Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 18:44
Behavioral task
behavioral1
Sample
5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
5d329190630c5c051e1b2c4ad4c69abd
-
SHA1
0227d4e1597ca90477cad5fc3a960f3590457031
-
SHA256
6974f159cb6e056fd9675ec4ecb6d271a7d6bb69711a295be593091d3bcb9e45
-
SHA512
0b0f745634bbab4234b0b8b9e5f80c9c99870fe0647afcfa88ffe1990012e9968bcf6f722d7f87c54e6cc7ca566e910a605688e7825a9b82629114f67dae69b9
-
SSDEEP
24576:O2G/nvxW3WDkIavL5BH7pdKk+BSjLeuNVg+4u:ObA3BI+BH9uB+r
Malware Config
Signatures
-
DcRat 9 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exe5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 900 schtasks.exe 1840 schtasks.exe 5020 schtasks.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe 2984 schtasks.exe 1856 schtasks.exe 656 schtasks.exe 3212 schtasks.exe 1848 schtasks.exe -
Modifies WinLogon for persistence 2 TTPs 8 IoCs
Processes:
hui.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\", \"C:\\Windows\\System32\\rasautou\\dllhost.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\", \"C:\\Windows\\System32\\rasautou\\dllhost.exe\", \"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\", \"C:\\Windows\\System32\\rasautou\\dllhost.exe\", \"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\", \"C:\\Windows\\System32\\coredpussvr\\SppExtComObj.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\", \"C:\\Windows\\System32\\rasautou\\dllhost.exe\", \"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\", \"C:\\Windows\\System32\\coredpussvr\\SppExtComObj.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\smss.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\", \"C:\\Documents and Settings\\WmiPrvSE.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\", \"C:\\Windows\\System32\\rasautou\\dllhost.exe\", \"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\", \"C:\\Windows\\System32\\coredpussvr\\SppExtComObj.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\smss.exe\", \"C:\\Windows\\System32\\browseui\\conhost.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\SKB\\LanguageModels\\System.exe\"" hui.exe -
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2984 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1856 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 656 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 900 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1840 960 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5020 960 schtasks.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Adobe\hui.exe dcrat behavioral2/memory/2656-13-0x0000000000200000-0x00000000002EE000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hui.exe5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation hui.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
Processes:
hui.exeSystem.exepid process 2656 hui.exe 3840 System.exe -
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
hui.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Documents and Settings\\WmiPrvSE.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\coredpussvr\\SppExtComObj.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Documents and Settings\\WmiPrvSE.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\ProximityCommon\\fontdrvhost.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\smss.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\smss.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\SKB\\LanguageModels\\System.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\SKB\\LanguageModels\\System.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\coredpussvr\\SppExtComObj.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics\\System.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\rasautou\\dllhost.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\rasautou\\dllhost.exe\"" hui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\browseui\\conhost.exe\"" hui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\System32\\browseui\\conhost.exe\"" hui.exe -
Drops file in System32 directory 8 IoCs
Processes:
hui.exedescription ioc process File created C:\Windows\System32\rasautou\dllhost.exe hui.exe File created C:\Windows\System32\rasautou\5940a34987c99120d96dace90a3f93f329dcad63 hui.exe File created C:\Windows\System32\ProximityCommon\fontdrvhost.exe hui.exe File created C:\Windows\System32\ProximityCommon\5b884080fd4f94e2695da25c503f9e33b9605b83 hui.exe File created C:\Windows\System32\coredpussvr\SppExtComObj.exe hui.exe File created C:\Windows\System32\coredpussvr\e1ef82546f0b02b7e974f28047f3788b1128cce1 hui.exe File created C:\Windows\System32\browseui\conhost.exe hui.exe File created C:\Windows\System32\browseui\088424020bedd6b28ac7fd22ee35dcd7322895ce hui.exe -
