Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/12/2024, 22:20
Behavioral task
behavioral1
Sample
e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe
-
Size
388KB
-
MD5
e37907163a8a6675b4e66ff75978f128
-
SHA1
575d44ad76239795c093103b7e34e23d5c33b475
-
SHA256
6cde68262c4e1b9813c1decf82c06efa1c74eed42fb38fcba3dc0cabdbf29ca1
-
SHA512
792f95ba82dc31aeca75d57d15148c933b05e6d4ebc63af18f4c56603b4061917ef719f2de75d96446487dc40df902f4cdff56627bbdf2d944e6912cf06fb24c
-
SSDEEP
12288:HHLUMuiv9RgfSjAzRtyTx+qup8RW77sK2W:btARyuHc2
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DFNER.exe -
ModiLoader Second Stage 20 IoCs
resource yara_rule behavioral1/memory/1504-49-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-50-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-55-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-59-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-60-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-63-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-64-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-65-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-68-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-71-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-74-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-78-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-81-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-84-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-87-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-90-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-93-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-96-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-99-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 behavioral1/memory/1504-102-0x0000000000400000-0x0000000000451000-memory.dmp modiloader_stage2 -
Executes dropped EXE 2 IoCs
pid Process 2192 DFNER.exe 1504 DFNER.exe -
Loads dropped DLL 8 IoCs
pid Process 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 2192 DFNER.exe 1504 DFNER.exe 1504 DFNER.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DFNER.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DFNER.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2524-29-0x0000000000400000-0x00000000004AC000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2192 set thread context of 1504 2192 DFNER.exe 30 -
resource yara_rule behavioral1/memory/2524-0-0x0000000000400000-0x00000000004AC000-memory.dmp upx behavioral1/memory/2524-29-0x0000000000400000-0x00000000004AC000-memory.dmp upx behavioral1/memory/1504-45-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-46-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-48-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-49-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-50-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-55-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-59-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-60-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-63-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-64-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-65-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-68-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-71-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-74-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-78-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-81-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-84-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-87-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-90-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-93-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-96-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-99-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1504-102-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFNER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFNER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 44 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0\win32 DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DFNER.exe" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0 DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\ = "KTBrvKLEhmZrN" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\FLAGS\ = "0" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\Version = "1.0" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\LocalServer32 DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\VERSION DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\VERSION\ = "1.0" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C} DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "_jRPkUyJabSTyj" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\Clsid\ = "{B4C7CEAC-2530-4E75-A626-3BDF747C8253}" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "jRPkUyJabSTyj" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32 DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ProgID\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\Version = "1.0" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0 DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32 DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\Clsid DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Implemented Categories DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674} DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\FLAGS DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\TypeLib DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Programmable DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\HELPDIR DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "_jRPkUyJabSTyj" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253} DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ProgID DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DFNER.exe" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj" DFNER.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" DFNER.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C} DFNER.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1504 DFNER.exe Token: SeBackupPrivilege 2632 vssvc.exe Token: SeRestorePrivilege 2632 vssvc.exe Token: SeAuditPrivilege 2632 vssvc.exe Token: SeDebugPrivilege 1504 DFNER.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2192 DFNER.exe 1504 DFNER.exe 1504 DFNER.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2192 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2192 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2192 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2192 2524 e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe 29 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 1504 2192 DFNER.exe 30 PID 2192 wrote to memory of 2676 2192 DFNER.exe 31 PID 2192 wrote to memory of 2676 2192 DFNER.exe 31 PID 2192 wrote to memory of 2676 2192 DFNER.exe 31 PID 2192 wrote to memory of 2676 2192 DFNER.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DFNER.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e37907163a8a6675b4e66ff75978f128_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\DFNER.exe"C:\Users\Admin\AppData\Local\Temp\DFNER.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\DFNER.exe"C:\Users\Admin\AppData\Local\Temp\DFNER.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1504
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\rserars.bat3⤵
- System Location Discovery: System Language Discovery
PID:2676
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5a1d47ae36cc432d68ddcd831ab36af12
SHA1ba2002b6f21f07145fbd7b3e74d47581153834a6
SHA256ac5bb947a68d0cbb7bab0f44855aae9f92dc85c054c7a80007e8dbdd6f34ded1
SHA51224416a688a0e528b88bb6a16abb2032875657f23ce1ed889cdaedd0f4e6144c25a08118ea1a38406537cd3a295a7d12c927147b3121eb5d9d38a3980a436e499
-
Filesize
145B
MD5457cced7a6b57d29373c684df02b7ce9
SHA1c56976b326f42de4841369edbc6fb56cf9151723
SHA25693200aff412fe035ce15e0437bc7f075860fd075a062c7b62bccc431e9d9e015
SHA512a08dad4af9565898f6813878d93f012203eb5ece4f879bdd563fa84717f300f30fe59b6b5637a24997e3b79ebcb710018d54948cee17d0babb89cd56b722eb99
-
Filesize
32KB
MD567a75cf7cebc7b3d2071e7884f8ebba9
SHA1ac9de2f53c840dd8a8607eb135b8226272dc7781
SHA256f321ed896779285be329a541bd4ab435fa9af86337b51f5c2b4479a92e6e9ac2
SHA512547b19a7afe8ce5bb36da766488363c8aa1c570b6f33aab1d801b7ad2cc85b1555a11fa2adbf852b753f39af5f21c08c30866b75c309541c15805563b1ed8e5a
-
Filesize
33KB
MD5c38f6407240088816fc808b1a7655a03
SHA140a1ed939402ce621a3e587e7d6a591753d0ea9d
SHA256b219c7d427496b83f651c64a38cfc1404a0a7dbd39cfb01a36fe2b38aa287985
SHA512566537dd3ac90225f1cbe238a0e41aaec23229ebc6e1ab3acc3c8dba30f1af2fb8ea9bf3a96ed6bdeaf12a02d6f73a1eb2c29c88cda9e4630149d2e0af7230d0
-
Filesize
7KB
MD567587e25a971a141628d7f07bd40ffa0
SHA176fcd014539a3bb247cc0b761225f68bd6055f6b
SHA256e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378
SHA5126e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350