Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
108s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/09/2024, 14:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=0
Resource
win11-20240802-en
General
-
Target
https://drive.google.com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=0
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 drive.google.com 5 drive.google.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf.rar:Zone.Identifier msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4656 msedge.exe 4656 msedge.exe 3008 msedge.exe 3008 msedge.exe 3116 msedge.exe 3116 msedge.exe 240 identity_helper.exe 240 identity_helper.exe 3392 msedge.exe 3392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 3796 7zG.exe Token: 35 3796 7zG.exe Token: SeSecurityPrivilege 3796 7zG.exe Token: SeSecurityPrivilege 3796 7zG.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3796 7zG.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe 3008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 4944 3008 msedge.exe 80 PID 3008 wrote to memory of 4944 3008 msedge.exe 80 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 1212 3008 msedge.exe 82 PID 3008 wrote to memory of 4656 3008 msedge.exe 83 PID 3008 wrote to memory of 4656 3008 msedge.exe 83 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84 PID 3008 wrote to memory of 2100 3008 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1UJlpm6BrqxbNRabncHtydNGlNYi1ouHg&export=download&authuser=01⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed58d3cb8,0x7ffed58d3cc8,0x7ffed58d3cd82⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:22⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:12⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,16697420903699126277,15979813767830015881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:12⤵PID:1192
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3192
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3552
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf\" -spe -an -ai#7zMap18409:378:7zEvent278651⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d30a5618854b9da7bcfc03aeb0a594c4
SHA17f37105d7e5b1ecb270726915956c2271116eab7
SHA2563494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8
SHA512efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77
-
Filesize
152B
MD503a56f81ee69dd9727832df26709a1c9
SHA1ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b
SHA25665d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53
SHA512e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781
-
Filesize
797B
MD5534cf691ed7e6020fe283ff239d82d53
SHA1f6eb79a1a1b8e1f9ce9bacb2cae2978cd4565f9c
SHA256b51f7f6f57fc0474b776c79bead176b03e5c0f8af7ce76ef578e99dc74b24a1b
SHA51215e2ae6f2f53183a027d0003806abdd4b9b1eddeabef487fd0aacb4efadeff2985dc9fc47cb96b085d901cc0b993e0c2d4ef05b3868e90a8cb5f3f7b76422588
-
Filesize
6KB
MD57e2a841c5b4fd9c61197aaa9c2fbf010
SHA10224e431ec1e5d305aa3ee2661ce118f2d35d614
SHA256a981dbb45b76a6e223134a8e571347e370a73810185b3c2c8dd8a3b14ed9cc1f
SHA512a46389a24674e4c56954b1771c8760d76f6c4d10221232c3a1458aa5b4a7e2c8a8f9f8f9a21a770d1f64a640a26a99d2331cc6512c69fc1f203cd44bcc21eac3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa0ae28c-8edb-478b-a8ac-2ec89b12ef5d.tmp
Filesize5KB
MD5f6e05c4f7a28472e8971df4d49d7d1cd
SHA16295c0b0bfc5c8f7222555a83364271f41394c71
SHA256df8898c908e887aa3c175f53f15199bfda6754108ae3dab32a24791c231cd7e6
SHA51258ccdd67b3fe213abab2be45ad2484526f5717dec67022d7643c817e0493071afb05cb48a002eb3990349fd3e0199e73dbc591a6e19105534b2ddb979e0be7be
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD515c7bd506411582678192e3529b854ad
SHA1a391bc22610bb82f1e02fbd1ff4329e163f0b92a
SHA2562b87e2713477b359653a67f57b47d4ffae925628afbe5a6548768f52a5123519
SHA512a131c2c9e156998d602e11c31b06746e696cd937850c15b6ae4d47cb6325e4b5ba4dc4de982010810b80d49360809cdab4a726db7fb71d803faa2839454de1df
-
Filesize
10KB
MD543712ed2f329bc2e541956bad33fdfe4
SHA15f72e66b763e2e7435ee6f630f609d1f978b7e1e
SHA25610659b831deffbdb3845aa11bc6c2a787f18306a9239a66c108db787acfe5987
SHA512f359ae3f023f9a0e13c7ae15b852f677f6ef12c39cedcfc14c0575d916b71fa950dc38c99fdc945b488de016db0fcf7a5e84a2a630407fdbf9eaea542711c5d1
-
C:\Users\Admin\Downloads\COPIA_ANEXA_PROCESO_00020240902_PARA_REVISION_CASO_SALDOS_VENCIDOS_O_PENDIENTES_DE_PAGO_POR_CONCEPTO_DE_IMPUESTO_PROXIMOS_A_EJECUTORIAR_ACCIONES_DE_EMBARGOpdf.rar:Zone.Identifier
Filesize26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
793KB
MD55bc206a820baef4708ca6101bc203c3f
SHA114d4a8d0a5efea5a1a50502a92676235cf9f281a
SHA25615b7c7446ff2832e7b9f04c465024e8289423393c6fea83353157e54fbafe091
SHA512930223f65391463ddeef4c059d449593dca258994e55fce3b9b5f31a16082cb6e6dc618bb13ee8dfe62534f4a2b428834ff605b63267f5202d004f83bc3090a7