Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe
-
Size
322KB
-
MD5
6f0ea559284ef9d1283c63ca04e5c3a2
-
SHA1
90e150a951b73e0404a0c20533bef7eff1c45ef5
-
SHA256
4267660783e70658681a12072da9b25494f4c7016c27152331fcfb836a236ced
-
SHA512
800275ad79ac8ac497dcec59f977dd413de0a64dd8345785edb7c51da2c8e39f7e5e6ca339d3ab536f34a73cbe1d97e244b16d325d9742fcb6c572558b4877fa
-
SSDEEP
6144:QyfgMg2MYWjcBjhbeDS4CA04wEXLAP9zooNa4GMk8DZi:QIiYWjIjh6SuXMlzoox3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 368 dwxxdxwxxd.exe -
resource yara_rule behavioral2/memory/460-2-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/460-17-0x0000000000400000-0x0000000000485000-memory.dmp upx behavioral2/memory/460-13-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/368-168-0x0000000000400000-0x0000000000484000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwxxdxwxxd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 368 dwxxdxwxxd.exe 368 dwxxdxwxxd.exe 368 dwxxdxwxxd.exe 368 dwxxdxwxxd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe Token: SeDebugPrivilege 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe Token: SeDebugPrivilege 368 dwxxdxwxxd.exe Token: SeDebugPrivilege 368 dwxxdxwxxd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 460 wrote to memory of 3408 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 56 PID 460 wrote to memory of 612 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 5 PID 460 wrote to memory of 668 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 7 PID 460 wrote to memory of 780 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 8 PID 460 wrote to memory of 784 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 9 PID 460 wrote to memory of 796 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 10 PID 460 wrote to memory of 892 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 11 PID 460 wrote to memory of 956 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 12 PID 460 wrote to memory of 64 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 13 PID 460 wrote to memory of 744 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 14 PID 460 wrote to memory of 864 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 15 PID 460 wrote to memory of 912 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 16 PID 460 wrote to memory of 1080 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 17 PID 460 wrote to memory of 1092 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 18 PID 460 wrote to memory of 1100 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 19 PID 460 wrote to memory of 1120 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 20 PID 460 wrote to memory of 1256 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 21 PID 460 wrote to memory of 1268 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 22 PID 460 wrote to memory of 1300 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 23 PID 460 wrote to memory of 1404 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 24 PID 460 wrote to memory of 1464 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 25 PID 460 wrote to memory of 1488 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 26 PID 460 wrote to memory of 1500 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 27 PID 460 wrote to memory of 1604 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 28 PID 460 wrote to memory of 1640 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 29 PID 460 wrote to memory of 1660 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 30 PID 460 wrote to memory of 1728 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 31 PID 460 wrote to memory of 1780 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 32 PID 460 wrote to memory of 1844 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 33 PID 460 wrote to memory of 1860 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 34 PID 460 wrote to memory of 1868 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 35 PID 460 wrote to memory of 1928 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 36 PID 460 wrote to memory of 2012 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 37 PID 460 wrote to memory of 1368 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 38 PID 460 wrote to memory of 996 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 39 PID 460 wrote to memory of 2212 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 40 PID 460 wrote to memory of 2256 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 41 PID 460 wrote to memory of 2304 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 42 PID 460 wrote to memory of 2312 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 43 PID 460 wrote to memory of 2352 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 44 PID 460 wrote to memory of 2448 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 45 PID 460 wrote to memory of 2500 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 46 PID 460 wrote to memory of 2508 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 47 PID 460 wrote to memory of 2532 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 48 PID 460 wrote to memory of 2852 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 49 PID 460 wrote to memory of 2420 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 51 PID 460 wrote to memory of 768 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 52 PID 460 wrote to memory of 3160 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 53 PID 460 wrote to memory of 3168 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 54 PID 460 wrote to memory of 3320 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 55 PID 460 wrote to memory of 3408 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 56 PID 460 wrote to memory of 3544 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 57 PID 460 wrote to memory of 3732 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 58 PID 460 wrote to memory of 3824 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 59 PID 460 wrote to memory of 3892 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 60 PID 460 wrote to memory of 3976 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 61 PID 460 wrote to memory of 4172 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 62 PID 460 wrote to memory of 4580 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 65 PID 460 wrote to memory of 4608 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 67 PID 460 wrote to memory of 4996 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 68 PID 460 wrote to memory of 4276 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 69 PID 460 wrote to memory of 1940 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 70 PID 460 wrote to memory of 1444 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 71 PID 460 wrote to memory of 5116 460 6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe 72
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:780
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:64
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:796
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2852
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3732
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3824
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3892
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3976
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4172
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:1444
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4484
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3552
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4536
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:2156
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2176
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:864
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1080
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3168
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:2516
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1268
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2420
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1488
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1604
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1660
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1860
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1928
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1368
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2352
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2448
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3320
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f0ea559284ef9d1283c63ca04e5c3a2_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\dwxxdxwxxd.exe\dwxxdxwxxd.exe"C:\dwxxdxwxxd.exe\dwxxdxwxxd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4580
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4276
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:5116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166KB
MD5e90498dd27ee8b61c0c47ec80a422106
SHA1b9eeef220358f0669ac7e5576d4bfa3e0889690c
SHA256b6178469f15c79723c9f53c07e10699af62ae0d6c6c6376e502b6dc356850be5
SHA512327cb6e76ee9fd2e37b3b8ca077f95f365d97c4efc096b1ebf4f7c5499e466df763d3d7f105855a1fef7584aeea0ccbc3bfd824c32c22f838f623c4773aefa44
-
Filesize
322KB
MD56f0ea559284ef9d1283c63ca04e5c3a2
SHA190e150a951b73e0404a0c20533bef7eff1c45ef5
SHA2564267660783e70658681a12072da9b25494f4c7016c27152331fcfb836a236ced
SHA512800275ad79ac8ac497dcec59f977dd413de0a64dd8345785edb7c51da2c8e39f7e5e6ca339d3ab536f34a73cbe1d97e244b16d325d9742fcb6c572558b4877fa