Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-01-2024 12:01
Static task
static1
Behavioral task
behavioral1
Sample
38a3b3b4a06fe3d8e43d0d4348dff9e7.dll
Resource
win7-20231215-en
General
-
Target
38a3b3b4a06fe3d8e43d0d4348dff9e7.dll
-
Size
166KB
-
MD5
38a3b3b4a06fe3d8e43d0d4348dff9e7
-
SHA1
ee0eb512b443c84f5dd69c8b2ed0066815bcc9c4
-
SHA256
279dc6f915f7513aa1cd00910f1a2c7541021d9bb9f2f5f67592a8ca1f002bc3
-
SHA512
d5a97ef4e54e4924bdef7a40a1f35ee59b9b8dd946317a168874398f775bca7a2a1aa70ff45049028ea16cac50a7daed1507e74ad5d15135d60be4a702720ae8
-
SSDEEP
1536:05lTUKCYmCgV5bT/2d1QYesG+sxFm2mEgW+YBOYYtV/rerTK:KTU56gVxj27NeUuFm1byOYUNq6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 1972 regsvr32mgr.exe 2856 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 1736 regsvr32.exe 1736 regsvr32.exe 1972 regsvr32mgr.exe 1972 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/1972-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2856-33-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2856-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1972-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2856-272-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2856-423-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\msado15.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\awt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsTap.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\oeimport.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\installer.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java_crw_demo.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dt_socket.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 2856 WaterMark.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe 1540 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2856 WaterMark.exe Token: SeDebugPrivilege 1540 svchost.exe Token: SeDebugPrivilege 2856 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1972 regsvr32mgr.exe 2856 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 2628 wrote to memory of 1736 2628 regsvr32.exe 28 PID 1736 wrote to memory of 1972 1736 regsvr32.exe 29 PID 1736 wrote to memory of 1972 1736 regsvr32.exe 29 PID 1736 wrote to memory of 1972 1736 regsvr32.exe 29 PID 1736 wrote to memory of 1972 1736 regsvr32.exe 29 PID 1972 wrote to memory of 2856 1972 regsvr32mgr.exe 31 PID 1972 wrote to memory of 2856 1972 regsvr32mgr.exe 31 PID 1972 wrote to memory of 2856 1972 regsvr32mgr.exe 31 PID 1972 wrote to memory of 2856 1972 regsvr32mgr.exe 31 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 2848 2856 WaterMark.exe 30 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 2856 wrote to memory of 1540 2856 WaterMark.exe 32 PID 1540 wrote to memory of 260 1540 svchost.exe 5 PID 1540 wrote to memory of 260 1540 svchost.exe 5 PID 1540 wrote to memory of 260 1540 svchost.exe 5 PID 1540 wrote to memory of 260 1540 svchost.exe 5 PID 1540 wrote to memory of 260 1540 svchost.exe 5 PID 1540 wrote to memory of 336 1540 svchost.exe 4 PID 1540 wrote to memory of 336 1540 svchost.exe 4 PID 1540 wrote to memory of 336 1540 svchost.exe 4 PID 1540 wrote to memory of 336 1540 svchost.exe 4 PID 1540 wrote to memory of 336 1540 svchost.exe 4 PID 1540 wrote to memory of 372 1540 svchost.exe 3 PID 1540 wrote to memory of 372 1540 svchost.exe 3 PID 1540 wrote to memory of 372 1540 svchost.exe 3 PID 1540 wrote to memory of 372 1540 svchost.exe 3 PID 1540 wrote to memory of 372 1540 svchost.exe 3 PID 1540 wrote to memory of 384 1540 svchost.exe 2 PID 1540 wrote to memory of 384 1540 svchost.exe 2 PID 1540 wrote to memory of 384 1540 svchost.exe 2 PID 1540 wrote to memory of 384 1540 svchost.exe 2 PID 1540 wrote to memory of 384 1540 svchost.exe 2 PID 1540 wrote to memory of 420 1540 svchost.exe 1 PID 1540 wrote to memory of 420 1540 svchost.exe 1 PID 1540 wrote to memory of 420 1540 svchost.exe 1 PID 1540 wrote to memory of 420 1540 svchost.exe 1 PID 1540 wrote to memory of 420 1540 svchost.exe 1 PID 1540 wrote to memory of 464 1540 svchost.exe 6 PID 1540 wrote to memory of 464 1540 svchost.exe 6 PID 1540 wrote to memory of 464 1540 svchost.exe 6 PID 1540 wrote to memory of 464 1540 svchost.exe 6
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:852
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:320
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1048
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1132
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1500
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2408
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:388
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2760
-
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2480
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\38a3b3b4a06fe3d8e43d0d4348dff9e7.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\38a3b3b4a06fe3d8e43d0d4348dff9e7.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
-
-
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize206KB
MD5a60857f8ec3026bbe082368fffd701de
SHA1a5a005b8116c0a6e4a764d03e06163637eb96202
SHA25623da9d8debbd01f01a14801c1eea170573374c146194dff48985ea5ec0b2ed19
SHA512a8ff1bc4b4a438efee75d457fd2dcd018c0251fd05fe285713b5f052a1dddea149a79b07372cb81ac9e80039712b446b3a026bef783718e4fceef79b575a2c40
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize202KB
MD53ee298e467e24dd93c20c2e31187b263
SHA1d1610bf7ee1b574f569f9525f6b9eeb5ccad7ef0
SHA256bfcfa8e04e02b8da92e05bbdfc5e5b3f5d2a053feeab5730cd743ce10eff1b0a
SHA5122d9c19e5350db1571c9f78d955fbbe35e11f2b9c2b99ec32b67205c0befb6ca5a8e2da0fb021a474370bb95f3fb9aee8f7507561cedb400b8113099f53a61e7e
-
Filesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
Filesize
45KB
MD54dbfb7d7801b52e4750cba8400b611ad
SHA101e1e56149cff08116b1c52a5185ffd1f6d81bf8
SHA256485fa62be8876f568df419b7ed40e0a855f4d29bbd9245fa5f3afd14c9c652fb
SHA512382aca2ee5b923f108e607ff45bcbf749292cdb1786d12751e80042eaf846038acbf88c8783fa91fb00b938ace0df640b642ce4bd78dc31463eb9610f310ac4c
-
Filesize
12KB
MD54b7508d0f75b440220f537739f9f04e8
SHA14446fea4bcbc2c61554735e0294c8fa66268e056
SHA256a3c1bb8968b4ff8fad2d6e367497cbb008aeeec8af52804fe7b950fbe53417eb
SHA512a8faa8a573e8b5b6b79f65cccbe2059fa19eec01cc0be6c410a0cbbc239100852d04e87e6d05ed33bc5c373907ca932a4ed09e6df5a780fe8528eef8fb7eb8da