Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
f7eaa8c37567f0e7a63cbcaa42b23a0d_JaffaCakes118.dll
Resource
win7-20241010-en
General
-
Target
f7eaa8c37567f0e7a63cbcaa42b23a0d_JaffaCakes118.dll
-
Size
156KB
-
MD5
f7eaa8c37567f0e7a63cbcaa42b23a0d
-
SHA1
b0b19a6c696880248b2b2d454772006e417a7599
-
SHA256
87b2b54ae6edd42d7bd84cc73dc1ab569729f055950c2f68f3ba09a842eaebb3
-
SHA512
548d248bab216d5fbf1d2fb210285dac8bbae207ab0f5c1925743cb356fb6ea627420014f1e2440316601f9381ec510a4c4ca34abbf4dc255682edfc0ba2dc61
-
SSDEEP
3072:avXmimD0k0QRW1PhI1sItKOgGdX3DUPG4VEr72fSH+IgPSf0+317I:a+fD/0QSzItKOgGFYW7vKBD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 2816 rundll32mgr.exe 2928 WaterMark.exe -
Loads dropped DLL 4 IoCs
pid Process 1604 rundll32.exe 1604 rundll32.exe 2816 rundll32mgr.exe 2816 rundll32mgr.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral1/memory/2816-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-22-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-24-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-66-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-60-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-59-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2928-584-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\fxplugins.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\pdmproxy100.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoViewer.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\npt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe svchost.exe File opened for modification C:\Program Files\Windows Journal\NBMapTIP.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcf.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\decora-sse.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2928 WaterMark.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe 2104 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2928 WaterMark.exe Token: SeDebugPrivilege 2104 svchost.exe Token: SeDebugPrivilege 2928 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1996 wrote to memory of 1604 1996 rundll32.exe 30 PID 1604 wrote to memory of 2816 1604 rundll32.exe 31 PID 1604 wrote to memory of 2816 1604 rundll32.exe 31 PID 1604 wrote to memory of 2816 1604 rundll32.exe 31 PID 1604 wrote to memory of 2816 1604 rundll32.exe 31 PID 2816 wrote to memory of 2928 2816 rundll32mgr.exe 32 PID 2816 wrote to memory of 2928 2816 rundll32mgr.exe 32 PID 2816 wrote to memory of 2928 2816 rundll32mgr.exe 32 PID 2816 wrote to memory of 2928 2816 rundll32mgr.exe 32 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2920 2928 WaterMark.exe 33 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2928 wrote to memory of 2104 2928 WaterMark.exe 34 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 256 2104 svchost.exe 1 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 336 2104 svchost.exe 2 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 384 2104 svchost.exe 3 PID 2104 wrote to memory of 392 2104 svchost.exe 4 PID 2104 wrote to memory of 392 2104 svchost.exe 4 PID 2104 wrote to memory of 392 2104 svchost.exe 4 PID 2104 wrote to memory of 392 2104 svchost.exe 4 PID 2104 wrote to memory of 392 2104 svchost.exe 4 PID 2104 wrote to memory of 424 2104 svchost.exe 5 PID 2104 wrote to memory of 424 2104 svchost.exe 5 PID 2104 wrote to memory of 424 2104 svchost.exe 5 PID 2104 wrote to memory of 424 2104 svchost.exe 5 PID 2104 wrote to memory of 424 2104 svchost.exe 5 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6 PID 2104 wrote to memory of 476 2104 svchost.exe 6
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1528
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1648
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:812
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2800
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:1020
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1076
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1088
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1316
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2308
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1924
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7eaa8c37567f0e7a63cbcaa42b23a0d_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7eaa8c37567f0e7a63cbcaa42b23a0d_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2920
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize144KB
MD543a6419e58250c5d5476ec3a2cd80c75
SHA1882d29b4d93d09e485011ca5933c90625148b9b7
SHA256eb32acda5574fc697bd7e966036317202178be7b10575eee3178f2d6fee6cfdf
SHA512f5380c3203177f3ca79df94f7ed930ae66dd85f8e193abb068127cb39aa3cc7793f3f61e4eb1e1d6bc74ff61ef952c4011fe3cee6ee9c33f70e2d4091de7b231
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize140KB
MD575c66dbde855e3ef98384b93cd6e46e2
SHA1dc57174ac4211b9346dc657f72199949cefdad15
SHA2565487696b9bfa83917972bb50f76f444d8a41022726659809b10f9dbe23b8197b
SHA512a3a98e708c40b12cca0f7e7853606e29ecb94d9d79bd5347973f650dd130be83457c2f623165eecaedf8c8ea0f3be99417ba4acdc0c89b3d4c7208b9008fb815
-
Filesize
65KB
MD5849ef19ec0155d79d4fa5bfb5657b106
SHA1eb7e7ff208ecb40d35755d8f36e31e2482166299
SHA2568b853e963eab5aa857b640be1d07d605a8bf6dd8bdf8884505b05034bbd87e04
SHA51230384d9943f7eca4efbdcac52d3dd9c14446a2d75dc04ce4047feabe037c5177138f6bdcb055939dcc47608dfb50a54c9676f795d850c9a9de353f90252053a2