Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
bbf34c5689b80de64562c1307183ea14.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bbf34c5689b80de64562c1307183ea14.exe
Resource
win10v2004-20231215-en
General
-
Target
bbf34c5689b80de64562c1307183ea14.exe
-
Size
197KB
-
MD5
bbf34c5689b80de64562c1307183ea14
-
SHA1
31d5213b7f06287578e2b17f4555d34a393b3e64
-
SHA256
8c544dd1913721c28f59f0a459da678d4f59fe9da3d09649f7d72470ca44d9fd
-
SHA512
ea53c1e9478d23e2cc168bbc91fdadefab3c7eed837b6976cf1df372e7af9f1c8f0d28240522421dcec2ce4cf50a32931d9932a7d6612105a48a70fdb850a7bc
-
SSDEEP
6144:Om3UslV28FMEQUTYan9QD80sLbCuUhm08Z4:OmEslVnrbdM83G
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2228 wmpscfgs.exe 1716 wmpscfgs.exe 2960 wmpscfgs.exe 1220 wmpscfgs.exe -
Loads dropped DLL 6 IoCs
pid Process 2356 bbf34c5689b80de64562c1307183ea14.exe 2356 bbf34c5689b80de64562c1307183ea14.exe 2356 bbf34c5689b80de64562c1307183ea14.exe 2356 bbf34c5689b80de64562c1307183ea14.exe 2228 wmpscfgs.exe 2228 wmpscfgs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe" bbf34c5689b80de64562c1307183ea14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\users\\admin\\appdata\\local\\temp\\\\wmpscfgs.exe" wmpscfgs.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created \??\c:\program files (x86)\microsoft office\office14\bcssync.exe bbf34c5689b80de64562c1307183ea14.exe File created \??\c:\program files (x86)\adobe\acrotray .exe bbf34c5689b80de64562c1307183ea14.exe File created \??\c:\program files (x86)\internet explorer\wmpscfgs.exe bbf34c5689b80de64562c1307183ea14.exe File created C:\Program Files (x86)\259411628.dat wmpscfgs.exe File opened for modification \??\c:\program files (x86)\adobe\acrotray.exe wmpscfgs.exe File created \??\c:\program files (x86)\adobe\acrotray.exe bbf34c5689b80de64562c1307183ea14.exe File opened for modification C:\Program Files (x86)\259411628.dat wmpscfgs.exe File created \??\c:\program files (x86)\microsoft office\office14\bcssync.exe wmpscfgs.exe File opened for modification \??\c:\program files (x86)\adobe\acrotray .exe wmpscfgs.exe File created \??\c:\program files (x86)\internet explorer\wmpscfgs.exe wmpscfgs.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000bb2d1f92ed993de009e84ad6a517bb2f552e9b41e0413073fdfbc7b4f2d34441000000000e8000000002000020000000404938edfad00622a7701dd952644050f8a95db47d7336a1421f5105c0924c5f20000000f15565a8203260015e96cab1b670e7eca63994b09a13aa5fa91bd5779c8b5eeb400000002b4a2a43d0cf29330f20923914bc94cd10811009cda2ff84a4e8859de0da10f820d6d348c2fa31d7150a5a7d23e80094f5d408557e987af90280640cb9b911e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F862E681-A1E2-11EE-9E06-5628A0CAC84B} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603dd0c7ef35da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000005aa8d858eb12e63fb315ff30d507aeb06da853cbc5d3d10019d6b524b09e2fd1000000000e80000000020000200000008b1e6cac046ab3fae89bc84166974d719a022f39ac4a60da85cc0198b97b9cb890000000a33bd5ae059fa948bc40ac44c315fe037d952cb50943122b9abc9b740d97b232b98068b98e22c77ba44c7669502c0f088326dc13e227b6b7f067ac55c6a52ab811667fc7a76c3d317d36b48028268e77bb5e6d232e6fa464e43e760522c04dadbc4055c55ae11fe2b28089247e2fe8bfee070deff6ee30372b7c09c33134e006c0ef6cdd087c1d098c21ffb648006cc4400000009550de2d8a69b8407c5a3c062fbcb1663e1a9672897e6938b177f3600440b665190ddd272c63b6470b9d76043681385b5cc495cac1f148530d5c177136d65fa1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409532541" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2356 bbf34c5689b80de64562c1307183ea14.exe 2228 wmpscfgs.exe 2228 wmpscfgs.exe 1716 wmpscfgs.exe 1716 wmpscfgs.exe 2960 wmpscfgs.exe 1220 wmpscfgs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2356 bbf34c5689b80de64562c1307183ea14.exe Token: SeDebugPrivilege 2228 wmpscfgs.exe Token: SeDebugPrivilege 1716 wmpscfgs.exe Token: SeDebugPrivilege 2960 wmpscfgs.exe Token: SeDebugPrivilege 1220 wmpscfgs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 2568 iexplore.exe 2568 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 2568 iexplore.exe 2568 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2568 iexplore.exe 2568 iexplore.exe 2176 IEXPLORE.EXE 2176 IEXPLORE.EXE 2568 iexplore.exe 2568 iexplore.exe 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2228 2356 bbf34c5689b80de64562c1307183ea14.exe 28 PID 2356 wrote to memory of 2228 2356 bbf34c5689b80de64562c1307183ea14.exe 28 PID 2356 wrote to memory of 2228 2356 bbf34c5689b80de64562c1307183ea14.exe 28 PID 2356 wrote to memory of 2228 2356 bbf34c5689b80de64562c1307183ea14.exe 