Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
-
Size
551KB
-
MD5
112dc26f534e4e55fefddaa621582eb0
-
SHA1
5597de93bebe233e2e1d7e945f246a071528cdab
-
SHA256
76706689031f218ca95e49d057039a983362a549aced4071b079f375c758b93b
-
SHA512
deb4c57bdc7848bbeda69258928cfd5a36c7ee4a4eab1fb6ad80ee243ac20ca3f4541e4faea7a153ca74e85cec6a5670040729adfc56e66d5286b082b5cb39b0
-
SSDEEP
12288:h1OgLdaO0Wctn+MEfOUgbJuMmFcouJqks:h1OYdaO0tMOUgJHJJqks
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2784 regsvr32.exe 2784 regsvr32.exe -
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfnfgiejniaifjddlbblpaancnkdnelm\5.10\manifest.json regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ = "savenShare" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe -
Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\savenShare\\j43M04.tlb" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare. regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CLSID\ = "{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID\ = "saVenSSHare..5.10" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\savenShare" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\ = "savenShare" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ = "savenShare" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32\ = "C:\\ProgramData\\savenShare\\j43M04.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CurVer\ = "saVenSSHare..5.10" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\ = "savenShare" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\CLSID\ = "{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID\ = "saVenSSHare." regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2784 1628 112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /n /s /i:"" sLlkS2.dll2⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences
Filesize5KB
MD5546b345f7f9945dfd0dc2f305c24b19c
SHA1809b176a86d66354b5311fdb47913b0209f7b8d7
SHA256ca8cf75fb5631267b97cfbc679133bb7c314146ff3ff9daa4b1c8e269b0fb2b8
SHA51227710fc946b671e34393d4228cd6e85da476cc17bb7e460b4a8e657172b0a40f37214b8a4b0e63167f8b2ae971b8820b6f6fe2eb64581a5ae4ad41d1aeebc0b3
-
Filesize
180KB
MD50e093772550eb9541dd715c016b5584a
SHA120338dc859a5652f5661280dc508f4e5b533e76d
SHA256028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149
SHA5120030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5
-
Filesize
2KB
MD548e9706fe9f76731f3576122fc3e9e33
SHA1387c8c4898ead8ace488a7df80fead429eaf167b
SHA2567bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1
SHA512e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6
-
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5e302eade9949c6e4ecc999f454c61497
SHA117b84af250f821a9da87cc26da87abff54fab87b
SHA256d0393399c9dda621e88f0ef460472970f0c590d38a3067224d00c1fd12226b1b
SHA5123b3aadd02c25b5b68b976eece4a160950f1a4ecb45cce36e3545b25efa6d5e8a64c3ad398bb4602d8e80fa48fe4a57c4d3e3f8efa040c72d8175b9acbb4e4d60
-
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\chrome.manifest
Filesize106B
MD5e6fc5045bb7aaffe4c69b6131fb1cf34
SHA15fe1d0dc634ea39a8744be530ec7d72cd9bd0d20
SHA25635c27ada4fb4e210867ca8fd99d4088d3592a3e51bd4fdae708e08f304527a3e
SHA5128a412a7b6509b69f84b53b6882edc37fce720def54bb60cbbfccd3bcbd8a20fe00eaf7d2e4e02ac32e06e1fe6ed3d4fc554a77cc10dba2be5b844725c587c175
-
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\content\bg.js
Filesize9KB
MD5b756a3f0fa7135274f8dd7eafbd1365a
SHA11ee64829f159da5e0b7c20260ae8cc2921870826
SHA2560ce5a17e74f96a5df9a38ad37a8a1247b11c8979ee09f6c1d93254f02c0abb31
SHA5120a2411b430ff7b8e2880ef58325df865cb069b16754e4cbd4ed22aedf101e1eb3986dca5470d319df30ee535669f176fa33bfcdaaf39e5b7ccc86ebf63b02758
-
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\install.rdf
Filesize600B
MD550c2d2a701f0e1b5e1e97a5ceaa054bb
SHA12247ee1e1af9dddee1574a6af0b3f9bc2028f5de
SHA2569e2b7ae5eb5ba1466d1bfa5ab3ece371b3d005f70da4e7fc84942c874782e9f4
SHA5129b95d22047d0b61a5054efab1bcb9a5f816f3ddf834615c6545eff8cd0d54d77d0ecb9ba8ec59e2ac2967e99f804d9e524629f28b5883b68d1e60ee3a04ea53c
-
Filesize
5KB
MD5b01a499868ec838003d89beeda475524
SHA1fcb760445adac3d46cd3df380c9ea5a18e4f9799
SHA256b15400dfc96ce05056f4ebe45b008cd29a16bdf44905526d13dac0102138ad27
SHA512d0718409bc3e6f0a7e11fadd7ce3767be8dc4275898e5f9fbb79e14f792457577998694e9151ecb7d6660fa98d5e5a32773e219f8265635f5d85bdb55e0ee02a
-
Filesize
144B
MD5fa990da9f6f58d35adb6202d8cde92be
SHA109df4badb9876df8882000b15b801afbd9d26e4d
SHA2564efc59adae6a9dfb672788ac98d465a2256181610846e6c0eb374277b3b269bd
SHA512c7d45ee21b4e032a32d5badff8bcf3ff0181e1791272b31dadf6932449fb35214f8e07c99a7e9ba66f7b139141bdc543c3c0a83ee9420d4ad67a57ff475770e9
-
Filesize
197B
MD55f9891607f65f433b0690bae7088b2c1
SHA1b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA51276018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
-
Filesize
559B
MD5209b7ae0b6d8c3f9687c979d03b08089
SHA16449f8bff917115eef4e7488fae61942a869200f
SHA256e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA5121b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
-
Filesize
504B
MD5a661344ba03dc31dbe48ec17e75846d5
SHA1078dd3172685f0f0dcd2e01901267d2dabb5f657
SHA256c47666baa1315c322a85e01f4c18ca1bc89f723a0224fd1b499fa715eb92c196
SHA5129022c5d63db00505cdc5faa2a1c63e5f0d2cbf49086b90e78475c75e437d9ec5fb66e8d1c4f541eaeb13d76f349de54648c51f61e0697aec5767d18357acd664
-
Filesize
1KB
MD5b0058cef80b67e4ec180c85fa456ba25
SHA1c0fefedccfbc36e3f1730ad614bb90fd721a2f17
SHA256707510a3f9795f7386205fdfb7c07335879c835c21e9cd81a315779fb23763a9
SHA512cac111a5898b2230a23669e2afd57c736152392f59f2c200f370165587cfc7daacbf50ac54400a4d01376da7cc22db5ac0c284de61921110f66ac2bf56e2b0fc
-
Filesize
203KB
MD541b13b132cb601ecc466654b90296353
SHA1245258ddccb48826f22d57444f49fa30be1b36fd
SHA2567fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf
SHA5120e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6
-
Filesize
7KB
MD530cebf4f79c82503fb6d3fd63c02ce58
SHA1723361e564a83bf0c0ebd70e42e15b4c3168d2ab
SHA256b43878aa7f4377df7882058f153bbf548e6e4daa8213674c22e11a2a91f282c4
SHA51286df63cfc2ffa2af343ce1a6d8d9e934a8aedfeec4058fd2a4dccf97b87e716b7408772128e38eee457ef51e684518c8235a8654b38111e77db725c29c608306