Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 05:27
Static task
static1
Behavioral task
behavioral1
Sample
c00af810f6860263f5695b3a6a74139c_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
c00af810f6860263f5695b3a6a74139c_JaffaCakes118.dll
-
Size
166KB
-
MD5
c00af810f6860263f5695b3a6a74139c
-
SHA1
a0bd2f245f086d85a32076eaa59607d82acc1baa
-
SHA256
731052f893b3e2b9ab0cb09a73ad84ee939f72506c6a54eeb960724eb6271388
-
SHA512
9e6290c6cd6e1343a9b71004edf8bb074813062591e14391521d4cd5475a769d3549b0ff957e97a18a1d1c73d01b3f00c1bf43392abf925e7334c22435d07a14
-
SSDEEP
3072:sTU56gVxj27Ne4L99ZgyXf9MWebpjMGlDCdrp:/4L7vBsGdp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 1944 regsvr32mgr.exe 2488 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 2564 regsvr32.exe 2564 regsvr32.exe 1944 regsvr32mgr.exe 1944 regsvr32mgr.exe -
resource yara_rule behavioral1/memory/1944-19-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1944-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2488-38-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2488-36-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2488-41-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2488-361-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2488-617-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\installer.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdBase.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcfr.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEDAO.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jpeg.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\More Games\MoreGames.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmicrodns_plugin.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2488 WaterMark.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2488 WaterMark.exe Token: SeDebugPrivilege 2656 svchost.exe Token: SeDebugPrivilege 2488 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1944 regsvr32mgr.exe 2488 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2112 wrote to memory of 2564 2112 regsvr32.exe 30 PID 2564 wrote to memory of 1944 2564 regsvr32.exe 31 PID 2564 wrote to memory of 1944 2564 regsvr32.exe 31 PID 2564 wrote to memory of 1944 2564 regsvr32.exe 31 PID 2564 wrote to memory of 1944 2564 regsvr32.exe 31 PID 1944 wrote to memory of 2488 1944 regsvr32mgr.exe 32 PID 1944 wrote to memory of 2488 1944 regsvr32mgr.exe 32 PID 1944 wrote to memory of 2488 1944 regsvr32mgr.exe 32 PID 1944 wrote to memory of 2488 1944 regsvr32mgr.exe 32 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2880 2488 WaterMark.exe 33 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2488 wrote to memory of 2656 2488 WaterMark.exe 34 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1556
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1664
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1344
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1792
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:324
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1032
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1316
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1940
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2440
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1424
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c00af810f6860263f5695b3a6a74139c_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c00af810f6860263f5695b3a6a74139c_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize206KB
MD56d1e992e31d9e5cc819651ba9c966311
SHA1be19cce5257ead84b006745b195bb9deb56fe85d
SHA2561cd51f4769826991b3e3ae79b698a0c58f330cb8bc044c783c8c2d66281b30f1
SHA512cac8e506589e43b03f5d4f090d10e3c8915bdd0b5274e0186e70fcfa694fd35c4e26a6abb9786f2e52d17deeb013102cf2374d6b2667161d1164c2e27cd602c2
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize202KB
MD57cfea7d87c8e659cd230de7fe76157b9
SHA1eb46642c1199d0993bcb80c7d9caf017d55b7b71
SHA2565b180a4ee015bc154ea81c29d8599b8087d829c9d8576d1431a99578bcbcf4d9
SHA5125320eaa51839f864fbf05d6866d36012e55ed6ce6f580b6f59cca59af083e943c89eb0abe82b9eeae2b8d30b6f2cb75c6be3c01ecd07835ae0cb1b31982a0d05
-
Filesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837