Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 12:21
Behavioral task
behavioral1
Sample
21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe
Resource
win10v2004-20241007-en
General
-
Target
21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe
-
Size
2.4MB
-
MD5
1e148da61555b6d30c6ba6e5b4e5010c
-
SHA1
56d1b7b37873b084837ea73b96ae384bf9e0100a
-
SHA256
21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54
-
SHA512
f6c2b9ebb2784f0c768ab12ba1327cb86a7387d3a942bf0f16e29b1788d96400a3b55df1cf442bb65dc89646afcfc27b838022c4f36991710b5bc9c97494166f
-
SSDEEP
49152:InsHyjtk2MYC5GDcj0c1qaggaqW+2JsKomXNqSf0E7T3rOL:Insmtk2arjnxC5sHmQXE7GL
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe -
Executes dropped EXE 3 IoCs
pid Process 5084 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 2736 Synaptics.exe 4580 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe -
resource yara_rule behavioral2/files/0x0009000000023c54-5.dat upx behavioral2/memory/5084-43-0x0000000000400000-0x0000000000955000-memory.dmp upx behavioral2/memory/4580-137-0x0000000000400000-0x0000000000955000-memory.dmp upx behavioral2/memory/5084-191-0x0000000000400000-0x0000000000955000-memory.dmp upx behavioral2/memory/5084-192-0x0000000000400000-0x0000000000955000-memory.dmp upx behavioral2/memory/4580-195-0x0000000000400000-0x0000000000955000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 42 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ._cache_Synaptics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ ._cache_Synaptics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000004759f149120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe4759f149305aa6622e0000006ee10100000001000000000000000000000000000000d06b11004100700070004400610074006100000042000000 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000305aa962100054656d7000003a0009000400efbe4759f149305aa9622e00000083e10100000001000000000000000000000000000000c7a3ba00540065006d007000000014000000 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000004759214c10004c6f63616c003c0009000400efbe4759f149305aa6622e00000082e1010000000100000000000000000000000000000043b623014c006f00630061006c00000014000000 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots ._cache_Synaptics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Set value (data) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 ._cache_Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings ._cache_Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2040 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 4580 ._cache_Synaptics.exe 5084 ._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4520 wrote to memory of 5084 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 83 PID 4520 wrote to memory of 5084 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 83 PID 4520 wrote to memory of 5084 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 83 PID 4520 wrote to memory of 2736 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 84 PID 4520 wrote to memory of 2736 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 84 PID 4520 wrote to memory of 2736 4520 21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe 84 PID 2736 wrote to memory of 4580 2736 Synaptics.exe 85 PID 2736 wrote to memory of 4580 2736 Synaptics.exe 85 PID 2736 wrote to memory of 4580 2736 Synaptics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe"C:\Users\Admin\AppData\Local\Temp\21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe"C:\Users\Admin\AppData\Local\Temp\._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD51e148da61555b6d30c6ba6e5b4e5010c
SHA156d1b7b37873b084837ea73b96ae384bf9e0100a
SHA25621d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54
SHA512f6c2b9ebb2784f0c768ab12ba1327cb86a7387d3a942bf0f16e29b1788d96400a3b55df1cf442bb65dc89646afcfc27b838022c4f36991710b5bc9c97494166f
-
C:\Users\Admin\AppData\Local\Temp\._cache_21d35a7d045b0412f8379c36d2e53a919b5aafdc7e4a2c96fe49b69ace2f9f54.exe
Filesize1.7MB
MD50d853b382746e7b22d99baeb1cc4d9fa
SHA1e58eaea35d749d454307be8f9014f70bf8f3924e
SHA2562af92c02377acaca3c387d8a807a56bb29b1b223f1197ec84e7eb965bb21cd0b
SHA512979900535be82b489cc8fa0a87425b7211eb30a893356bd5779ec56b5bcdeab651e08f77a6958cc3a2037ed2055c53537ca9b5f109f19d57dde0b0437617de22
-
Filesize
21KB
MD5cd0c57dd9ce758281376a3b950730465
SHA173c6d121b0cc39266ac3e0a6004c84c7f969fdf4
SHA256eacd712435ca68ea1a495e765ca056246d93f9529f3bb6dee37e4d4c71d0988f
SHA512f51fa46aa8ca2b0ca2d009b9a842dd4a4b89f04c0f86c2f8eb55c03913a699353f481ad605da02d739cdf20cb10201445dfdc366237b64f8647d268799189cb2
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04