Drops file in Program Files directory 2 IoCs
Processes:
hui.exedescription ioc process File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe hui.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\69ddcba757bf72f7d36c464c71f42baab150b2b9 hui.exe -
Drops file in Windows directory 3 IoCs
Processes:
hui.exedescription ioc process File created C:\Windows\SKB\LanguageModels\System.exe hui.exe File opened for modification C:\Windows\SKB\LanguageModels\System.exe hui.exe File created C:\Windows\SKB\LanguageModels\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a hui.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exehui.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000_Classes\Local Settings hui.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1840 schtasks.exe 5020 schtasks.exe 2984 schtasks.exe 1856 schtasks.exe 3212 schtasks.exe 656 schtasks.exe 900 schtasks.exe 1848 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
hui.exeSystem.exepid process 2656 hui.exe 3840 System.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
hui.exeSystem.exedescription pid process Token: SeDebugPrivilege 2656 hui.exe Token: SeDebugPrivilege 3840 System.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exeWScript.execmd.exehui.execmd.exedescription pid process target process PID 2184 wrote to memory of 2684 2184 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe WScript.exe PID 2184 wrote to memory of 2684 2184 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe WScript.exe PID 2184 wrote to memory of 2684 2184 5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe WScript.exe PID 2684 wrote to memory of 4496 2684 WScript.exe cmd.exe PID 2684 wrote to memory of 4496 2684 WScript.exe cmd.exe PID 2684 wrote to memory of 4496 2684 WScript.exe cmd.exe PID 4496 wrote to memory of 2656 4496 cmd.exe hui.exe PID 4496 wrote to memory of 2656 4496 cmd.exe hui.exe PID 2656 wrote to memory of 2856 2656 hui.exe cmd.exe PID 2656 wrote to memory of 2856 2656 hui.exe cmd.exe PID 2856 wrote to memory of 3148 2856 cmd.exe chcp.com PID 2856 wrote to memory of 3148 2856 cmd.exe chcp.com PID 2856 wrote to memory of 1852 2856 cmd.exe w32tm.exe PID 2856 wrote to memory of 1852 2856 cmd.exe w32tm.exe PID 2856 wrote to memory of 3840 2856 cmd.exe System.exe PID 2856 wrote to memory of 3840 2856 cmd.exe System.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d329190630c5c051e1b2c4ad4c69abd_JaffaCakes118.exe"1⤵
- DcRat
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Adobe\sN8j8UtUmLUEbzv.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Adobe\87tDm8T1lOvAjdSEmWMIMA3JTpcTMB.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Roaming\Adobe\hui.exe"C:\Users\Admin\AppData\Roaming\Adobe\hui.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RVuqL2qAIw.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:3148
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1852
-
C:\Windows\SKB\LanguageModels\System.exe"C:\Windows\SKB\LanguageModels\System.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Documents and Settings\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\rasautou\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\ProximityCommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\coredpussvr\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\browseui\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD52b6d6f744795885e122a474148b9c073
SHA110056dad5c654ef25c6a582967c6e705cd47f441
SHA2563d71b33602576440ae08405247fdfcb787c69a67ec98b7dc103a9ab65dd7326d
SHA5120b09c3d64656cab580ba871264ff3e9f5c071ab9e319e740bbe1478db92a360fa64174aea62017d7ade40f547a96d0197201f5a4f66e1d691e494d55d62293fc
-
Filesize
25B
MD5e7f48aa75e0fb6a5ff062767274b118a
SHA135708e08c6fd4f4d5b90d205535eaf614f616947
SHA25675d94792b854edf88578815103ae48089e1cb0566c97c86bc3b3ecf5373778d7
SHA51285d827e4d81a7612ae78feda079f1a82812d7a430643db6bb3863c3cfe618649eb15b574c367d070c6fc594ebaf1c8ada66390279c703f7eb88e2c8b9a21adcb
-
Filesize
922KB
MD51b46dad7064609344351ac9efe3f9aab
SHA19aa8051f5ef6f800410ec669e52b415b6bf43816
SHA2563bd60f927e3882940077fa527712e5c55a2767564b39a932c4d4941e190a4c81
SHA512ce773799e73f0b61a793098df7a824346ec1d94d16877a272ace42a644d4fdf7d6a68b4a7c976b4b90471036f0d68b56bbfec18cffc68331c32970e7db7c57c4
-
Filesize
219B
MD570e5d6cdf95e6c8bd3cb92a5f27b41f1
SHA12139d28ec203b8e56a4d4b5f35cdc971711ee16b
SHA256ddbb5359838904c2276556b9e509443ffecba2ef2c15c97370f0a0df01a22a0d
SHA512b49e59956fe3b04980c2e9ba174da14239277b64c15a0d4cef2af1976bbaf9c7fec4a430afa1c1f56563a9f70b6d6339872be7dd847597a84b2a52730b399f3d