Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Main/CED3D10Hook.dll
windows7-x64
1Main/CED3D10Hook.dll
windows10-2004-x64
1Main/CED3D...64.dll
windows7-x64
1Main/CED3D...64.dll
windows10-2004-x64
1Main/CED3D11Hook.dll
windows7-x64
1Main/CED3D11Hook.dll
windows10-2004-x64
1Main/CED3D...64.dll
windows7-x64
1Main/CED3D...64.dll
windows10-2004-x64
1Main/RUN_ME.bat
windows7-x64
10Main/RUN_ME.bat
windows10-2004-x64
10Main/autor...oup.js
windows7-x64
1Main/autor...oup.js
windows10-2004-x64
1Main/autor...ace.js
windows7-x64
1Main/autor...ace.js
windows10-2004-x64
1Main/autor...nfo.js
windows7-x64
1Main/autor...nfo.js
windows10-2004-x64
1Main/autor...rch.js
windows7-x64
1Main/autor...rch.js
windows10-2004-x64
1Main/autor...log.js
windows7-x64
1Main/autor...log.js
windows10-2004-x64
1Main/autor...ols.js
windows7-x64
1Main/autor...ols.js
windows10-2004-x64
1Main/autor...ave.js
windows7-x64
1Main/autor...ave.js
windows10-2004-x64
1Main/autor...yce.js
windows7-x64
1Main/autor...yce.js
windows10-2004-x64
1Main/autor...ian.js
windows7-x64
1Main/autor...ian.js
windows10-2004-x64
1Main/autor...are.js
windows7-x64
1Main/autor...are.js
windows10-2004-x64
1Main/autor...unt.js
windows7-x64
1Main/autor...unt.js
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 09:40
Behavioral task
behavioral1
Sample
Main/CED3D10Hook.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Main/CED3D10Hook.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Main/CED3D10Hook64.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Main/CED3D10Hook64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Main/CED3D11Hook.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Main/CED3D11Hook.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Main/CED3D11Hook64.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Main/CED3D11Hook64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Main/RUN_ME.bat
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Main/RUN_ME.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Main/autorun/AddToNewGroup.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Main/autorun/AddToNewGroup.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Main/autorun/DotNetInterface.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Main/autorun/DotNetInterface.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Main/autorun/JavaInfo.js
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Main/autorun/JavaInfo.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Main/autorun/JavaSearch.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Main/autorun/JavaSearch.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Main/autorun/MethodInvokeDialog.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Main/autorun/MethodInvokeDialog.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Main/autorun/andtools.js
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
Main/autorun/andtools.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Main/autorun/autosave.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Main/autorun/autosave.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
Main/autorun/babyce.js
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
Main/autorun/babyce.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Main/autorun/bigendian.js
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
Main/autorun/bigendian.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Main/autorun/ceshare.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Main/autorun/ceshare.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Main/autorun/ceshare/ceshare_account.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Main/autorun/ceshare/ceshare_account.js
Resource
win10v2004-20240226-en
General
-
Target
Main/CED3D10Hook.dll
-
Size
128KB
-
MD5
43dac1f3ca6b48263029b348111e3255
-
SHA1
9e399fddc2a256292a07b5c3a16b1c8bdd8da5c1
-
SHA256
148f12445f11a50efbd23509139bf06a47d453e8514733b5a15868d10cc6e066
-
SHA512
6e77a429923b503fc08895995eb8817e36145169c2937dacc2da92b846f45101846e98191aeb4f0f2f13fff05d0836aa658f505a04208188278718166c5e3032
-
SSDEEP
1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3580 msedge.exe 3580 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 536 identity_helper.exe 536 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 4784 2328 rundll32.exe 88 PID 2328 wrote to memory of 4784 2328 rundll32.exe 88 PID 2328 wrote to memory of 4784 2328 rundll32.exe 88 PID 4388 wrote to memory of 3524 4388 msedge.exe 100 PID 4388 wrote to memory of 3524 4388 msedge.exe 100 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 4220 4388 msedge.exe 101 PID 4388 wrote to memory of 3580 4388 msedge.exe 102 PID 4388 wrote to memory of 3580 4388 msedge.exe 102 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103 PID 4388 wrote to memory of 3588 4388 msedge.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\CED3D10Hook.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Main\CED3D10Hook.dll,#12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffac44d46f8,0x7ffac44d4708,0x7ffac44d47182⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:12⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2856 /prefetch:12⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:12⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:82⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13160421993905074236,6570583938823718734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD573c8d54f775a1b870efd00cb75baf547
SHA133024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA2561ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
-
Filesize
152B
MD54b206e54d55dcb61072236144d1f90f8
SHA1c2600831112447369e5b557e249f86611b05287d
SHA25687bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
-
Filesize
6KB
MD5d33bc2dc676c898395007af82c5f743a
SHA1fe2619f24736e4d4da1c40777bfc782b81da84f1
SHA25615de956cce2c5d0402ceee97e33882efdabe1c8c01dea2b5c6b7d97215eb205a
SHA512c5f8f0743218dc3339809b7a563b9408a6976b441962aba67978771aaa3731a7d4668cc7240c93aa993035fba1efbc037ebda7fa337388144e71a9f5bb822ba8
-
Filesize
6KB
MD5fbfa0f2a3a55cc4afdf189c84d652631
SHA144216fdd7a25279457c0e59522ad37c91c6c633f
SHA256ba10a4c54055b023b4e7ed9c489e38b1efd7bdf1fd6140190c6630b021efc0bb
SHA512e04194e6af2c786e82d783b162d7e685effdf49b12353102bc43f9639c0497f387147b5007b7de8e1cee72494d5aab94a1ff341a51f9472d8f87047694d80957
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD59e556d877405a722e38e6902a3422dfb
SHA1a0b2d6e4dd04ba17cf188f858337093fbcff64f0
SHA25642cd9d6c4fbd92cecabd8fea47f7023369d7a2c06e7273beafac0e5c0bae8bba
SHA512459838721d0002bac20a514cfb3315930d01654e8010afd1bcaac557ce55c5eeaded74d4747287cac5704099378787726f50835ebc7b1853692461a03a0bb80b
-
Filesize
8KB
MD591b4429277d84f21be71fcaf2d7e6540
SHA171e917957a4891cadffad1761ebcdf39df30dd80
SHA256623e6718ea3cec2957e4a473b12446f4a2eb8c164e9bc8b86db6c65bf0e13d66
SHA512db642c129a246f91e5fd89a567395dd9e8f5761669fbd1f84dc54dbb98825bd7f45a0944e82ccf620b8ca810ee2160365b805cf8b28110d25349e6e0f234a782