Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 09:06
Static task
static1
Behavioral task
behavioral1
Sample
f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html
-
Size
155KB
-
MD5
f347da2ebb506a79097f29b8440271d9
-
SHA1
dcff826661c46030239baad9c30062089b27aa51
-
SHA256
5db7662952e8261079292f44129573ed2e74ce687bf3a5db51a1d4d80fb11e6f
-
SHA512
4ec8986667cd00824827b39bad2a05cddac238e2733a56b0b3747da32937001e6e4c7a47337b892f40efe706d616a187cda3c81735d8816513744e92fb7fcba5
-
SSDEEP
1536:i4RTE812x2VDoyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iyBVDoyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 1680 svchost.exe 2472 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 2776 IEXPLORE.EXE 1680 svchost.exe -
resource yara_rule behavioral1/files/0x00350000000186e7-433.dat upx behavioral1/memory/1680-436-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2472-443-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2472-446-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2472-448-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px518A.tmp svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7282481-BAC3-11EF-BD4E-7E1302FB0A39} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440415444" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2472 DesktopLayer.exe 2472 DesktopLayer.exe 2472 DesktopLayer.exe 2472 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1420 iexplore.exe 1420 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1420 iexplore.exe 1420 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 1420 iexplore.exe 1420 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2776 1420 iexplore.exe 30 PID 1420 wrote to memory of 2776 1420 iexplore.exe 30 PID 1420 wrote to memory of 2776 1420 iexplore.exe 30 PID 1420 wrote to memory of 2776 1420 iexplore.exe 30 PID 2776 wrote to memory of 1680 2776 IEXPLORE.EXE 35 PID 2776 wrote to memory of 1680 2776 IEXPLORE.EXE 35 PID 2776 wrote to memory of 1680 2776 IEXPLORE.EXE 35 PID 2776 wrote to memory of 1680 2776 IEXPLORE.EXE 35 PID 1680 wrote to memory of 2472 1680 svchost.exe 36 PID 1680 wrote to memory of 2472 1680 svchost.exe 36 PID 1680 wrote to memory of 2472 1680 svchost.exe 36 PID 1680 wrote to memory of 2472 1680 svchost.exe 36 PID 2472 wrote to memory of 1040 2472 DesktopLayer.exe 37 PID 2472 wrote to memory of 1040 2472 DesktopLayer.exe 37 PID 2472 wrote to memory of 1040 2472 DesktopLayer.exe 37 PID 2472 wrote to memory of 1040 2472 DesktopLayer.exe 37 PID 1420 wrote to memory of 2080 1420 iexplore.exe 38 PID 1420 wrote to memory of 2080 1420 iexplore.exe 38 PID 1420 wrote to memory of 2080 1420 iexplore.exe 38 PID 1420 wrote to memory of 2080 1420 iexplore.exe 38
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f347da2ebb506a79097f29b8440271d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1040
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:472081 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4d341668946813ec005938d6a328915
SHA18570c46b72f71105bb8420d0ed41ea95cf90471f
SHA256d1f6d15fcb7bf75c1109c686b10906547ec530d6d82dfc3634645944f183f194
SHA5126f8823908c90563aab23cbc8d4c56904ee37b499aeaf471fb28c3cb206cacfc7e08bc738cf156cba29b3fcb584058cfec41e0746740e4cb78b3132446cdea026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500a9815872c58a6df31ba475f42448fe
SHA167b0020a7641ea754412e43eb1307a3bf1fe2856
SHA25652c406843be07c780cf492d687940ba4aa4ffc47bbbcd8c4c56b7d2afe99fceb
SHA51207a65567b6b6214896ed735c8b2eb2a2d43397aa698c71bfeddff48554bd9048080c6687a049d6cbe5f90e24c3742abc497b7040717d7e5f299048c8754ad663
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5033302568c4e6c4ce05b5e3f0b935488
SHA168daceb873b6dd7004cfeba304f49c6ee7af491e
SHA256ffa3bad82020d8f91273a88d167bd75a04a6b4752d55f43adb513c935aadfe83
SHA512f40b717482831cac0efe202287a1e78213566e3dcc27b0a3deb394020c024a7ad8b1a04f6e5c5fce8f5846b9d458064c6f93295e236b3a5781aaeb059a808fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556c10fd864c7c9f7c23f1ca8a90f7c86
SHA1d527d7cd5121567e11b0dd91558d3071e377cc21
SHA2568349407cde3ebe0536880377dfdfeadb75c6f176ee44ad7ac511e607c9c90931
SHA51278321aec9eda63d45b017ba246aed5ee968f9cea5d670817149a580ef1cf3e53dde9f018601e85c0fc876f3aee3f9dc59da103a9bee612344a1077ee2234fd4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5871e474b1f3bb3dd690e92b07b5633f1
