Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
HorrorRNGInst.exe
Resource
win7-20240729-en
General
-
Target
HorrorRNGInst.exe
-
Size
89KB
-
MD5
958be1157871fd8c546e4992cf55713b
-
SHA1
dcc2fc1dc846cfa87ec29e8fe5c92603e4a895aa
-
SHA256
f67f239010aabb32ecb3fc0e578b1faf105072feee6e352f0b385e8d405038de
-
SHA512
d046a68472108430ee5c8f69d5ed9c3474d2f09881f3c8f344b551b3899c44bbf63d6632783354f9370e4dbefb81a597fcd1fb9baf7c1d2487bbfdea132aaba6
-
SSDEEP
1536:H7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfCw6Op:b7DhdC6kzWypvaQ0FxyNTBfCa
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HorrorRNGInst.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 3008 timeout.exe 2788 timeout.exe 2936 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2976 chrome.exe 2976 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe Token: SeShutdownPrivilege 2976 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 3004 1520 HorrorRNGInst.exe 31 PID 1520 wrote to memory of 3004 1520 HorrorRNGInst.exe 31 PID 1520 wrote to memory of 3004 1520 HorrorRNGInst.exe 31 PID 1520 wrote to memory of 3004 1520 HorrorRNGInst.exe 31 PID 3004 wrote to memory of 3008 3004 cmd.exe 32 PID 3004 wrote to memory of 3008 3004 cmd.exe 32 PID 3004 wrote to memory of 3008 3004 cmd.exe 32 PID 3004 wrote to memory of 2788 3004 cmd.exe 33 PID 3004 wrote to memory of 2788 3004 cmd.exe 33 PID 3004 wrote to memory of 2788 3004 cmd.exe 33 PID 3004 wrote to memory of 2936 3004 cmd.exe 34 PID 3004 wrote to memory of 2936 3004 cmd.exe 34 PID 3004 wrote to memory of 2936 3004 cmd.exe 34 PID 2976 wrote to memory of 2928 2976 chrome.exe 36 PID 2976 wrote to memory of 2928 2976 chrome.exe 36 PID 2976 wrote to memory of 2928 2976 chrome.exe 36 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2712 2976 chrome.exe 38 PID 2976 wrote to memory of 2748 2976 chrome.exe 39 PID 2976 wrote to memory of 2748 2976 chrome.exe 39 PID 2976 wrote to memory of 2748 2976 chrome.exe 39 PID 2976 wrote to memory of 2768 2976 chrome.exe 40 PID 2976 wrote to memory of 2768 2976 chrome.exe 40 PID 2976 wrote to memory of 2768 2976 chrome.exe 40 PID 2976 wrote to memory of 2768 2976 chrome.exe 40 PID 2976 wrote to memory of 2768 2976 chrome.exe 40 PID 2976 wrote to memory of 2768 2976 chrome.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe"C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\B55B.tmp\B55C.tmp\B55D.bat C:\Users\Admin\AppData\Local\Temp\HorrorRNGInst.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:3008
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:2788
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak3⤵
- Delays execution with timeout.exe
PID:2936
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7af9758,0x7fef7af9768,0x7fef7af97782⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:22⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:82⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2028 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:12⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2140 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:12⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1460 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:22⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3248 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:22⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3420 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3776 --field-trial-handle=876,i,15357603660796678109,3103331557177384220,131072 /prefetch:12⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5affd5fc747a862694f6ce3f83bb3f7c8
SHA1df7491104e07d1cc8899bc11be5425b4f5b89f44
SHA25601cfebcb98bf7f55ef466f29d854e151764aaf8524f794527ec2b8ed6dffecb4
SHA51220691ed8c2bd2848305a8b2acf7646e1adb8a3e92b436b123e9a745ddca00dd14c2fcc4ae6f52d9555ca8154dcf58203782acd53e5173bfa5c4e9353c82bc770
-
Filesize
5KB
MD5e38cf01660056ad5c0ffd52d009de8e6
SHA155d0d25ccdbfaae35cefc8e0fa6a6489b7e42594
SHA256835723fd20edbedefc99507aeb18637b2d4ed4754772839f9b1e038596268e42
SHA512725ee8544c5da4e355ff4e2c9d48f1a44c0af7e88885048083029c5afd9d2f3604a016280d2e0d2084c93f9203cff95a76c6e226dcb046e24aa1d9c09158cd03
-
Filesize
5KB
MD5fe037880ef8660b7bc3a846a76da8ee3
SHA148f2db4a0bd5b1c31279beef1206a338a33959eb
SHA256f3c2101bab91ac930ff42e25ee764b15a7397ad834c68c75c9be43a0c9bf96a7
SHA5129097f4a27d656ac2e12940b1e7abd394889e22cfd87f2e84e3b68cc23ce86bcf17053b950992215c7de21f4bb5a74267bc5fc2b0334f1744110e7f046232f173
-
Filesize
5KB
MD597af65f1ff54ece1ea6b9216581cfe1f
SHA1dfe52995af2e83fd1fb1ececc767088020b4f3bc
SHA2568a0bd2ecc9810e8ef7a725961387e7504b1297e85ea163d4c355ac042c2a2554
SHA5129ddd85c6afcf26169c978846af8a5bcc028f8454d997ffd4ca8c3660b5ca2c29ec7e305dc8d4a341c6c8e9e4577025d2949b7e55225e820feeabea6185918edf
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
748B
MD5aa21ff611de58cd776878ae721f9dba6
SHA1e4d3e10fb81f2878c882bdec5ddfb0b2944670e8
SHA256de947581c04fd3bb85d040e80f100114b0e3456f4f0024f097185e12343ff576
SHA5125aff17cdecbaa2d12aacc14e712f75df5855620bf73a7accb523179118e978b5c7ba45d07d52f4ff6e4444371541f29be1fc0c2f8b67ce3a6dfeaef3380797eb