Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
d4f7ac86ac572454315130a0ed616fff
-
SHA1
d66709c9083ee4bc0f563ab08193527d080194ed
-
SHA256
96bd4ce2033976a257a79cad48bbf8d217eff40dfca04c1c7ec145e79db5aaaf
-
SHA512
435eef70a5818574e139e104f3082f0fc8d16d3994cdee9a8ae258d33ab049ef326d90af5fb4bad27727d3ab78038dfb9c213c50a5693f10b7efdc8d76cf4edb
-
SSDEEP
24576:ROfVkHfxVtfx+qI+iMNa73L+TL84qc6Xx6:RONIyTjMN2LlTXx
Score
10/10
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0009000000016c65-44.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2716 Exporer32.exe 2700 OENL.exe -
Loads dropped DLL 7 IoCs
pid Process 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2716 Exporer32.exe 2716 Exporer32.exe 2716 Exporer32.exe 2700 OENL.exe 2700 OENL.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OENL Agent = "C:\\Windows\\SysWOW64\\28463\\OENL.exe" OENL.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\OENL.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\OENL.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\OENL.exe Exporer32.exe File created C:\Windows\SysWOW64\28463\AKV.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 OENL.exe File created C:\Windows\SysWOW64\28463\OENL.001 Exporer32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OENL.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32\ThreadingModel = "Apartment" d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ProgID d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\VersionIndependentProgID\ = "ADOX.Table.6.0" d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45} d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ = "ADOX.Table.6.0" d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32\ = "%CommonProgramFiles%\\System\\ado\\msadox.dll" d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ProgID\ = "ADOX.Table.6.0" d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\VersionIndependentProgID d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Token: 33 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe Token: 33 2700 OENL.exe Token: SeIncBasePriorityPrivilege 2700 OENL.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 2700 OENL.exe 2700 OENL.exe 2700 OENL.exe 2700 OENL.exe 2700 OENL.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2312 wrote to memory of 2768 2312 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 30 PID 2768 wrote to memory of 2716 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2716 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2716 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 31 PID 2768 wrote to memory of 2716 2768 d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe 31 PID 2716 wrote to memory of 2700 2716 Exporer32.exe 32 PID 2716 wrote to memory of 2700 2716 Exporer32.exe 32 PID 2716 wrote to memory of 2700 2716 Exporer32.exe 32 PID 2716 wrote to memory of 2700 2716 Exporer32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4f7ac86ac572454315130a0ed616fff_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\28463\OENL.exe"C:\Windows\system32\28463\OENL.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
454B
MD51ad0b626eafdd3db771b734aca0e32e1
SHA1dd04fccb5851b115706275a2cc572c29927d195c
SHA256688d6a83ad3177ed220fc7db26c8fc66231f466e770ec3ef9f709cc62ecba6b4
SHA51296d52d6ce174fa0653f770d44b5fb3dc8f0e3d8729830e687baf1ae3fe13013af8ea9a1589116a41c3d20edd8578d9100b0c99615eb9a8606c94d35e83665ea4
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
480KB
MD5fc5de561e93892e45f9b034dbfa4f575
SHA15423374a92a48e7004c90ec0bb3b246becea0410
SHA256546210e2c69564a87068b01bcdd04338164f7929b83d9a611c4cfcb22415e2e1
SHA5125ba01eda2dd7322b7daa5cfd1a7b33d5eb37dca2cc94b2c157fde1e689bd85a0944df61c6415e25f019acf3a6c34814e0baaa09fdad8a427f10c8d68c3f24266
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8