Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Perl.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Perl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
fontsize.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
fontsize.js
Resource
win10v2004-20240802-en
General
-
Target
c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe
-
Size
245KB
-
MD5
c14e1e0b99d986a11e3873a97fe6b496
-
SHA1
81a1816bca2ecd5386ad470a572e0f2f0d552540
-
SHA256
2f24af7d912806552a0160fcc1d02199a4e2926865791455aa3ab8ea71551e09
-
SHA512
a311ddd3a8b0e4cdd4dc23e46a0488ffdec69cc7bb401aa9af2d0f3ff9c7da3de6c60d32710e50cabf9fecc6b8dd126bf79d79607234f4f2eafb601176f2b9f9
-
SSDEEP
6144:Yn/L+VEJ48dDlHj0WVtm8RJYv+tDCQwPxY07J3dC:uaEjpdj0Wvm8LTDv+A
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 3 IoCs
flow pid Process 1544 904 mshta.exe 1546 904 mshta.exe 1548 904 mshta.exe -
Contacts a large (518) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
pid Process 2268 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpFFE2.bmp" c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2180 set thread context of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\prolog c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe File opened for modification C:\Windows\seemers c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1240 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 336 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1240 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeBackupPrivilege 2744 vssvc.exe Token: SeRestorePrivilege 2744 vssvc.exe Token: SeAuditPrivilege 2744 vssvc.exe Token: 33 1048 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1048 AUDIODG.EXE Token: 33 1048 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1048 AUDIODG.EXE Token: SeDebugPrivilege 336 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 904 mshta.exe 904 mshta.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2180 wrote to memory of 2000 2180 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 29 PID 2000 wrote to memory of 2900 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 30 PID 2000 wrote to memory of 2900 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 30 PID 2000 wrote to memory of 2900 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 30 PID 2000 wrote to memory of 2900 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 30 PID 2900 wrote to memory of 2972 2900 cmd.exe 32 PID 2900 wrote to memory of 2972 2900 cmd.exe 32 PID 2900 wrote to memory of 2972 2900 cmd.exe 32 PID 2000 wrote to memory of 904 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 39 PID 2000 wrote to memory of 904 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 39 PID 2000 wrote to memory of 904 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 39 PID 2000 wrote to memory of 904 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 39 PID 2000 wrote to memory of 2268 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 40 PID 2000 wrote to memory of 2268 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 40 PID 2000 wrote to memory of 2268 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 40 PID 2000 wrote to memory of 2268 2000 c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe 40 PID 2268 wrote to memory of 336 2268 cmd.exe 42 PID 2268 wrote to memory of 336 2268 cmd.exe 42 PID 2268 wrote to memory of 336 2268 cmd.exe 42 PID 2268 wrote to memory of 1240 2268 cmd.exe 44 PID 2268 wrote to memory of 1240 2268 cmd.exe 44 PID 2268 wrote to memory of 1240 2268 cmd.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\taskkill.exetaskkill /f /im "c14e1e0b99d986a11e3873a97fe6b496_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1240
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
- System Location Discovery: System Language Discovery
PID:2128
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5bc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD530262652d3f1d416a8e097233cb0f947
SHA14084748e332bd76ebaa99875acb292fd0e50bca7
SHA25696a3cb1c223e953e02117f8f7facc5a70c312195ebe9763843c61e3ad0a61d7d
SHA512648d63cd8678847d70cc978e3f900d930a73af62501dee0a8177af41ad5d18cf0dae049ac13107c039fde37d3d662b53dc1ffb710c5a97ecb5a22c70c8116beb
-
Filesize
3KB
MD58dba1a409f19dbcf3954982c655d1790
SHA1be2909f47feaab9b4c20a7fd1fe3b4005484eadb
SHA25602d1a363872fab1715209d778c7377081808e187681c8d5c21fef56a86d693a9
SHA5123bb4c8cb9a9a15cb1bb36a2df482ed5dded48581de8139bedb258a5312ef8180980dd11cf8dc8b97df5d86a7df25d3dc8aa31bb8e40a9e6a14856cd5fc90be50
-
Filesize
3KB
MD5ce6eb141e7945e01100e19234f0c332b
SHA1281e21b35d1cb9c9848dc8d87bc8405cf2fc0205
SHA25615daedf21d890eb2f48697504c8de40bdf7787944862f1268992d7e92de8c12e
SHA51264f14d25202a29e286f68f5fcfc37d65f598defd698b914134204e8f702e425a24b8045b846fecb2743126257d37b3387926c3fa737811656eeb7a24fe2235ef
-
Filesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
Filesize
11KB
MD5de3cfe19cebc2322bd5447a8ca9abc47
SHA18985671f81715c3c1d630cebc1fc48954c16feb8
SHA256dcad4e428c0f7f0fd73500bf346e70fca4ebd28a8874ebd06972681ffce7beb8
SHA512f1ac2a7e9fffe4a14173e398c837ace42207c41a7f0496c0581f040966ba40de5008ed70bdd76f30a5798bd36012a0fee0802389f8ab8907b6937140068a1fda