Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 00:11
Static task
static1
Behavioral task
behavioral1
Sample
b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe
-
Size
364KB
-
MD5
b596f3053aa0ee17ac014f793f986f76
-
SHA1
950c7f8f7b9c906d7e894243bce7973a1f26bbd4
-
SHA256
fa7b9285252fa6eb2d426c5d26ec79993ba08f2aeb30b919c806d2a73251e3f1
-
SHA512
610ebf5920c07d350b06cba4d348479ea34ad277864df03c8c0bb43d3a3af0394028eaa92ec0f3991511fc4140576f6ccf01b3200dd5a189e92edcb847476fb3
-
SSDEEP
6144:Kyxa+dYaWA5sjXjsXumqkzcwvgXbqzTtEk/reQpvsdf7Mzjtt6bq2EHkcwoVERU:TxzvG0Skz5vZfakLvsdf6zAxRU
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\windows defender1.exe = "C:\\Users\\Admin\\AppData\\Roaming\\windows defender1.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Roaming\\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe -
Loads dropped DLL 2 IoCs
pid Process 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows defender1 = "C:\\Users\\Admin\\AppData\\Roaming\\windows defender1\\windows defender1.exe" b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows defender1 = "C:\\Users\\Admin\\AppData\\Roaming\\windows defender1\\windows defender1.exe" b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 300 set thread context of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2980 reg.exe 2696 reg.exe 2856 reg.exe 2780 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 1 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeCreateTokenPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeAssignPrimaryTokenPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeLockMemoryPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeMachineAccountPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeTcbPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeSecurityPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeSystemtimePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeCreatePermanentPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeBackupPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeRestorePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeShutdownPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeDebugPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeAuditPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeUndockPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeSyncAgentPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeEnableDelegationPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeManageVolumePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeImpersonatePrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 31 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 32 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 33 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 34 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe Token: 35 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 300 wrote to memory of 1280 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 30 PID 300 wrote to memory of 1280 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 30 PID 300 wrote to memory of 1280 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 30 PID 300 wrote to memory of 1280 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 30 PID 1280 wrote to memory of 1400 1280 csc.exe 32 PID 1280 wrote to memory of 1400 1280 csc.exe 32 PID 1280 wrote to memory of 1400 1280 csc.exe 32 PID 1280 wrote to memory of 1400 1280 csc.exe 32 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 300 wrote to memory of 2316 300 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 33 PID 2316 wrote to memory of 2732 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 34 PID 2316 wrote to memory of 2732 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 34 PID 2316 wrote to memory of 2732 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 34 PID 2316 wrote to memory of 2732 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 34 PID 2316 wrote to memory of 2744 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 35 PID 2316 wrote to memory of 2744 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 35 PID 2316 wrote to memory of 2744 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 35 PID 2316 wrote to memory of 2744 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 35 PID 2316 wrote to memory of 2756 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 36 PID 2316 wrote to memory of 2756 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 36 PID 2316 wrote to memory of 2756 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 36 PID 2316 wrote to memory of 2756 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 36 PID 2316 wrote to memory of 2768 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 37 PID 2316 wrote to memory of 2768 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 37 PID 2316 wrote to memory of 2768 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 37 PID 2316 wrote to memory of 2768 2316 b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe 37 PID 2732 wrote to memory of 2856 2732 cmd.exe 43 PID 2732 wrote to memory of 2856 2732 cmd.exe 43 PID 2732 wrote to memory of 2856 2732 cmd.exe 43 PID 2732 wrote to memory of 2856 2732 cmd.exe 43 PID 2756 wrote to memory of 2696 2756 cmd.exe 44 PID 2756 wrote to memory of 2696 2756 cmd.exe 44 PID 2756 wrote to memory of 2696 2756 cmd.exe 44 PID 2756 wrote to memory of 2696 2756 cmd.exe 44 PID 2744 wrote to memory of 2780 2744 cmd.exe 42 PID 2744 wrote to memory of 2780 2744 cmd.exe 42 PID 2744 wrote to memory of 2780 2744 cmd.exe 42 PID 2744 wrote to memory of 2780 2744 cmd.exe 42 PID 2768 wrote to memory of 2980 2768 cmd.exe 45 PID 2768 wrote to memory of 2980 2768 cmd.exe 45 PID 2768 wrote to memory of 2980 2768 cmd.exe 45 PID 2768 wrote to memory of 2980 2768 cmd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iq4ps2b8.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC11E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC11D.tmp"3⤵
- System Location Discovery: System Language Discovery
PID:1400
-
-
-
C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exeC:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\b596f3053aa0ee17ac014f793f986f76_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2696
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windows defender1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windows defender1.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windows defender1.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windows defender1.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2980
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bc3d243755aba7420ed232986c7f6232
SHA1cdc421dcdb13e9aad07e0734a8909ebbc2fc59c3
SHA2564bbdb81c36b382de5ad17f635fbc126a364ad6f568dd2b3791d22d90dbac6523
SHA512f2dc88c630f7d6cd2db755d8f587f38bbe64937f6da3756e705ccad1c5c9d520b84f59dd34cfb984063bc0fa047f59ee8f7e4faab8e66e0ceed787de72644817
-
Filesize
5KB
MD50fc93aba26609564b811d7cf152b5878
SHA1587e5e2f48d0f3d9498e2315834feb4e2fd167f5
SHA2567997e8d99307300a17c2d7155e84f1f7ba0ba6af3f85a2029e42a8584c2152e9
SHA512aa8e161758145d9d10d4f53c5161a4f042a2029f9824b52867f831b67eeea6963a4c2d4313f0da7a0059b1bbcd2a9718aafd3be1461b41fb7ba0144d2e48d306
-
Filesize
6KB
MD5d89fdbb4172cee2b2f41033e62c677d6
SHA1c1917b579551f0915f1a0a8e8e3c7a6809284e6b
SHA2562cbdc0ddc7901a9b89615cc338f63e1800f864db431e7a7a85749f73cba0b383
SHA51248941f08ae00d342b52e3255b99ce36abb4e46a48075a760869bc86b1a32c0737eb2bd5e43d5ee665303ab134282f9732738755c4027043ed2d4f414faab63ed
-
Filesize
652B
MD58fd6dde8710cc11d45f22de16ae1e174
SHA1e888f5e020fa19511392b5d9582bf836f7c0128e
SHA2560f2e30878bbee725e87636bfca10e91943c9a385db73d7394799efa8dfcccd08
SHA5124fd5271d07268c2af466beeb43358ab38f0693c079e6098eaa258664ab5f07c9a50fe73d969d67a844a228e29f445832f6f2c944019eaddd30d457386bd6e14e
-
Filesize
5KB
MD5cb25540570735d26bf391e8b54579396
SHA1135651d49409214d21348bb879f7973384a7a8cb
SHA256922ec415710a6e1465ed8553838ddf19c8deb32b75da6dfaca372c1067d2d743
SHA512553ce9d3647b196ccbd6612c06d301afac992130ec5c80fe8fa8a42bab4250053fad651227ff97d9fab4ba8aaff562d421236dc0b2b5d0d4a17430985dd07080
-
Filesize
206B
MD50107b540d55088a97618e4571a9524c7
SHA19c01873f6c0dbbc3a91220c3aeb23545f4544bed
SHA2566005a558d626f7a13f91c663e5979aea473183f4db0b67dc167f3946e170c700
SHA5122594298423fc5963d2ad4b9a1e8739f6e1c3a24dbd5e9522efb99237dcf2927a8dea8fe21db69413021dcdfff7655be7e645f476e3e96acb929c43ca3f037b69