Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_111fe9849014288920528887e75aa974.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_111fe9849014288920528887e75aa974.exe
-
Size
95KB
-
MD5
111fe9849014288920528887e75aa974
-
SHA1
4e4131e067a39b73664d7e03e735fa53974e4794
-
SHA256
145fd16c6ab8bd756ff9590893339d3d8929a82791e27272043f8b24800f0e94
-
SHA512
f66278c5aeeb6c33bc2881fa8d4b8561cfff6269a177072a6def3f146242c66fc417a6689dc546b58b6d49b91a36cce66cc88fcf49e820573f42311b4548805f
-
SSDEEP
768:UG06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYwK:lR0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2720 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2676-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2676-19-0x0000000000220000-0x0000000000275000-memory.dmp upx behavioral1/memory/2720-30-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2720-76-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2720-585-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msxactps.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\mozavcodec.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_111fe9849014288920528887e75aa974.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 2720 WaterMark.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe 1532 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2720 WaterMark.exe Token: SeDebugPrivilege 1532 svchost.exe Token: SeDebugPrivilege 2720 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 2720 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 2720 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 30 PID 2676 wrote to memory of 2720 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 30 PID 2676 wrote to memory of 2720 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 30 PID 2676 wrote to memory of 2720 2676 JaffaCakes118_111fe9849014288920528887e75aa974.exe 30 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 3032 2720 WaterMark.exe 31 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 2720 wrote to memory of 1532 2720 WaterMark.exe 32 PID 1532 wrote to memory of 256 1532 svchost.exe 1 PID 1532 wrote to memory of 256 1532 svchost.exe 1 PID 1532 wrote to memory of 256 1532 svchost.exe 1 PID 1532 wrote to memory of 256 1532 svchost.exe 1 PID 1532 wrote to memory of 256 1532 svchost.exe 1 PID 1532 wrote to memory of 336 1532 svchost.exe 2 PID 1532 wrote to memory of 336 1532 svchost.exe 2 PID 1532 wrote to memory of 336 1532 svchost.exe 2 PID 1532 wrote to memory of 336 1532 svchost.exe 2 PID 1532 wrote to memory of 336 1532 svchost.exe 2 PID 1532 wrote to memory of 384 1532 svchost.exe 3 PID 1532 wrote to memory of 384 1532 svchost.exe 3 PID 1532 wrote to memory of 384 1532 svchost.exe 3 PID 1532 wrote to memory of 384 1532 svchost.exe 3 PID 1532 wrote to memory of 384 1532 svchost.exe 3 PID 1532 wrote to memory of 392 1532 svchost.exe 4 PID 1532 wrote to memory of 392 1532 svchost.exe 4 PID 1532 wrote to memory of 392 1532 svchost.exe 4 PID 1532 wrote to memory of 392 1532 svchost.exe 4 PID 1532 wrote to memory of 392 1532 svchost.exe 4 PID 1532 wrote to memory of 432 1532 svchost.exe 5 PID 1532 wrote to memory of 432 1532 svchost.exe 5 PID 1532 wrote to memory of 432 1532 svchost.exe 5 PID 1532 wrote to memory of 432 1532 svchost.exe 5 PID 1532 wrote to memory of 432 1532 svchost.exe 5 PID 1532 wrote to memory of 480 1532 svchost.exe 6 PID 1532 wrote to memory of 480 1532 svchost.exe 6 PID 1532 wrote to memory of 480 1532 svchost.exe 6 PID 1532 wrote to memory of 480 1532 svchost.exe 6 PID 1532 wrote to memory of 480 1532 svchost.exe 6 PID 1532 wrote to memory of 488 1532 svchost.exe 7 PID 1532 wrote to memory of 488 1532 svchost.exe 7 PID 1532 wrote to memory of 488 1532 svchost.exe 7 PID 1532 wrote to memory of 488 1532 svchost.exe 7 PID 1532 wrote to memory of 488 1532 svchost.exe 7 PID 1532 wrote to memory of 496 1532 svchost.exe 8 PID 1532 wrote to memory of 496 1532 svchost.exe 8 PID 1532 wrote to memory of 496 1532 svchost.exe 8 PID 1532 wrote to memory of 496 1532 svchost.exe 8 PID 1532 wrote to memory of 496 1532 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1440
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1044
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2308
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:272
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:308
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1080
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1116
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:1852
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2752
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_111fe9849014288920528887e75aa974.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_111fe9849014288920528887e75aa974.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3032
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize204KB
MD510f3e58b9ea4301c95e2f54e05823af4
SHA10fc7d6d823f60a6fa01f388fad0bf8ac59642832
SHA25683dc58bdddd75fbc61b0e08586cf71b20ff2c8ec12a4d7a1baa2b49ed1caec81
SHA512107f2a62fe6b11ef077c22ae1dae3587352b43f933928df39333378fda9667c32135979450d7509ca0deea8e62636272eabeaaadae596b5619324aeafc354fae
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize200KB
MD51b605c50aff3e966c44199e01564c838
SHA114213795dcfb6d06ac0d6a9c9bc23fb35f776ab3
SHA2562dac610f720fa4a90b16e3affe1f9c322a8f354a6ef9b467ce54c23252f2070a
SHA512dee3ebae315db752d0e8caf188d14be67811b5d7b07b934b10ed5e2e00c8c555d822516039574fc8d187ed7e1e626d596c9307281e51ce62ed397d6afb7d892c
-
Filesize
95KB
MD5111fe9849014288920528887e75aa974
SHA14e4131e067a39b73664d7e03e735fa53974e4794
SHA256145fd16c6ab8bd756ff9590893339d3d8929a82791e27272043f8b24800f0e94
SHA512f66278c5aeeb6c33bc2881fa8d4b8561cfff6269a177072a6def3f146242c66fc417a6689dc546b58b6d49b91a36cce66cc88fcf49e820573f42311b4548805f