Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 05:12
Static task
static1
Behavioral task
behavioral1
Sample
7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe
-
Size
565KB
-
MD5
7bd1449412431d9fac27834f581a0268
-
SHA1
a4bed12dcbf4468d4b522609a5e50f0e1395c8a7
-
SHA256
ab0cf46b521df780e8d0218b58c11eb2d35cbd04a90cbfc28fcf4e5051d607e1
-
SHA512
6f79fbb2662778c7990ac180ef533f52a5446d50686c2c5068d813e0f5ceca4435b9b7aaa638d2d10f5dc61643f940ff3a07e2ed9d3028946042a3e989edcd55
-
SSDEEP
12288:DOgs3HszQpXU13UUI5TBSOzh2fQSLFnJgrrjU:Ns3aQpXUSUIFUA2fQSLFJt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 5 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 4792 netsh.exe 2960 netsh.exe 1084 netsh.exe 100 netsh.exe 1768 netsh.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Lammer2.EXE7bd1449412431d9fac27834f581a0268_JaffaCakes118.exeLammer3.EXELammer1.EXELammer.EXELammer4.EXEdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Lammer2.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Lammer3.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Lammer1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Lammer.EXE Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation Lammer4.EXE -
Drops startup file 10 IoCs
Processes:
Windows.exeSystem32.exeWindowsDefender.exechrome.exeschost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43df5702df2db1f4d0e90dcf8d9bdc19.exe Windows.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd2be8e69be289f42cf0a96e88ff3d5b.exe System32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43df5702df2db1f4d0e90dcf8d9bdc19.exe Windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a41b6ebd1d33bb8c1cb2119ac71002de.exe WindowsDefender.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7713f6efd7d7f8c40858b5cd10ebb5cf.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7713f6efd7d7f8c40858b5cd10ebb5cf.exe chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c58a694823e51789bacd19e018ce8e02.exe schost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c58a694823e51789bacd19e018ce8e02.exe schost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a41b6ebd1d33bb8c1cb2119ac71002de.exe WindowsDefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd2be8e69be289f42cf0a96e88ff3d5b.exe System32.exe -
Executes dropped EXE 10 IoCs
Processes:
Lammer.EXELammer1.EXELammer2.EXELammer3.EXELammer4.EXEchrome.exeWindowsDefender.exeWindows.exeSystem32.exeschost.exepid process 4448 Lammer.EXE 3836 Lammer1.EXE 2964 Lammer2.EXE 4948 Lammer3.EXE 4268 Lammer4.EXE 3480 chrome.exe 3224 WindowsDefender.exe 2440 Windows.exe 4380 System32.exe 4392 schost.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
WindowsDefender.exeSystem32.exeschost.exeWindows.exechrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a41b6ebd1d33bb8c1cb2119ac71002de = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefender.exe\" .." WindowsDefender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a41b6ebd1d33bb8c1cb2119ac71002de = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefender.exe\" .." WindowsDefender.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd2be8e69be289f42cf0a96e88ff3d5b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c58a694823e51789bacd19e018ce8e02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\schost.exe\" .." schost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\43df5702df2db1f4d0e90dcf8d9bdc19 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c58a694823e51789bacd19e018ce8e02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\schost.exe\" .." schost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fd2be8e69be289f42cf0a96e88ff3d5b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7713f6efd7d7f8c40858b5cd10ebb5cf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\7713f6efd7d7f8c40858b5cd10ebb5cf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\43df5702df2db1f4d0e90dcf8d9bdc19 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.exe\" .." Windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
