Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe
-
Size
92KB
-
MD5
15962bfa885184b6a7383ff02d3df2ab
-
SHA1
518131dbcc12b1672e91f0dd19da6f356f5aacc8
-
SHA256
da5e9696540af7b799eb517d6652700b1a22372b03bd0292cd3652176ac0aa05
-
SHA512
aa039b88d8752dc313536a52ecf6f100d68fdf880060df7368a039af453b95cf69c5c2c9bd3fcce574c62ded84db51aed8abd4cd0335025da55186da2680acff
-
SSDEEP
1536:GVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE:2nxwgxgfR/DVG7wBpE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/1120-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2740-27-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1120-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2740-69-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2740-596-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\DESIGNER\MSADDNDR.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\OmdProject.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\gstreamer-lite.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\MSOERES.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\System\wab32.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-font.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jdwp.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfreeze_plugin.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2740 WaterMark.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe 2752 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2740 WaterMark.exe Token: SeDebugPrivilege 2752 svchost.exe Token: SeDebugPrivilege 2740 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 2740 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2740 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 29 PID 1120 wrote to memory of 2740 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 29 PID 1120 wrote to memory of 2740 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 29 PID 1120 wrote to memory of 2740 1120 15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe 29 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2940 2740 WaterMark.exe 30 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2740 wrote to memory of 2752 2740 WaterMark.exe 31 PID 2752 wrote to memory of 256 2752 svchost.exe 1 PID 2752 wrote to memory of 256 2752 svchost.exe 1 PID 2752 wrote to memory of 256 2752 svchost.exe 1 PID 2752 wrote to memory of 256 2752 svchost.exe 1 PID 2752 wrote to memory of 256 2752 svchost.exe 1 PID 2752 wrote to memory of 332 2752 svchost.exe 2 PID 2752 wrote to memory of 332 2752 svchost.exe 2 PID 2752 wrote to memory of 332 2752 svchost.exe 2 PID 2752 wrote to memory of 332 2752 svchost.exe 2 PID 2752 wrote to memory of 332 2752 svchost.exe 2 PID 2752 wrote to memory of 372 2752 svchost.exe 3 PID 2752 wrote to memory of 372 2752 svchost.exe 3 PID 2752 wrote to memory of 372 2752 svchost.exe 3 PID 2752 wrote to memory of 372 2752 svchost.exe 3 PID 2752 wrote to memory of 372 2752 svchost.exe 3 PID 2752 wrote to memory of 380 2752 svchost.exe 4 PID 2752 wrote to memory of 380 2752 svchost.exe 4 PID 2752 wrote to memory of 380 2752 svchost.exe 4 PID 2752 wrote to memory of 380 2752 svchost.exe 4 PID 2752 wrote to memory of 380 2752 svchost.exe 4 PID 2752 wrote to memory of 420 2752 svchost.exe 5 PID 2752 wrote to memory of 420 2752 svchost.exe 5 PID 2752 wrote to memory of 420 2752 svchost.exe 5 PID 2752 wrote to memory of 420 2752 svchost.exe 5 PID 2752 wrote to memory of 420 2752 svchost.exe 5 PID 2752 wrote to memory of 464 2752 svchost.exe 6 PID 2752 wrote to memory of 464 2752 svchost.exe 6 PID 2752 wrote to memory of 464 2752 svchost.exe 6 PID 2752 wrote to memory of 464 2752 svchost.exe 6 PID 2752 wrote to memory of 464 2752 svchost.exe 6 PID 2752 wrote to memory of 480 2752 svchost.exe 7 PID 2752 wrote to memory of 480 2752 svchost.exe 7 PID 2752 wrote to memory of 480 2752 svchost.exe 7 PID 2752 wrote to memory of 480 2752 svchost.exe 7 PID 2752 wrote to memory of 480 2752 svchost.exe 7 PID 2752 wrote to memory of 488 2752 svchost.exe 8 PID 2752 wrote to memory of 488 2752 svchost.exe 8 PID 2752 wrote to memory of 488 2752 svchost.exe 8 PID 2752 wrote to memory of 488 2752 svchost.exe 8 PID 2752 wrote to memory of 488 2752 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1436
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1668
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:732
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:796
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1336
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:836
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:292
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:272
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1028
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1232
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:924
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1892
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1880
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15962bfa885184b6a7383ff02d3df2ab_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2940
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize198KB
MD59770b75937d656be12423495b900ddd7
SHA172a393ae065e73d1758449bde1627524e636b89c
SHA256d0bc1c07dffdfc67bec71fab764d5d0b03a2e938a90483cea1b5e26620ba3f3a
SHA5123da50e4051d91065efee263d47ed3c2d3dff26dfea5428e38415d6b22163d388e5a208ba00cba3a27feaef53138724ec9d397c436482f1ab1ce586b51e98b462
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize194KB
MD5996c7e67e7e2cf0e6fc17234c1293ab8
SHA1604275f04cf1dcd19bbb50569ac163e057c3c6c6
SHA256c18351a69c6d7ea47582aefd7195406ff08aad639a235e6408e8bc2c4342d1e7
SHA512379813f917cf07f70e32f6f48a71eba6c8a02fa5df6fece0497619576457b46a3bb3f921c814dd2a656fd3eed13e2f7b3bbc285886764a84ff6f4ea75586dc48
-
Filesize
92KB
MD515962bfa885184b6a7383ff02d3df2ab
SHA1518131dbcc12b1672e91f0dd19da6f356f5aacc8
SHA256da5e9696540af7b799eb517d6652700b1a22372b03bd0292cd3652176ac0aa05
SHA512aa039b88d8752dc313536a52ecf6f100d68fdf880060df7368a039af453b95cf69c5c2c9bd3fcce574c62ded84db51aed8abd4cd0335025da55186da2680acff