Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system -
submitted
12/12/2023, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe
Resource
win10-20231129-en
General
-
Target
813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe
-
Size
7.5MB
-
MD5
53f95cac7f320fbd67a17985fbcf97e1
-
SHA1
6451282820e1b11b3f1a79247d2d2e484519a11a
-
SHA256
813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed
-
SHA512
58d69309dc494450d939085c46b71296218f9ea353e649d7201608173e6ee2159cf82853bc7c3a97caae3e2a1be552316cc0b7dd74c3bbf71e8e273ebc2557d0
-
SSDEEP
196608:hq/iLRC0OLkYNew6tjCtD2RQVsBp4UAzj:hHC9Lkuew6t2oCO9Azj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 1072 gifplayer.exe 312 gifplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 194.49.94.194 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
description ioc Process File created C:\Program Files (x86)\PlayGIF\bin\x86\is-ODNLK.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DUU45.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-C32OR.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-FC2UL.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DBEP6.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5NH4P.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-SN4N4.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BEUI0.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-G5S58.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File opened for modification C:\Program Files (x86)\PlayGIF\gifplayer.exe 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-J0TC8.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-K1DFD.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-3VB4O.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-0F4PA.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-MEEM3.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-2S6FQ.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-DJCOU.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EOQ3Q.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\lessmsi\is-KGQRP.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File opened for modification C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-D945D.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-N906L.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BGV2N.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-I4U9E.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-08F49.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\is-MLD7H.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-1PRHM.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5Q5TA.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-OH06O.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PC6IQ.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-CI2HL.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-MP3SH.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-2J82N.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-EL7SM.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JLOGN.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-H5E9H.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-PJRRQ.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-J6RDK.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\plugins\internal\is-47L1S.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-G0S5O.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UPQBQ.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-BUCE1.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RO7DE.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-690HC.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-ED6PK.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-HIJH8.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IUVAS.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-LNSNA.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-O03A6.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\uninstall\unins000.dat 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\stuff\is-HV6H8.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-B2F7Q.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-8C26C.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-IEIRO.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-D7CV2.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-JCHEV.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-RB80G.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\is-R4IMF.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-S5M2I.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-UQ9MB.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-5T6E7.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-O46SC.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp File created C:\Program Files (x86)\PlayGIF\bin\x86\is-71730.tmp 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4704 4720 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe 74 PID 4720 wrote to memory of 4704 4720 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe 74 PID 4720 wrote to memory of 4704 4720 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe 74 PID 4704 wrote to memory of 2820 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 75 PID 4704 wrote to memory of 2820 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 75 PID 4704 wrote to memory of 2820 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 75 PID 4704 wrote to memory of 1072 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 77 PID 4704 wrote to memory of 1072 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 77 PID 4704 wrote to memory of 1072 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 77 PID 4704 wrote to memory of 2304 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 80 PID 4704 wrote to memory of 2304 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 80 PID 4704 wrote to memory of 2304 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 80 PID 4704 wrote to memory of 312 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 78 PID 4704 wrote to memory of 312 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 78 PID 4704 wrote to memory of 312 4704 813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp 78 PID 2304 wrote to memory of 4792 2304 net.exe 81 PID 2304 wrote to memory of 4792 2304 net.exe 81 PID 2304 wrote to memory of 4792 2304 net.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe"C:\Users\Admin\AppData\Local\Temp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\is-7KNFC.tmp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp"C:\Users\Admin\AppData\Local\Temp\is-7KNFC.tmp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp" /SL5="$18007C,7577497,68096,C:\Users\Admin\AppData\Local\Temp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2820
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
PID:1072
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
PID:312
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵PID:4792
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD557d1bf4de4f35b3ca5e5657f1e223484
SHA1f0e3900b334dd016df4aed99a7046f1a0084f5e7
SHA2568971da81633a2d15afc0493db59c389c48d6a3f49b148d25d14b8c6bde097335
SHA512a4d2ddf628f5582eb9c3fc0c42b31507f9b920f4d3d184fcb112e97e5952418ff9739e2a5d14247ee28314c194c84369099f0a7875998e012239ebd9adbe6d4a
-
Filesize
819KB
MD548533df6fc6a3dc9064a69016c889782
SHA1e845aa98bcf95c46dfb3df7f33369d0044ca8a67
SHA256dcfcb13b7aa54a45e74588cf9c90940da826e515758c3c3a3211678c3687f64b
SHA512bcc17b0be85d9d1141c5908467279578a4e4a385582179181454261fde180516818748b487cde3d543af45af299f789ab38b07c800064f6ea7442495bfa775d0
-
Filesize
797KB
MD5b56f4cc1715fbc763a765e40c8cb27c6
SHA18768edee03a92882de86228ca999b2d386736fb5
SHA256ee8c84c5a1eb9dcc2109378436ee6e938d08345e89bdd6539d896d7900db7f4e
SHA5129e8c4fc2ca8729243848a3f9807accb796ddc72c697b3bb7a6fbb085064db4e9b1660246cd8b9f493fb3074f346fce01d43f5d4efe7b82d1647722a352708292
-
C:\Users\Admin\AppData\Local\Temp\is-7KNFC.tmp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp
Filesize191KB
MD58b819dd8f6519cbcaa35a8892c10f744
SHA1f5232734c43252b64d47c1a864c7556a01f086b0
SHA256553d92228cd8766f944b9efedec4fabd1959ec4516e2b285e56385bab8913c26
SHA51204972589930f1097879307382fba6323a6d982570b802db57b47903f47481aaa6e4bcfc6774ff89b8c9d71b51c7832a19b23b00023a58499ac5764c75bd70405
-
C:\Users\Admin\AppData\Local\Temp\is-7KNFC.tmp\813e4a016bef8de2539d0d5ce4c6c427dea05f2aa4d3772cd71dfbc71c9a59ed.tmp
Filesize272KB
MD58c9fb94bbc250d7b75e892b13c9d8997
SHA118f60abce9a8361c84d74d60fe38ea2cf1b472bd
SHA256e071dd3f492e2e813d5b449420a4ac943091b0c3a49481af848c3f3aae65d85d
SHA512486040846d3a03da6402948b082bb34060873a67a309ae43fc8cbd716071fa3f8b4be51852d1e59c7fb46c2622d8eed697b36a363c9654e0a8fb8b17654eedb5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303