Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3JaffaCakes...c0.exe
windows7-x64
10JaffaCakes...c0.exe
windows10-2004-x64
10$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISGameExplorerPlugin.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISGameExplorerPlugin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WT_Plugin.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WT_Plugin.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe
-
Size
231KB
-
MD5
029fde9403ed6a8445e674646c4104c0
-
SHA1
2a6a3c327b11d30e00dbef3370275cf4fc60586f
-
SHA256
c351b4878a034ce7d31673ceeab281922585b1b26a9f520c2cf69f5f900d87a0
-
SHA512
48141c1c4b25e2a49a5e3ab0b6ee00cc038233c99c38634adde5169b67e3f44d88247eb6b54a2fa7a5af7144b3045de40626fa5a92724381435aad4262dec95e
-
SSDEEP
6144:Z+2YqOYG9j0CUEI2hd5twlULasDns6uYozF5OwVkS6E:kJEWj5Fhd5sUesDns6BAee
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" Au_.exe -
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
pid Process 2808 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 2808 Au_.exe -
Loads dropped DLL 6 IoCs
pid Process 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 2808 Au_.exe 2808 Au_.exe 2808 Au_.exe 2808 Au_.exe 2808 Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Au_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Au_.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Au_.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe -
resource yara_rule behavioral1/memory/840-6-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-3-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-4-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-9-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-7-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-5-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-11-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-10-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-8-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-24-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-36-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/840-25-0x0000000001EB0000-0x0000000002F3E000-memory.dmp upx behavioral1/memory/2808-92-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-97-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-113-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-95-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-94-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-98-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-96-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-93-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-91-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-115-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-116-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx behavioral1/memory/2808-137-0x0000000005D60000-0x0000000006DEE000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000700000001686c-54.dat nsis_installer_1 behavioral1/files/0x000800000001630a-52.dat nsis_installer_1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 2808 Au_.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe Token: SeDebugPrivilege 2808 Au_.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 840 wrote to memory of 1084 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 18 PID 840 wrote to memory of 1156 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 20 PID 840 wrote to memory of 1192 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 21 PID 840 wrote to memory of 844 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 23 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 840 wrote to memory of 2808 840 JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe 30 PID 2808 wrote to memory of 1084 2808 Au_.exe 18 PID 2808 wrote to memory of 1156 2808 Au_.exe 20 PID 2808 wrote to memory of 1192 2808 Au_.exe 21 PID 2808 wrote to memory of 844 2808 Au_.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Au_.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1084
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_029fde9403ed6a8445e674646c4104c0.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:840 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD507599bc344a4c7bbcedc75a69334b187
SHA17ab3af63e151332c1804b7879f02938fec7ffb9f
SHA2563865670396bbc0576ef72eb26833dd02d6843a72a405c56bdb5b9baad1d948a3
SHA5120e51aa376d5cea54659b395495329fd8de8a84ad5483cffb7680e57edd4f9ca6db4728d76839fae878e212495a95d150c90dd3abbee25017d8eb6de9141b3ade
-
Filesize
231KB
MD5029fde9403ed6a8445e674646c4104c0
SHA12a6a3c327b11d30e00dbef3370275cf4fc60586f
SHA256c351b4878a034ce7d31673ceeab281922585b1b26a9f520c2cf69f5f900d87a0
SHA51248141c1c4b25e2a49a5e3ab0b6ee00cc038233c99c38634adde5169b67e3f44d88247eb6b54a2fa7a5af7144b3045de40626fa5a92724381435aad4262dec95e
-
Filesize
257B
MD59195eeae67c3adc6095e7b145ea2482f
SHA1223f2696ddc29c9c28f8e2d6e565ee39304a46ac
SHA25684798b9cd600d305f6fc658d41972e394d3e3559388a8852499d046335058af2
SHA512a66a123b9e9961008ca5cafd83202b9aa3630a7072cfe0f4492316c8db862a8300f27c7649db6fd6d1c968b428cc0d941ff2988cecb7b536e5e82bcfc7d3a998
-
Filesize
100KB
MD50c2020b9cebdefe01d1ab1bf079ead52
SHA117bdbefce3f24c7b8817bb0499ef407f4bf0df2d
SHA25632fa6bae573848b5123734672039e808c9ce93e781f01e619b959c6c4e8fde72
SHA512fea74de5eca2d90fe6b35d3ad40ad2b7527448a5cd9f75eb2d549d4aa5e8cbb410a3d9a3b1f3a861689c5f45b949c87090f0349ad57f5918dd1b27e7b26b61fc
-
Filesize
9KB
MD50e4c4e4eb158e3f250ca9161156e74a5
SHA178d055856312c2b9f313877f7f72ca936554095a
SHA25660e6e287828dd882447a79018b505bb3be67b0f04fc8e022a57442e249588ed1
SHA512eba47ef4d16532df26f50e42bb5650733844ffc94b6f0e9037c2a2854326e9bcf1d6c967f541a655a91452c9357eb4ba1aedf85a2757a560ad4527a8f6b63ebc
-
Filesize
3KB
MD51923c3ce705616293c721d5dfc46b7a3
SHA1beec6bba81cc80e100243e6b26554e0c585f7734
SHA256921d31307a7e93270caa35093893b1799b055ffde2db3298fb9aa495ede7f9a2
SHA512b8d584db8fac7a8395e3e5e1fdf12c4d3e5d1bdd78ac00e7467b5c4d279c670834211076ada391b6f11fb833fc8b54f2b3b24d9ecd85727000b1c0138aac8b77
-
Filesize
164KB
MD59f392fdef8b0681254ad916cf0cf6961
SHA1ef903a0652696e5c0aad1b271916a1c212bdcee1
SHA2560e6a43834e7124c784f958756330dbdcba32bc397bc96fd8ce1672c8c173be27
SHA5125835042e78caea5ac25b2ce7c0490643c37890dd83424bf521ed67a97e2faaf95e2f8d9e7626b71f78c1d40e93dd61d3a175d149cf932042101d39fc09c2a77c