Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2025, 04:57
Behavioral task
behavioral1
Sample
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe
Resource
win10v2004-20241007-en
General
-
Target
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe
-
Size
331KB
-
MD5
25e4b3153f2e61b139aaa9df1b2f8b12
-
SHA1
23c38b69b037670cafd48cf285cf88f41c7c854c
-
SHA256
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221
-
SHA512
b0c7090f25d63e7277e25d396db6636135a72c863f98bf24b23ab16ed547c593cf4ed19c6ebd969395cee205741ca7d5f9dffbe3ed770cbad016f33cb2f9d46e
-
SSDEEP
6144:FQAEfkGPHFi1zron6+s78g8mTXJgQ8EZbST8FQeLg5tIk:6/Fi1zro6+swHOEx8FQeLSq
Malware Config
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/628-1-0x0000000000450000-0x00000000004AA000-memory.dmp disable_win_def behavioral2/files/0x000d000000023a68-22.dat disable_win_def -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Pnsys.exe -
Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" Pnsys.exe -
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/628-1-0x0000000000450000-0x00000000004AA000-memory.dmp family_quasar behavioral2/files/0x000d000000023a68-22.dat family_quasar -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify = "1" Pnsys.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 5088 Pnsys.exe 3292 Pnsys.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify = "1" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\UACDisableNotify = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PocTelemetryAgentLogOfse = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe\"" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PocTelemetryAgentLogOfse = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe\"" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PocTelemetryAgentLogOfse = "\"C:\\Users\\Admin\\AppData\\Roaming\\PLogfsete\\Pnsys.exe\"" Pnsys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PocTelemetryAgentLogOfse = "\"C:\\Users\\Admin\\AppData\\Roaming\\PLogfsete\\Pnsys.exe\"" Pnsys.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Pnsys.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 19 pastebin.com 49 pastebin.com 3 pastebin.com 4 pastebin.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Modifies Security services 2 TTPs 16 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" Pnsys.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2476 vssadmin.exe 3292 vssadmin.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 888 schtasks.exe 2428 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3900 powershell.exe 3900 powershell.exe 1588 powershell.exe 1588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Token: SeBackupPrivilege 3088 vssvc.exe Token: SeRestorePrivilege 3088 vssvc.exe Token: SeAuditPrivilege 3088 vssvc.exe Token: SeDebugPrivilege 3900 powershell.exe Token: SeDebugPrivilege 5088 Pnsys.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeDebugPrivilege 3292 Pnsys.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5088 Pnsys.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 628 wrote to memory of 888 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 85 PID 628 wrote to memory of 888 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 85 PID 628 wrote to memory of 4572 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 87 PID 628 wrote to memory of 4572 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 87 PID 628 wrote to memory of 2476 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 89 PID 628 wrote to memory of 2476 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 89 PID 628 wrote to memory of 3900 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 93 PID 628 wrote to memory of 3900 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 93 PID 628 wrote to memory of 5088 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 95 PID 628 wrote to memory of 5088 628 cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe 95 PID 5088 wrote to memory of 2428 5088 Pnsys.exe 97 PID 5088 wrote to memory of 2428 5088 Pnsys.exe 97 PID 5088 wrote to memory of 212 5088 Pnsys.exe 99 PID 5088 wrote to memory of 212 5088 Pnsys.exe 99 PID 5088 wrote to memory of 3292 5088 Pnsys.exe 101 PID 5088 wrote to memory of 3292 5088 Pnsys.exe 101 PID 5088 wrote to memory of 1588 5088 Pnsys.exe 103 PID 5088 wrote to memory of 1588 5088 Pnsys.exe 103 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Pnsys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe"C:\Users\Admin\AppData\Local\Temp\cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Security services
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\Pev64\Files\PocTelemetryAgentLogOfse" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe" /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:888
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "PocTelemetryAgentLogOfse" /f2⤵PID:4572
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
-
C:\Users\Admin\AppData\Roaming\PLogfsete\Pnsys.exe"C:\Users\Admin\AppData\Roaming\PLogfsete\Pnsys.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies Security services
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5088 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\System\Pev64\Files\PocTelemetryAgentLogOfse" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\PLogfsete\Pnsys.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2428
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "PocTelemetryAgentLogOfse" /f3⤵PID:212
-
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
C:\Users\Admin\AppData\Roaming\PLogfsete\Pnsys.exeC:\Users\Admin\AppData\Roaming\PLogfsete\Pnsys.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3292
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5731e9e4becec0b1ef9caad4b3562d4b4
SHA16dffb77aba4e92ad5bd4b7c02fdee6f328bcd457
SHA25671c7eca538938fa4d5b470fee41cfe43734e9beb9ae409d5b41111fa1a15c2d5
SHA512841cf559ae5b0feec4be43018717641399b3602a553112e98b07d498f1a44169924466abc7e2313b8e8cf1c0fdc1bb7635e2818aab8269b0ef349a0ba0cd6ae5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
331KB
MD525e4b3153f2e61b139aaa9df1b2f8b12
SHA123c38b69b037670cafd48cf285cf88f41c7c854c
SHA256cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221
SHA512b0c7090f25d63e7277e25d396db6636135a72c863f98bf24b23ab16ed547c593cf4ed19c6ebd969395cee205741ca7d5f9dffbe3ed770cbad016f33cb2f9d46e
-
Filesize
76B
MD571330e621c034f659ccfe4dd0cf6ab9f
SHA1dab22af92eb3dc9d220ae9421631f817ca8b6bbc
SHA256b85d6e085df587885fb7351f4897346807d86484e12f68459a9c61b9b5005432
SHA512ade04e246e004fe46665286d5d89978b082605a551e849daf4fa358056a9b5163b67b8b9d78c16c8368922516639c1072b80f1d80eb1eb2e52d25fe9c2e8ecd4