Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe
-
Size
120KB
-
MD5
19dccf4b8f4c1fb743f3d5d09edcb90d
-
SHA1
6f4b43fa085ebe9508bfa292a671db57df264a18
-
SHA256
2c31cf175fcd8445a864d50e190152742926ab56f092b22a6b2765092bacd769
-
SHA512
a1714b73ac704b2725a0dd8136ece7a2b559bb4a8aa658a2d93d4578f8f76e77b270f2c55629fd3c5bd58ce331ecd0b08c04e565b298621c197adc0c18ae2839
-
SSDEEP
1536:zVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApEIruqN1aQCVwSaLsFm:rnxwgxgfR/DVG7wBpEIrzN1RC9a
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2096 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2548-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2548-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-24-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2096-71-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2096-590-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\javafx-iio.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\sbdrop.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\mpvis.DLL svchost.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextService.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\net.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_XPS.DLL svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\msvcp140.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VISSHE.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2096 WaterMark.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe 2324 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2096 WaterMark.exe Token: SeDebugPrivilege 2324 svchost.exe Token: SeDebugPrivilege 2096 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 2096 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2096 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 30 PID 2548 wrote to memory of 2096 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 30 PID 2548 wrote to memory of 2096 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 30 PID 2548 wrote to memory of 2096 2548 JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe 30 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2488 2096 WaterMark.exe 31 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2096 wrote to memory of 2324 2096 WaterMark.exe 32 PID 2324 wrote to memory of 256 2324 svchost.exe 1 PID 2324 wrote to memory of 256 2324 svchost.exe 1 PID 2324 wrote to memory of 256 2324 svchost.exe 1 PID 2324 wrote to memory of 256 2324 svchost.exe 1 PID 2324 wrote to memory of 256 2324 svchost.exe 1 PID 2324 wrote to memory of 332 2324 svchost.exe 2 PID 2324 wrote to memory of 332 2324 svchost.exe 2 PID 2324 wrote to memory of 332 2324 svchost.exe 2 PID 2324 wrote to memory of 332 2324 svchost.exe 2 PID 2324 wrote to memory of 332 2324 svchost.exe 2 PID 2324 wrote to memory of 380 2324 svchost.exe 3 PID 2324 wrote to memory of 380 2324 svchost.exe 3 PID 2324 wrote to memory of 380 2324 svchost.exe 3 PID 2324 wrote to memory of 380 2324 svchost.exe 3 PID 2324 wrote to memory of 380 2324 svchost.exe 3 PID 2324 wrote to memory of 388 2324 svchost.exe 4 PID 2324 wrote to memory of 388 2324 svchost.exe 4 PID 2324 wrote to memory of 388 2324 svchost.exe 4 PID 2324 wrote to memory of 388 2324 svchost.exe 4 PID 2324 wrote to memory of 388 2324 svchost.exe 4 PID 2324 wrote to memory of 428 2324 svchost.exe 5 PID 2324 wrote to memory of 428 2324 svchost.exe 5 PID 2324 wrote to memory of 428 2324 svchost.exe 5 PID 2324 wrote to memory of 428 2324 svchost.exe 5 PID 2324 wrote to memory of 428 2324 svchost.exe 5 PID 2324 wrote to memory of 472 2324 svchost.exe 6 PID 2324 wrote to memory of 472 2324 svchost.exe 6 PID 2324 wrote to memory of 472 2324 svchost.exe 6 PID 2324 wrote to memory of 472 2324 svchost.exe 6 PID 2324 wrote to memory of 472 2324 svchost.exe 6 PID 2324 wrote to memory of 488 2324 svchost.exe 7 PID 2324 wrote to memory of 488 2324 svchost.exe 7 PID 2324 wrote to memory of 488 2324 svchost.exe 7 PID 2324 wrote to memory of 488 2324 svchost.exe 7 PID 2324 wrote to memory of 488 2324 svchost.exe 7 PID 2324 wrote to memory of 496 2324 svchost.exe 8 PID 2324 wrote to memory of 496 2324 svchost.exe 8 PID 2324 wrote to memory of 496 2324 svchost.exe 8 PID 2324 wrote to memory of 496 2324 svchost.exe 8 PID 2324 wrote to memory of 496 2324 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1312
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:636
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1156
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2984
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:284
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1072
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2560
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2460
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_19dccf4b8f4c1fb743f3d5d09edcb90d.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize253KB
MD5ebf15b20f0a5726e85455fa89d6a336f
SHA19e12d8676834fc019a2358389ca3f31b3f17d600
SHA25618f2cae12a250b690d883d8f11e89415038a036b343432bb253061a5038d564a
SHA512424ea724a0ad3ce19ce0a7b5a1f69d63b6b29c0d69511b2babcb462ff7cb5ab6711ebb017d087b438c3f6823c5a4e8ab3bc564106d7270a377bb54b87b81eebf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize249KB
MD58721543747e4d53899133664e596282a
SHA1a5b03842def567310be73fe0ae36c41184ebc131
SHA256019475781179d59ce868a93262ab45f9b94f8a2601b19f35de90cc76e7cb3b3e
SHA512a1faef418c6a8fe5b0ec0401848e1d2e2283e8711a601561852a1711f3be6e384148423115802c8efa87871ad5b56a12411f8c3b7ebade7941d11c74fda2fbbb
-
Filesize
120KB
MD519dccf4b8f4c1fb743f3d5d09edcb90d
SHA16f4b43fa085ebe9508bfa292a671db57df264a18
SHA2562c31cf175fcd8445a864d50e190152742926ab56f092b22a6b2765092bacd769
SHA512a1714b73ac704b2725a0dd8136ece7a2b559bb4a8aa658a2d93d4578f8f76e77b270f2c55629fd3c5bd58ce331ecd0b08c04e565b298621c197adc0c18ae2839