System32.exeWindowsDefender.exechrome.exeWindows.exeschost.exedescription pid process Token: SeDebugPrivilege 4380 System32.exe Token: SeDebugPrivilege 3224 WindowsDefender.exe Token: SeDebugPrivilege 3480 chrome.exe Token: SeDebugPrivilege 2440 Windows.exe Token: SeDebugPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe Token: SeIncBasePriorityPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe Token: SeIncBasePriorityPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe Token: SeIncBasePriorityPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe Token: SeIncBasePriorityPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe Token: SeIncBasePriorityPrivilege 4392 schost.exe Token: 33 3224 WindowsDefender.exe Token: SeIncBasePriorityPrivilege 3224 WindowsDefender.exe Token: 33 3480 chrome.exe Token: SeIncBasePriorityPrivilege 3480 chrome.exe Token: 33 4380 System32.exe Token: SeIncBasePriorityPrivilege 4380 System32.exe Token: 33 2440 Windows.exe Token: SeIncBasePriorityPrivilege 2440 Windows.exe Token: 33 4392 schost.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
7bd1449412431d9fac27834f581a0268_JaffaCakes118.exeLammer3.EXELammer1.EXELammer.EXELammer4.EXELammer2.EXEWindows.exeWindowsDefender.exechrome.exeSystem32.exeschost.exedescription pid process target process PID 1492 wrote to memory of 4448 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer.EXE PID 1492 wrote to memory of 4448 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer.EXE PID 1492 wrote to memory of 4448 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer.EXE PID 1492 wrote to memory of 3836 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer1.EXE PID 1492 wrote to memory of 3836 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer1.EXE PID 1492 wrote to memory of 3836 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer1.EXE PID 1492 wrote to memory of 2964 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer2.EXE PID 1492 wrote to memory of 2964 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer2.EXE PID 1492 wrote to memory of 2964 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer2.EXE PID 1492 wrote to memory of 4948 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer3.EXE PID 1492 wrote to memory of 4948 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer3.EXE PID 1492 wrote to memory of 4948 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer3.EXE PID 1492 wrote to memory of 4268 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer4.EXE PID 1492 wrote to memory of 4268 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer4.EXE PID 1492 wrote to memory of 4268 1492 7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe Lammer4.EXE PID 4948 wrote to memory of 3480 4948 Lammer3.EXE chrome.exe PID 4948 wrote to memory of 3480 4948 Lammer3.EXE chrome.exe PID 4948 wrote to memory of 3480 4948 Lammer3.EXE chrome.exe PID 3836 wrote to memory of 3224 3836 Lammer1.EXE WindowsDefender.exe PID 3836 wrote to memory of 3224 3836 Lammer1.EXE WindowsDefender.exe PID 3836 wrote to memory of 3224 3836 Lammer1.EXE WindowsDefender.exe PID 4448 wrote to memory of 2440 4448 Lammer.EXE Windows.exe PID 4448 wrote to memory of 2440 4448 Lammer.EXE Windows.exe PID 4448 wrote to memory of 2440 4448 Lammer.EXE Windows.exe PID 4268 wrote to memory of 4392 4268 Lammer4.EXE schost.exe PID 4268 wrote to memory of 4392 4268 Lammer4.EXE schost.exe PID 4268 wrote to memory of 4392 4268 Lammer4.EXE schost.exe PID 2964 wrote to memory of 4380 2964 Lammer2.EXE System32.exe PID 2964 wrote to memory of 4380 2964 Lammer2.EXE System32.exe PID 2964 wrote to memory of 4380 2964 Lammer2.EXE System32.exe PID 2440 wrote to memory of 2960 2440 Windows.exe