Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31-07-2024 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
General
-
Target
7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe
-
Size
492KB
-
MD5
7e0a79cad98add88070148fb9ddb12aa
-
SHA1
75effc9d69686bf3a5937ffe48e2711b8d2828e3
-
SHA256
961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
-
SHA512
ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad
-
SSDEEP
12288:UrrkmWeRqPx0tCgJGP66jcrcfAD0UUzViH:eOecPx0tCp66AQ4D0UUzsH
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\No$Crypter.exe = "C:\\Users\\Admin\\AppData\\Roaming\\No$Crypter.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid Process 2700 explorer.exe -
Executes dropped EXE 3 IoCs
Processes:
explorer.exenvxdsinc.exeSiaPort.exepid Process 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe -
Loads dropped DLL 6 IoCs
Processes:
7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exeexplorer.exenvxdsinc.exepid Process 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 2700 explorer.exe 2700 explorer.exe 1732 nvxdsinc.exe 1732 nvxdsinc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
nvxdsinc.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\nvxdsinc.exe" nvxdsinc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
explorer.exeSiaPort.exedescription pid Process procid_target PID 2700 set thread context of 2620 2700 explorer.exe 31 PID 1236 set thread context of 2408 1236 SiaPort.exe 46 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exe7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.execmd.execmd.exereg.execmd.exeAppLaunch.exereg.exeSiaPort.exeexplorer.exeAppLaunch.exenvxdsinc.exereg.exereg.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SiaPort.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxdsinc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid Process 2364 reg.exe 2368 reg.exe 1800 reg.exe 1140 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
explorer.exenvxdsinc.exeSiaPort.exepid Process 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe 1732 nvxdsinc.exe 1236 SiaPort.exe 2700 explorer.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
Processes:
7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exeexplorer.exeAppLaunch.exenvxdsinc.exeSiaPort.exedescription pid Process Token: SeDebugPrivilege 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe Token: SeDebugPrivilege 2700 explorer.exe Token: 1 2620 AppLaunch.exe Token: SeCreateTokenPrivilege 2620 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 2620 AppLaunch.exe Token: SeLockMemoryPrivilege 2620 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 2620 AppLaunch.exe Token: SeMachineAccountPrivilege 2620 AppLaunch.exe Token: SeTcbPrivilege 2620 AppLaunch.exe Token: SeSecurityPrivilege 2620 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2620 AppLaunch.exe Token: SeLoadDriverPrivilege 2620 AppLaunch.exe Token: SeSystemProfilePrivilege 2620 AppLaunch.exe Token: SeSystemtimePrivilege 2620 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2620 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2620 AppLaunch.exe Token: SeCreatePagefilePrivilege 2620 AppLaunch.exe Token: SeCreatePermanentPrivilege 2620 AppLaunch.exe Token: SeBackupPrivilege 2620 AppLaunch.exe Token: SeRestorePrivilege 2620 AppLaunch.exe Token: SeShutdownPrivilege 2620 AppLaunch.exe Token: SeDebugPrivilege 2620 AppLaunch.exe Token: SeAuditPrivilege 2620 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2620 AppLaunch.exe Token: SeChangeNotifyPrivilege 2620 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2620 AppLaunch.exe Token: SeUndockPrivilege 2620 AppLaunch.exe Token: SeSyncAgentPrivilege 2620 AppLaunch.exe Token: SeEnableDelegationPrivilege 2620 AppLaunch.exe Token: SeManageVolumePrivilege 2620 AppLaunch.exe Token: SeImpersonatePrivilege 2620 AppLaunch.exe Token: SeCreateGlobalPrivilege 2620 AppLaunch.exe Token: 31 2620 AppLaunch.exe Token: 32 2620 AppLaunch.exe Token: 33 2620 AppLaunch.exe Token: 34 2620 AppLaunch.exe Token: 35 2620 AppLaunch.exe Token: SeDebugPrivilege 1732 nvxdsinc.exe Token: SeDebugPrivilege 1236 SiaPort.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AppLaunch.exeAppLaunch.exepid Process 2620 AppLaunch.exe 2620 AppLaunch.exe 2620 AppLaunch.exe 2408 AppLaunch.exe 2408 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exeexplorer.exeAppLaunch.execmd.execmd.execmd.exedescription pid Process procid_target PID 2732 wrote to memory of 2700 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2700 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2700 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 30 PID 2732 wrote to memory of 2700 2732 7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 2620 2700 explorer.exe 31 PID 2700 wrote to memory of 1732 2700 explorer.exe 32 PID 2700 wrote to memory of 1732 2700 explorer.exe 32 PID 2700 wrote to memory of 1732 2700 explorer.exe 32 PID 2700 wrote to memory of 1732 2700 explorer.exe 32 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 580 2620 AppLaunch.exe 33 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 3024 2620 AppLaunch.exe 34 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 856 2620 AppLaunch.exe 35 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 2620 wrote to memory of 1700 2620 AppLaunch.exe 36 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 856 wrote to memory of 1800 856 cmd.exe 42 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 3024 wrote to memory of 2368 3024 cmd.exe 41 PID 580 wrote to memory of 1140 580 cmd.exe 44 PID 580 wrote to memory of 1140 580 cmd.exe 44 PID 580 wrote to memory of 1140 580 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7e0a79cad98add88070148fb9ddb12aa_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1140
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2368
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1800
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\No$Crypter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\No$Crypter.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"C:\Users\Admin\AppData\Local\Temp\System\SiaPort.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1236 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD54538db5dab04a07ad6385a2166c65cf0
SHA198c7e4588d9418643df5bc7d4e7d1cef2ff4423e
SHA25682bbdff4d25adb230894bab9f72df55f044cf9ea063a48f99055a599af819bb5
SHA512c4d0098b9ca2862cd053cd722fb8be9b3229bc5c4617036571c145fe33762856806ecb8eb73f3bcf3279ae8e8e5d8500722ef08eb611cf101cdcb5d74cf6cb26
-
Filesize
37KB
MD596fafbeae063dcf2947958423ca42d3f
SHA1da7b4d92877bedfe6238e04eb7ec8662e0d5e4e5
SHA2569a768bfedb5c7f3f1bae0171d6ef7f002a41ec3545e54e25824edbf423efafee
SHA512d083b327fc9f9a5c998706d3ec4137fa96a80f9f1dd1d622363d587dc225ba206f99d7878cdc67b93746f73b31e87509fb88dd3a55537a1cde39476cd872f277
-
Filesize
492KB
MD57e0a79cad98add88070148fb9ddb12aa
SHA175effc9d69686bf3a5937ffe48e2711b8d2828e3
SHA256961e10de552361ed6da39826e2c634251e0218f3eea9ddba83a99e56338f77a1
SHA512ac2cd4fd7fd9a67c813f86d7a3bc5d46f5067a8cc310eeb42f940e96688090d4a6e0e2b8f751ce830fd0be9ebc93ee7e53e2f92a1fdea044971a0351352534ad