Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe
-
Size
95KB
-
MD5
19c8b353cf7afa719c6ce799c0796923
-
SHA1
d485bf1c0a5b86e8aa1c6375e2e6d5ad3d8439a9
-
SHA256
2d15161f3fa63e0d2267e59adcc6b9f4c9a6a0e154174d5231f272c4d40eb278
-
SHA512
c17916bf3e134598d748e4994b663576f28380aad03eb4e0a645b79be80c2558148d06b7f32502151d612d4ee8cee7ca2404a1b7d75e7e0ef47121d387921b7f
-
SSDEEP
768:j06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:hR0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2576 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2576-23-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2576-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2156-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2576-70-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2576-602-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\promointl.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSetupPS.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2iexp.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jpeg.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe File opened for modification C:\Program Files\Common Files\System\ado\msador15.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcf.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msxactps.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\t2k.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html svchost.exe File opened for modification C:\Program Files\Windows Mail\wabfind.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSO.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\DirectDB.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\management.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\lgpllibs.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2576 WaterMark.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe 2656 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2576 WaterMark.exe Token: SeDebugPrivilege 2656 svchost.exe Token: SeDebugPrivilege 2576 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 2576 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2576 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 30 PID 2156 wrote to memory of 2576 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 30 PID 2156 wrote to memory of 2576 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 30 PID 2156 wrote to memory of 2576 2156 JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe 30 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2472 2576 WaterMark.exe 31 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2576 wrote to memory of 2656 2576 WaterMark.exe 32 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 256 2656 svchost.exe 1 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 332 2656 svchost.exe 2 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 384 2656 svchost.exe 3 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 392 2656 svchost.exe 4 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 432 2656 svchost.exe 5 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 476 2656 svchost.exe 6 PID 2656 wrote to memory of 492 2656 svchost.exe 7 PID 2656 wrote to memory of 492 2656 svchost.exe 7 PID 2656 wrote to memory of 492 2656 svchost.exe 7 PID 2656 wrote to memory of 492 2656 svchost.exe 7 PID 2656 wrote to memory of 492 2656 svchost.exe 7 PID 2656 wrote to memory of 500 2656 svchost.exe 8 PID 2656 wrote to memory of 500 2656 svchost.exe 8 PID 2656 wrote to memory of 500 2656 svchost.exe 8 PID 2656 wrote to memory of 500 2656 svchost.exe 8 PID 2656 wrote to memory of 500 2656 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:616
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:864
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1876
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:696
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:772
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:832
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1192
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:868
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1928
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1044
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1088
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2288
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2236
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19c8b353cf7afa719c6ce799c0796923.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2472
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD519c8b353cf7afa719c6ce799c0796923
SHA1d485bf1c0a5b86e8aa1c6375e2e6d5ad3d8439a9
SHA2562d15161f3fa63e0d2267e59adcc6b9f4c9a6a0e154174d5231f272c4d40eb278
SHA512c17916bf3e134598d748e4994b663576f28380aad03eb4e0a645b79be80c2558148d06b7f32502151d612d4ee8cee7ca2404a1b7d75e7e0ef47121d387921b7f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize204KB
MD5a323859ae21868b75e5746c5e172b004
SHA127d22138d86b5b2bfe4070780b19c5b83ec3526b
SHA256cc4d95ff958431e4bf1d9fe7716d46bcd8b5be8c0d40277f6b3ae2ab311f4c08
SHA5124066b5183147286b4466e6fbeba03c47278e9620167d99cd098775e5835443110875295ee02ef88b2a97c18883d90f62621194153e476b6d5d44cd63820a1392
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize200KB
MD55d6a4a1e341c82a2c1e0f8884834a015
SHA1d915c9ff71bdef140454f5dc61763cf040ce1303
SHA25625f0e051c68a8e8a8b75c08cbe31839833646f67e97f39082d9904f010617190
SHA5120f838a35494a10b37c05290676ee6a9d781003689cb8f830e7f9f31f81f855f0ea72b00f78e0cabab02b1b07e07358f0642d30a0d387747b97b81f0327251bf8