netsh.exe PID 2440 wrote to memory of 2960 2440 Windows.exe netsh.exe PID 2440 wrote to memory of 2960 2440 Windows.exe netsh.exe PID 3224 wrote to memory of 1768 3224 WindowsDefender.exe netsh.exe PID 3224 wrote to memory of 1768 3224 WindowsDefender.exe netsh.exe PID 3224 wrote to memory of 1768 3224 WindowsDefender.exe netsh.exe PID 3480 wrote to memory of 4792 3480 chrome.exe netsh.exe PID 3480 wrote to memory of 4792 3480 chrome.exe netsh.exe PID 3480 wrote to memory of 4792 3480 chrome.exe netsh.exe PID 4380 wrote to memory of 1084 4380 System32.exe netsh.exe PID 4380 wrote to memory of 1084 4380 System32.exe netsh.exe PID 4380 wrote to memory of 1084 4380 System32.exe netsh.exe PID 4392 wrote to memory of 100 4392 schost.exe netsh.exe PID 4392 wrote to memory of 100 4392 schost.exe netsh.exe PID 4392 wrote to memory of 100 4392 schost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7bd1449412431d9fac27834f581a0268_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\Lammer.EXE"C:\Users\Admin\AppData\Roaming\Lammer.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\Windows.exe"C:\Users\Admin\AppData\Local\Temp\Windows.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows.exe" "Windows.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:2960 -
C:\Users\Admin\AppData\Roaming\Lammer1.EXE"C:\Users\Admin\AppData\Roaming\Lammer1.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe" "WindowsDefender.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:1768 -
C:\Users\Admin\AppData\Roaming\Lammer2.EXE"C:\Users\Admin\AppData\Roaming\Lammer2.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:1084 -
C:\Users\Admin\AppData\Roaming\Lammer3.EXE"C:\Users\Admin\AppData\Roaming\Lammer3.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:4792 -
C:\Users\Admin\AppData\Roaming\Lammer4.EXE"C:\Users\Admin\AppData\Roaming\Lammer4.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\schost.exe"C:\Users\Admin\AppData\Local\Temp\schost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\schost.exe" "schost.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:100
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
319B
MD591046f2e147049d3e53cd9bf9d4d95ed
SHA1228e347d062840b2edcbd16904475aacad414c62
SHA256ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc
SHA512071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0
-
Filesize
23KB
MD54930dde1b76d3a886b539c8fbe0c4ee7
SHA1436d5fecd006d51ae9da268600d93e62ec0c9e28
SHA256843ca7195e41f30700a18eda1168462c8746987c8ae92aa7af9f642aaa67278b
SHA512c5d160c2606a3e55f7c610567ac84fabd6d6700ba5ee163c04e440f8b15679c26407258241e83b939658898b3f65957aaf5a108089bf1bbba6649d3e6310f740
-
Filesize
23KB
MD5cde9fc63215bd544e1bd36a532ad97e7
SHA14fe8dd9ec4696640a2c70c1ce9682a5045f39d85
SHA2565994b98560fe850659064216f9a3030810d933c40163ca35fd9cf5914287bb27
SHA5121d18497fdf40a1aabaff7998b265fc613e648fca31a0accd8f4e9827a843fe27b06f128cc09696fc32c03505c552ce97383b949b6f6f7d9de1930cedfe3b4ee1
-
Filesize
23KB
MD5778eefef5ec195cffc908663e3234024
SHA15376facf2c5417f930236eae3206477714afaceb
SHA256a5a2a1283ce6cea0c16b6259c9af3fb5d3a413cf274d7823ec93a6da857ec9a7
SHA512cb43ced7a4a9518aa925e8e48b57072518c165d4356794faffe484694835b656bea91ad7df36ffcff5764816b866ec36944939eb24d4a7e09539dc96bf30a338
-
Filesize
23KB
MD5e1610181327b8e358105540b0c6e694b
SHA16cc14c8e5c7e3f82b87f003f3c3c97a0f4e22bbd
SHA2561394827b4f6d8ef8a352da505f1a6875915ad4a6bba4665181ddd410e89f1ac6
SHA5122b3aeba04d993003727cac48db835fa5a22918dc8e3a11b4f022089802e9c8539ac6db3332e755fd5d5a225d244b515831e0d468d46b946cf8ab92eb6225e960
-
Filesize
23KB
MD56534ac0f8282bda742f84c0be0d59fdb
SHA1f2825254164b55e643a7a9f9cf37d82a0cb58c67
SHA2569a06aad85ab062c00d2228fe01749738e8b4837a9199817e22424dc924e833d5
SHA512238a2d1be71a1f469bd4c42804bbddeb70e952343d0b72c7731e5628cb4be7b59b03c2114c15a76152ee410d4c29796e5ab90dd241dda17876774d3d358c285c