Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
55d8d7ede1e3f2f0e5137e4199b182c0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
55d8d7ede1e3f2f0e5137e4199b182c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
55d8d7ede1e3f2f0e5137e4199b182c0N.exe
-
Size
8.0MB
-
MD5
55d8d7ede1e3f2f0e5137e4199b182c0
-
SHA1
69fb9910794271e707b7584b04e075709e2a2a39
-
SHA256
53672acf950da3cee20f11595a35afbb3840c324ad2223552b282793e23c7f8f
-
SHA512
c680430898bea820c7290cbfeee7da406543682420a361cc33a3d01715961b027d35c012e1bc5b3c380a021a47622d3befedbbf40044ab0ffb0169a4c440ce46
-
SSDEEP
98304:0XZvnKYEUwMXKCGXZvnKYEUwMXKCgpFK0U8AmJNIo:0tnf3rXJGtnf3rXJWFKzYN
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1020 powershell.exe 3740 powershell.exe 4572 powershell.exe 1960 powershell.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 5 IoCs
pid Process 1856 ._cache_55d8d7ede1e3f2f0e5137e4199b182c0N.exe 768 Synaptics.exe 4464 Synaptics.exe 3512 Synaptics.exe 3592 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 55d8d7ede1e3f2f0e5137e4199b182c0N.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3696 set thread context of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 768 set thread context of 4464 768 Synaptics.exe 113 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4852 schtasks.exe 1316 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1012 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 1020 powershell.exe 3740 powershell.exe 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 1020 powershell.exe 3740 powershell.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 1960 powershell.exe 1960 powershell.exe 4572 powershell.exe 4572 powershell.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 768 Synaptics.exe 4572 powershell.exe 1960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeDebugPrivilege 3740 powershell.exe Token: SeDebugPrivilege 768 Synaptics.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1856 ._cache_55d8d7ede1e3f2f0e5137e4199b182c0N.exe 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE 1012 EXCEL.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 3696 wrote to memory of 1020 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 94 PID 3696 wrote to memory of 1020 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 94 PID 3696 wrote to memory of 1020 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 94 PID 3696 wrote to memory of 3740 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 96 PID 3696 wrote to memory of 3740 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 96 PID 3696 wrote to memory of 3740 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 96 PID 3696 wrote to memory of 4852 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 98 PID 3696 wrote to memory of 4852 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 98 PID 3696 wrote to memory of 4852 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 98 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 3696 wrote to memory of 2444 3696 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 100 PID 2444 wrote to memory of 1856 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 101 PID 2444 wrote to memory of 1856 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 101 PID 2444 wrote to memory of 1856 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 101 PID 2444 wrote to memory of 768 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 102 PID 2444 wrote to memory of 768 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 102 PID 2444 wrote to memory of 768 2444 55d8d7ede1e3f2f0e5137e4199b182c0N.exe 102 PID 768 wrote to memory of 4572 768 Synaptics.exe 106 PID 768 wrote to memory of 4572 768 Synaptics.exe 106 PID 768 wrote to memory of 4572 768 Synaptics.exe 106 PID 768 wrote to memory of 1960 768 Synaptics.exe 108 PID 768 wrote to memory of 1960 768 Synaptics.exe 108 PID 768 wrote to memory of 1960 768 Synaptics.exe 108 PID 768 wrote to memory of 1316 768 Synaptics.exe 110 PID 768 wrote to memory of 1316 768 Synaptics.exe 110 PID 768 wrote to memory of 1316 768 Synaptics.exe 110 PID 768 wrote to memory of 3512 768 Synaptics.exe 112 PID 768 wrote to memory of 3512 768 Synaptics.exe 112 PID 768 wrote to memory of 3512 768 Synaptics.exe 112 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 768 wrote to memory of 4464 768 Synaptics.exe 113 PID 4464 wrote to memory of 3592 4464 Synaptics.exe 114 PID 4464 wrote to memory of 3592 4464 Synaptics.exe 114 PID 4464 wrote to memory of 3592 4464 Synaptics.