28 PID 2356 wrote to memory of 1716 2356 bbf34c5689b80de64562c1307183ea14.exe 29 PID 2356 wrote to memory of 1716 2356 bbf34c5689b80de64562c1307183ea14.exe 29 PID 2356 wrote to memory of 1716 2356 bbf34c5689b80de64562c1307183ea14.exe 29 PID 2356 wrote to memory of 1716 2356 bbf34c5689b80de64562c1307183ea14.exe 29 PID 2568 wrote to memory of 1192 2568 iexplore.exe 31 PID 2568 wrote to memory of 1192 2568 iexplore.exe 31 PID 2568 wrote to memory of 1192 2568 iexplore.exe 31 PID 2568 wrote to memory of 1192 2568 iexplore.exe 31 PID 2228 wrote to memory of 2960 2228 wmpscfgs.exe 36 PID 2228 wrote to memory of 2960 2228 wmpscfgs.exe 36 PID 2228 wrote to memory of 2960 2228 wmpscfgs.exe 36 PID 2228 wrote to memory of 2960 2228 wmpscfgs.exe 36 PID 2228 wrote to memory of 1220 2228 wmpscfgs.exe 35 PID 2228 wrote to memory of 1220 2228 wmpscfgs.exe 35 PID 2228 wrote to memory of 1220 2228 wmpscfgs.exe 35 PID 2228 wrote to memory of 1220 2228 wmpscfgs.exe 35 PID 2568 wrote to memory of 2348 2568 iexplore.exe 33 PID 2568 wrote to memory of 2348 2568 iexplore.exe 33 PID 2568 wrote to memory of 2348 2568 iexplore.exe 33 PID 2568 wrote to memory of 2348 2568 iexplore.exe 33 PID 2568 wrote to memory of 2176 2568 iexplore.exe 37 PID 2568 wrote to memory of 2176 2568 iexplore.exe 37 PID 2568 wrote to memory of 2176 2568 iexplore.exe 37 PID 2568 wrote to memory of 2176 2568 iexplore.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbf34c5689b80de64562c1307183ea14.exe"C:\Users\Admin\AppData\Local\Temp\bbf34c5689b80de64562c1307183ea14.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\users\admin\appdata\local\temp\wmpscfgs.exec:\users\admin\appdata\local\temp\\wmpscfgs.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exeC:\Program Files (x86)\Internet Explorer\wmpscfgs.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
-
-
\??\c:\users\admin\appdata\local\temp\wmpscfgs.exec:\users\admin\appdata\local\temp\\wmpscfgs.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
-
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exeC:\Program Files (x86)\Internet Explorer\wmpscfgs.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1192
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:472069 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275480 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5972638d5eac518692a891e56ee3717e8
SHA1c10357bc5d5730c54eaec4156e3c3d3dc093f9c4
SHA256e51d0ba4921da32bf65189792bcf576f5dee14aefdb6f67ec730b4f84f16db76
SHA512d0f085de72fe01fbb53f44b7b20efd2c68424f75566ddc38105cbdd061bafee4011153532a437faac6a619149f1c61d116f8995630a65f7143ae0366cde87611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55647119721304b69c79f69766e5b652a
SHA1a64527ddde259133bdcff9bca1fd4c9be847b6d9
SHA256a57e941b4f65dc092554c2bd2cf59680ab9d4c6dce99e782e3dfaa9cdff9abe4
SHA512814293b5f6a33f1cf1aa0f0933b251d02d717ea1ab29b0cdeaa364c289933be4e36d935b9b9b6c10c4c6c04288cfaf73597e5f557fad2dcaf66195962b1e5211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1824367aeacebb85593fc104cc39637
SHA189b5730cc5dce7788518f66b01244572568d7193
SHA256b92327a4a4c3d634eb1bd2bd0d0cdc603cf7ec0c106a3b4394c247d439855fbc
SHA512b423da202ffb50b2d8c024f0dd8033f5365a00ee6b0341db74acc1a54afe41ade4b55bbef7bd6491c47d6c50760a029a2fe55589503eeafd587f1e2ddc109f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587041e53b038097e12dcbc62f3688bac
SHA15274b34bb4117b348ff40975288b7feeb52558de
SHA256b9166ee5b8afb9b543b91cae5aadbb37abcae65e4c1113f869ce92f8c8437981
SHA512f8714312da0cf8d59535e725d8a819d58e4bb0cfe50fd72a761ba2b22e1071c12dae274c1fc97298e63e926f4b3d0f8663912cc6e7d581daf9d352893525b347
-
Filesize
221KB
MD5e135b8dbe296e701326819e5ad7316c2
SHA10264229b32c8d027d8c2d5245c0effc544070c19
SHA25657b71a8f4296975c07a1e7a5b61e7540c557971ff307e4480a6bb4f70acd1ead
SHA5129dcee1fc53882787e63ab32fa2ffc4f699adffdb48feffa10a748bf41af92199caef2f675045faf14aab0018a61c9dfd15a9b22b9c5067470eed583861a4b485
-
Filesize
16KB
MD507f38e392b76ec6448feff496701b509
SHA12212e64ca3253c55373a8c1d578f07ef1fa53801
SHA2563051fffc6856165941858403f5b71639d0dd846cd757a7b18c07a3fd020cc1b3
SHA5128084bd52a92d8f21cacb0297b7253114e6316d126bd3f79e3f4d4db38999871c2df6a1be221d5938e965949b5fbbf4b8b300a3161c6d3c7f2614aa3867f07645
-
Filesize
207KB
MD58e053ff4eeded62c9a70bfd486c11827
SHA1b158a7da8ec1a354673336f5674b0aede9c227cd
SHA256f3cf78187d8ee0b6cf139324121aba5e167ba53ab1eb2f159a0cba6dba88d5e5
SHA5129c2673e3e6dd30f31942eb91ba84c6cc43bbb06035f682ce366e4588c3313b1bca8f468ffa1997097e471848b25be3beb08ea67d870215a0e5d587747440405a