Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 21:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe
-
Size
118KB
-
MD5
83a414f3dda5e233ac687d9afd4fe54f
-
SHA1
25698595bb6c6bf3c3eaf4a89ad88f598365cf8e
-
SHA256
05105b60f1a9809deed15a2f80411555dacd4afd0b4baf4160c8b48dc3d16ec7
-
SHA512
ca46bec22c63202a4dece02ae9fbb444f0d318d35d6b6c3320f0c186520a49b1b02d21a5ebd67eb94067c6dfc4dbbf9e4a2178ceb4da757223f3f1ed3ac7fd42
-
SSDEEP
3072:EpLwyDfulTE32lmoy9QSpUJh7LII1VjlXChDoJWt8zzS3kgg4UOvgvFheYsGr:QS1VjlokPS3kgg9igN4Yl
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation acrotray.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation acrotray .exe -
Executes dropped EXE 4 IoCs
pid Process 1596 acrotray.exe 4120 acrotray.exe 4308 acrotray .exe 3400 acrotray .exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "C:\\Program Files (x86)\\Adobe\\acrotray.exe" 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\acrotray .exe 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\acrotray.exe 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray .exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrotray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31124132" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074472bebe7af3a46942426e1e277b42a000000000200000000001066000000010000200000003490a52b2c997d384ab591e722fbd1bb13c3be7ba4c9a458cb5c03ea24ffd4bb000000000e8000000002000020000000da0346a70ea2895ca5c07b4e4f22b3c5c0400c330c8f623ca01d4ea27fa437f320000000eb0339f3314b0bf1fef6200bea1a4743fee07f942b4134de5ecd8057ba3ca781400000008fef5076fa67348eee1816cb27fd880fd591041785a9f794f1550bb6b23d51826485c465e1f885b1988d7a865750b669ead1aa4c77502004b589a920409c703f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2366841840" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0311d97a4eada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2366841840" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074472bebe7af3a46942426e1e277b42a000000000200000000001066000000010000200000006491743bdc3096dd2ae8926c859066cdae81e5b71c8373e99dbbeb69a8f4f777000000000e80000000020000200000002be4043ec37adabab474c076e6e54bcc7a68ad966ecb579cd68755fdec90bb2b2000000097bc06b675ef14de21403f9493036097dc562bbe02ac933faab0b535011cc96e40000000ef8e67939c852d53829480af944f97bad1f9d0c1cfec15f2fe94c87745f2d21ac02eef5d06aeb8fc3ef4550ab38ea7f758de80d571c3df253b7a1277f5bbc383 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31124132" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B8C17129-5697-11EF-9912-EE6C637598CE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6090308ca4eada01 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1596 acrotray.exe 1596 acrotray.exe 1596 acrotray.exe 1596 acrotray.exe 1596 acrotray.exe 1596 acrotray.exe 4120 acrotray.exe 4308 acrotray .exe 4120 acrotray.exe 4308 acrotray .exe 4308 acrotray .exe 4120 acrotray.exe 4308 acrotray .exe 4120 acrotray.exe 4308 acrotray .exe 4308 acrotray .exe 3400 acrotray .exe 3400 acrotray .exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe 3400 acrotray .exe 3400 acrotray .exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe 4120 acrotray.exe 4120 acrotray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe Token: SeDebugPrivilege 1404 83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe Token: SeDebugPrivilege 1596 acrotray.exe Token: SeDebugPrivilege 4120 acrotray.exe Token: SeDebugPrivilege 4308 acrotray .exe Token: SeDebugPrivilege 3400 acrotray .exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3228 iexplore.exe 3228 iexplore.exe 3228 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3228 iexplore.exe 3228 iexplore.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 3228 iexplore.exe 3228 iexplore.exe 220 IEXPLORE.EXE 220 IEXPLORE.EXE 3228 iexplore.exe 3228 iexplore.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2084 wrote to memory of 1404 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 86 PID 2084 wrote to memory of 1404 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 86 PID 2084 wrote to memory of 1404 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 86 PID 2084 wrote to memory of 1596 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 95 PID 2084 wrote to memory of 1596 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 95 PID 2084 wrote to memory of 1596 2084 83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe 95 PID 1596 wrote to memory of 4120 1596 acrotray.exe 98 PID 1596 wrote to memory of 4120 1596 acrotray.exe 98 PID 1596 wrote to memory of 4120 1596 acrotray.exe 98 PID 3228 wrote to memory of 2000 3228 iexplore.exe 99 PID 3228 wrote to memory of 2000 3228 iexplore.exe 99 PID 3228 wrote to memory of 2000 3228 iexplore.exe 99 PID 1596 wrote to memory of 4308 1596 acrotray.exe 100 PID 1596 wrote to memory of 4308 1596 acrotray.exe 100 PID 1596 wrote to memory of 4308 1596 acrotray.exe 100 PID 4308 wrote to memory of 3400 4308 acrotray .exe 101 PID 4308 wrote to memory of 3400 4308 acrotray .exe 101 PID 4308 wrote to memory of 3400 4308 acrotray .exe 101 PID 3228 wrote to memory of 220 3228 iexplore.exe 105 PID 3228 wrote to memory of 220 3228 iexplore.exe 105 PID 3228 wrote to memory of 220 3228 iexplore.exe 105 PID 3228 wrote to memory of 2376 3228 iexplore.exe 107 PID 3228 wrote to memory of 2376 3228 iexplore.exe 107 PID 3228 wrote to memory of 2376 3228 iexplore.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe"C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_jaffacakes118.exe" C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Program Files (x86)\Adobe\acrotray.exe"C:\Program Files (x86)\Adobe\acrotray.exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files (x86)\Adobe\acrotray .exe"C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray .exe" C:\Program Files (x86)\Adobe\acrotray.exe" C:\Users\Admin\AppData\Local\Temp\83a414f3dda5e233ac687d9afd4fe54f_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:2304
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3228 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3228 CREDAT:82950 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:220
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3228 CREDAT:82958 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5df97b5387a71ab2ff1219994eb96c0f8
SHA11d7d54bd4135b92e3de448aabe2ad47d9be349f6
SHA256a37b42ede4567eb9c0ea94598ed3cc4b5263870a073e0ce64d96eb2a8e908a74
SHA512626347b304a2e8954464a54b6b26fb39fe970b42edbdb971fd4ec1893e17281ec3598ca3eb962ec834c8a1a0c37f4f5920ab86b28a55da2270467d0a6141578c
-
Filesize
129KB
MD542df6ec4add9507ca3b5752b107d395e
SHA1362f111c3dad33769dc43d7bdf2ca17ed41cbec9
SHA256f8aa9eb2407419e3a19ef452e1629941dd869bc90673986603ba62677600a3a4
SHA512c8b3d1800839da02b6203f631d7397d8cc1a52a489dd923b1b742c9a3d67a2edba0d32c1820e2f75f5c34c26a67ca638664cd85a22de09d6247ca63e6cf7695b