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d8d7ede1e3f2f0e5137e4199b182c0N.exe"C:\Users\Admin\AppData\Local\Temp\55d8d7ede1e3f2f0e5137e4199b182c0N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\55d8d7ede1e3f2f0e5137e4199b182c0N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SBYYcyqg.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SBYYcyqg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF676.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\55d8d7ede1e3f2f0e5137e4199b182c0N.exe"C:\Users\Admin\AppData\Local\Temp\55d8d7ede1e3f2f0e5137e4199b182c0N.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\._cache_55d8d7ede1e3f2f0e5137e4199b182c0N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_55d8d7ede1e3f2f0e5137e4199b182c0N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1856
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SBYYcyqg.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SBYYcyqg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5270.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1316
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:3512
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3592
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1012
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.0MB
MD555d8d7ede1e3f2f0e5137e4199b182c0
SHA169fb9910794271e707b7584b04e075709e2a2a39
SHA25653672acf950da3cee20f11595a35afbb3840c324ad2223552b282793e23c7f8f
SHA512c680430898bea820c7290cbfeee7da406543682420a361cc33a3d01715961b027d35c012e1bc5b3c380a021a47622d3befedbbf40044ab0ffb0169a4c440ce46
-
Filesize
144B
MD5b08fa3be953cb64475787b67f9316386
SHA158e153f103a56006c481962295a0849b435aaa07
SHA256c603b7880238275ffdcaf5783a3a90232960676ec2c7b001bd9165c22b5b52de
SHA5122099d0ded74bb607a95b3ddaa7a410bdc8aa2eff828917b8b048a6876a78eb8c1370c0dbb2a80b6a14fb709a36e75206afec776afe070d7c9a14fd4f467ffc9f
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD59c2e6429a342995b46e2d6e1e4a8abd6
SHA15ed963c72f6a7d8a2f9e4b47064d26d24660690e
SHA256090c60c543bbed34343f9911dcb22db4d4026247e944ae633ec4bff9f53a14e3
SHA512b36491875e564276d4c06c3cb3c1f725b9c7ead1546e816a1074ed8e92d4a7161e8b3828f264921e84936f6f4abe254ace040e340a54b0b1029122c225a1d547
-
Filesize
18KB
MD5672b2794ea0b79b4324c673952e59b78
SHA189611134a2c9cffec552939554aa35fc7edfca58
SHA25611f1336fffc8c0f674e40c70683d81f7db8183d6d5e5ba76cbd2adae7ad13493
SHA51249fc2f5becdae3e3e2e6dd3bed1b352cb017b9d67208e6e5b15ad6456c412d75d5d06244a435ec14395f9bd163798d580c2ea52b221895ec6312388a1a9f4392
-
Filesize
483KB
MD513e2266694c6d450ed6320e775ea6ca0
SHA12a700c9c8179aec8c1f3b5e51adf064655694202
SHA25614fafc8d570493d28077c853810754b4f5f7c803a58bf05456d4d197862191b4
SHA512121f24d2433bd3c0b60126259e12ce2c990aef48635f5297ec37db9ce3337301408b6b2f4562936d803341c40e4f68ed51ccc05319920c8d7b0300b007d8600e
-
Filesize
25KB
MD50014e75249bad1f9e07387a02f613707
SHA1c39cc2667a8424b90bffd6d3e3f6ab2cf100aef6
SHA256303fdd0724a4913b53b5170f3dcffd51987a94fc0a3ecde202275aa3cb001b81
SHA512ecf12dfb23b3d46b2b9cc3a3323ae48e7eaf95e5890f6f154136e2191e731ca66565676dd18e3aa6ac9aaffe31721501e8180bf8c8bbd7947eab62aa1692857a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1KB
MD5d3c93ae9f62b277f828cd297b2cd021b
SHA13d475c7f9f1670633f0ef67ed50a39405c5404fa
SHA256a5b46bfb82f7114df89ef574d8672d834596fd09744a7b4d541359188bd1d0b2
SHA5124ad59e207d96a70cf33fadda1817d116063ab13efd64c73a75e70bdd464d649d1c0f90cc83da04bc2abc379241240f0517789512aec18d8ab053a5fa6864cdcf