911eb8b5c677c6d66493
SHA1c7d272af0a022073b8488065aca7db1d4091a5bd
SHA256a8648e3d4b39d1d0489afb068bf8b22ff101d3e2dca75d6f747d9844fc9ab1cc
SHA5122d393cec75943052544a328f8d31ae32ee1464e39e76af660fb5ed0b79da09914e004edbb5a98019eac917044fcbbd8366b586eaabfa0917a7bad3b23f1f71a9
-
Filesize
298KB
MD55789e759c1b7911eb8b5c677c6d66493
SHA1c7d272af0a022073b8488065aca7db1d4091a5bd
SHA256a8648e3d4b39d1d0489afb068bf8b22ff101d3e2dca75d6f747d9844fc9ab1cc
SHA5122d393cec75943052544a328f8d31ae32ee1464e39e76af660fb5ed0b79da09914e004edbb5a98019eac917044fcbbd8366b586eaabfa0917a7bad3b23f1f71a9
-
Filesize
2.4MB
MD57c8bfdee3c36b4a9222de69d79a1a841
SHA165e5ec73f95b0976ab19fb74a872072bca704f7b
SHA256e45c40410e9c94c3522e465d7dab52266e56d5f815dc4fc9c4d3f3cf18d877f4
SHA5128a574b7c6a6d4c398e738ecbb852ec04c22feae429dcf07ba66b52bfe16a6f6f8a32c30da6ad58021570eb22baf0da017557a6f4d3d3b8e10ec18f6e8b52e6db
-
Filesize
2.4MB
MD57c8bfdee3c36b4a9222de69d79a1a841
SHA165e5ec73f95b0976ab19fb74a872072bca704f7b
SHA256e45c40410e9c94c3522e465d7dab52266e56d5f815dc4fc9c4d3f3cf18d877f4
SHA5128a574b7c6a6d4c398e738ecbb852ec04c22feae429dcf07ba66b52bfe16a6f6f8a32c30da6ad58021570eb22baf0da017557a6f4d3d3b8e10ec18f6e8b52e6db
-
Filesize
1.9MB
MD557c833bfd5042e34bec23dfd711cd151
SHA16bcd1915173d57d369e209943be31eebebdd535a
SHA2569d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
SHA5123c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1