Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 14:37 UTC
Static task
static1
Behavioral task
behavioral1
Sample
fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe
-
Size
359KB
-
MD5
fa959b76f73f5951b7ad1f0eb23ee287
-
SHA1
ea95bcc3e3868706cd06cff1a32535c3a308c600
-
SHA256
fcd1f19f66313fca32cad8c96d10ff735a129a52914eed8d039be4ffa05273f9
-
SHA512
74c2815c9e59e03c3a0944c0f564d259bc418660a8ecf9ad1dea102a067bbfb2e1903194aa14f027e94f97abb8482061109e498f534ecc48a1cb502f046bdf90
-
SSDEEP
6144:eYSn9YgJHXTEpUtV0V0YuXYad7kOKdrM7JbfQtv3EYe8+PV46jn/jg:F7gNXTOK1d7kOKdKfQtv0nVbjbg
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 2856 mshta.exe 30 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
description ioc Process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 55 IoCs
resource yara_rule behavioral1/memory/1892-1-0x0000000000400000-0x0000000000461F20-memory.dmp modiloader_stage2 behavioral1/memory/1892-4-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/1892-5-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/1892-3-0x0000000000400000-0x0000000000461F20-memory.dmp modiloader_stage2 behavioral1/memory/1892-2-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/1892-7-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/1892-8-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/1892-9-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/2060-15-0x0000000005820000-0x00000000058FC000-memory.dmp modiloader_stage2 behavioral1/memory/2060-18-0x0000000005820000-0x00000000058FC000-memory.dmp modiloader_stage2 behavioral1/memory/1948-19-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-16-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-32-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-34-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-47-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-53-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-52-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-51-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-50-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-49-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-48-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-42-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-41-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-40-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-39-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-38-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-37-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-36-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-35-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-33-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-31-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-30-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-29-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-28-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-27-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-26-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/268-56-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-24-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-23-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-22-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-21-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-25-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-20-0x0000000000220000-0x000000000036A000-memory.dmp modiloader_stage2 behavioral1/memory/268-68-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/1892-58-0x0000000001DE0000-0x0000000001EBC000-memory.dmp modiloader_stage2 behavioral1/memory/268-74-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-73-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-72-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-71-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-70-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-69-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-67-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-66-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-65-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 behavioral1/memory/268-64-0x0000000000210000-0x000000000035A000-memory.dmp modiloader_stage2 -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
pid Process 1948 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\44e1594\\b465ea0.bat\"" regsvr32.exe -
pid Process 2060 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2060 set thread context of 1948 2060 powershell.exe 34 PID 1948 set thread context of 268 1948 regsvr32.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe -
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\63c05f1\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:bYgYY6c=\"yUYaO\";Vo7=new ActiveXObject(\"WScript.Shell\");untz7gxU=\"4CHx1M\";T7psv2=Vo7.RegRead(\"HKCU\\\\software\\\\yifrufkkyi\\\\fcecg\");Oli9gu=\"MIgvjQI0\";eval(T7psv2);Ym7W3We=\"Rs\";\"" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.1f507c30 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.1f507c30\ = "63c05f1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\63c05f1 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\63c05f1\shell regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\63c05f1\shell\open regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\63c05f1\shell\open\command regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 powershell.exe 2060 powershell.exe 2060 powershell.exe 2060 powershell.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe 1948 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2060 powershell.exe 1948 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2060 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2060 2980 mshta.exe 32 PID 2980 wrote to memory of 2060 2980 mshta.exe 32 PID 2980 wrote to memory of 2060 2980 mshta.exe 32 PID 2980 wrote to memory of 2060 2980 mshta.exe 32 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 2060 wrote to memory of 1948 2060 powershell.exe 34 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35 PID 1948 wrote to memory of 268 1948 regsvr32.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa959b76f73f5951b7ad1f0eb23ee287_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1892
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:XKuTq1E="D3";ef79=new%20ActiveXObject("WScript.Shell");I7ep0lSmT="pruJa";los1d7=ef79.RegRead("HKCU\\software\\LvXPIOvgH\\wj9Cgra");pHV4dAuA="2PvDxS4";eval(los1d7);O8Q7Gyqf="6f";1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:pjav2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:268
-
-
-
Network
- No results found
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 80 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
104 B 104 B 2 2
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
-
52 B 1
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD569b4e83def802b192e3fc2001802e7cc
SHA1782313f53f4b15849add08db1ef46bdbb32951e0
SHA2564486b1f7bd8ab8f19f4c54682041ac38046fdb2aad7c59a76416a3b7f6115515
SHA5128fedd0affd136556d5535d2b9e69092b474b89702146f79625f500d5d7b49c4bfef19db55f537fa091bbdf11eba79fecd658eb0c694a1ebc504ff2708a6cb320
-
Filesize
74B
MD519d2d331c8c790c11eb364fc3ee6c925
SHA1a5944b2ad78c0282760679daa70a1ff83992adf9
SHA256e6b73f60e0c0e233a1fcd501cac1526d2d2e25346cc1ab19aeb415b250c8ad8a
SHA512694a0813d4136f2053d07d70a80d367964ba46187c0072c2e152661ace5cb1a04f46b7c71864d7ddca14ab552558a9a25a87de627fa11b37a199f3eb89df1b86