SHA1fde98555e3e26cd27b85dfe7baf3a3d876e57009
SHA256e03e50a9d680434f8962331d1f35fcc193e7241af8c852335198fcca8b7bf090
SHA512ba60e78f68f320bdcdaa9e7fdd637ead82def1c0945b37d8d2e376eaa46654bb7f9d21f45ee68f6f0cae5fe16a4e165b12d21974f2f455f9bd10fe0e9eef1107
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542c6daf550bc8f755f116d37e2745b81
SHA1e66dd3693901706e6abbafdfd82ca2d8d09a4dbb
SHA256ede649b536fc294c1fd080c1339ccac34224fac96fe91f5adf200577fad4b8b1
SHA512405369385367d1028076370ee9dcfe952fe5813444bb1bad2685e36c3268ca2f94a9d0047d4c56846858f75ae403530ab1f215a0853598d81cae3a9cf394a5e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5218bb20bcd82e736d92daaf60376cc10
SHA147a85fc0681fe8a7cf9fac9c555d698244412cf7
SHA2565beb50399fbafcad38552770bd721bf7fac17e005ae22dc8c5c1bedec0101d86
SHA512a916e3e9a1592da85237012c5af65b69dc2b9c6fd7f6a84b8ea2889d9c465d35e868d8266874e8690e7d0805119b231a31cc47eafa08e10299335df85f044b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983dbc29d62638758a1b56e0a7f841b6
SHA146459a68c80e27b3b391a2eec4374d1689f24943
SHA2566b71c9771cc441d25328269b8169b390aca0e5d98ea0c1109d86668157f338d3
SHA512d1e66bf5b71afd082f52c7e690f81d48803f622ef12ec520998b49ea5adef3125e98ad181f81958246b2443c124ddf7619d51617014ba3bd44d7f97fe8934e1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5155ea35b30811a7ee41b2209a96afd
SHA1fb427ef6a89e5011b566c4f8f82332d0afe25450
SHA256ee1862c88c48d758ae47b9852337760cc7729190f79c505f20ef83a727a73f1d
SHA5121c51707a22e38fe6283e5b28c427a67523d1b8a43717e83649c6f6eb0d7b944ffa8a48aae2514af04a9a3494e8bc5ff6328b2dd9abb4c548095b9368cc20bdfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e926a7155b374012516ee174d5e6197
SHA15877c0b0b6ec6566e7857457c1cc043a8b516ef1
SHA2567c92f3bb80a74db7fa5d3304d98ed5528407f1fe99ca61f232efb9d2406bc9ea
SHA5126372b7b6603b41ab5143cbd2b150723131c32aeaab960bd059d0e8c9c16814dcdc6344401bed04456b9a52d9e3a6bdf50b1e28f3dac27eca111e3f1f672de6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5994569dda1cd6d43ce8adfe9c106ba79
SHA168c12cf191cad7c83884a7504b55a89d21e5c7f7
SHA256cce7ecc3c1b55534ab0fde586f42b6fdfb4afbc6d6147052d7d950212bcfb3c3
SHA51281debb507a94493b680c13d023deed750b99bfe9b35539cf61f8432fe46e02cc0e96c0dd825a918146fa5b04ac957c04b68cd317d2011d17f1153545dbd39e0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cabb7d1577e810504340225b6e417332
SHA1d35966f8f4b3527909a0750ba08f0895ea3b90c5
SHA256281237181ae971e3f7cbc0b21515d3b212d13e0d6ff01f58b306df1d2a47a908
SHA5129a12c999abebfb2ed40d9aa9d20456b446642f7db47e2475bf69084e26c246c0c21b4167ce1de19853703880daefd8619b9a2b1a055e3525d1058d82eb623782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0db9714140ae976876d197b6f478187
SHA1387b8abb6a6c9cc4f10b4c7af87143bbf9bd1fcb
SHA2566482fdc76fe7e206bba88c0e64dbf3a83c4abd9a5fc8ff8e3736e8207ce78eff
SHA51209900cb488fdb5b2772a76eb0a06c06000781579b048d23d5176c1919ea3b4d2fa072ad5383780bf9f5819083a18728052fd2ea1e6807c7d24abb3724576304e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5810b90372de288550504e2e4c5c9f1c8
SHA1a6241cce680cde278b4426e34a41dcf9f9b59941
SHA25650dddc6fcf331b3804a48c3fbc02da45deb4445150f783925acc221db6d30b2d
SHA5127e41f92862a0eaaf9abf38785f4ddb0470eba47ad646d8628bff3e331c8687e96770d06f0648e784401ab8cf010060a477c31915d2d511051b12c734242555a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573826392dc30fae675513c9d6f33669c
SHA1062c47b0a6857f0eae3758394ee268bfc320dc5f
SHA256f030e663bcdc87390a3c49197f47662740b301b0232b1e5630f9c393721033ad
SHA5120e1c741d8ccee2bbb331e56d3d48e1a62e748fd23c73663970971558cc258d50e29d03b53db29ee842a46f6a5b43543e7a3504f08f6ca9b3a99e14bc1ddb4189
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4ebe81d16bcb24f2bef2a2ef460e672
SHA178837438a37eda074f9136120efa92456674a924
SHA25651d900954ebe032d40074daaadbac4c7b7706fa2faa7236a0c2a2da972a91c5d
SHA51228a40029109cf4a769e16a86b84c9bc98db1c90985153162b70c2d1aed6fc9b93704e47aa8963840e093fc0d48c33e892302299de527e072bea650ef28dfe62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5271abba47776ede804d7f47fc81bafaf
SHA1ab0cb4ece447bd26a5d1e76893ee8e64ef0e34ef
SHA2562d5b37b7748588b9eeb4fdc65c791e4c978cac3b2540c8cb44251ce0bd42c8d9
SHA5125ce4eca91d5b16e65879e3bce1eb379148f57fc33fe2bd31bb4e0e58c14a7ec790108380bec9707f37aad56dd5132f338dd1b34b2396d3228c8353cfe43046e6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a