Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe
-
Size
147KB
-
MD5
16b23aef3ac4cff120269deb5da405ac
-
SHA1
510d2fc6569adde0e5b6d8f8394e505afbc64269
-
SHA256
166d2c129ac315154e2221306ae85292a63370370d793ccba4315ebb2ba2b71e
-
SHA512
c7a93a4a29554e4ba9593836fd651d9f18c7e30a02e97ea1507a6281dc1c28e03cc8bb7bb041ecdf09c0714d657e821442921317c2646317643554c659aaf109
-
SSDEEP
1536:FR0+n3Pc0LCH9MtbvabUDzJYWu3BmiIuw22Jn1fbO4V:FR1n3k0CdM1vabyzJYWqQa2
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2244 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/1664-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-13-0x00000000001E0000-0x000000000022E000-memory.dmp upx behavioral1/memory/1664-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1664-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2244-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2244-71-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2244-591-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado15.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Windows Mail\wabfind.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_rtp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\qipcap64.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMCCore.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\msvcr100.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\MSOERES.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsoundds.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\awt.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2244 WaterMark.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe 2688 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2244 WaterMark.exe Token: SeDebugPrivilege 2688 svchost.exe Token: SeDebugPrivilege 2244 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 2244 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2244 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 30 PID 1664 wrote to memory of 2244 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 30 PID 1664 wrote to memory of 2244 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 30 PID 1664 wrote to memory of 2244 1664 JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe 30 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2736 2244 WaterMark.exe 31 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2244 wrote to memory of 2688 2244 WaterMark.exe 32 PID 2688 wrote to memory of 256 2688 svchost.exe 1 PID 2688 wrote to memory of 256 2688 svchost.exe 1 PID 2688 wrote to memory of 256 2688 svchost.exe 1 PID 2688 wrote to memory of 256 2688 svchost.exe 1 PID 2688 wrote to memory of 256 2688 svchost.exe 1 PID 2688 wrote to memory of 336 2688 svchost.exe 2 PID 2688 wrote to memory of 336 2688 svchost.exe 2 PID 2688 wrote to memory of 336 2688 svchost.exe 2 PID 2688 wrote to memory of 336 2688 svchost.exe 2 PID 2688 wrote to memory of 336 2688 svchost.exe 2 PID 2688 wrote to memory of 372 2688 svchost.exe 3 PID 2688 wrote to memory of 372 2688 svchost.exe 3 PID 2688 wrote to memory of 372 2688 svchost.exe 3 PID 2688 wrote to memory of 372 2688 svchost.exe 3 PID 2688 wrote to memory of 372 2688 svchost.exe 3 PID 2688 wrote to memory of 384 2688 svchost.exe 4 PID 2688 wrote to memory of 384 2688 svchost.exe 4 PID 2688 wrote to memory of 384 2688 svchost.exe 4 PID 2688 wrote to memory of 384 2688 svchost.exe 4 PID 2688 wrote to memory of 384 2688 svchost.exe 4 PID 2688 wrote to memory of 420 2688 svchost.exe 5 PID 2688 wrote to memory of 420 2688 svchost.exe 5 PID 2688 wrote to memory of 420 2688 svchost.exe 5 PID 2688 wrote to memory of 420 2688 svchost.exe 5 PID 2688 wrote to memory of 420 2688 svchost.exe 5 PID 2688 wrote to memory of 464 2688 svchost.exe 6 PID 2688 wrote to memory of 464 2688 svchost.exe 6 PID 2688 wrote to memory of 464 2688 svchost.exe 6 PID 2688 wrote to memory of 464 2688 svchost.exe 6 PID 2688 wrote to memory of 464 2688 svchost.exe 6 PID 2688 wrote to memory of 480 2688 svchost.exe 7 PID 2688 wrote to memory of 480 2688 svchost.exe 7 PID 2688 wrote to memory of 480 2688 svchost.exe 7 PID 2688 wrote to memory of 480 2688 svchost.exe 7 PID 2688 wrote to memory of 480 2688 svchost.exe 7 PID 2688 wrote to memory of 488 2688 svchost.exe 8 PID 2688 wrote to memory of 488 2688 svchost.exe 8 PID 2688 wrote to memory of 488 2688 svchost.exe 8 PID 2688 wrote to memory of 488 2688 svchost.exe 8 PID 2688 wrote to memory of 488 2688 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1196
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1632
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵PID:2852
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1176
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:996
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:328
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:888
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1084
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2868
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2504
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_16b23aef3ac4cff120269deb5da405ac.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize308KB
MD501d526d9f8d9a5592a3577f8aa5ba1d3
SHA14d9d0d8a25593666b2f82da77c0e759baa0d1a2a
SHA256d22d7b4ecea965f98ad130a33ad955efe05855ee16374589f0c594f31913d127
SHA51230c429a7f28b559c526dd5fe9bc75ffafb30c961ae0cdba337ca0c2d7319ad1f3b6c6b7a8f217dee7a2d76b31155c4d92922f162a826df6a7c7ac33d21d76bff
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize304KB
MD5bbabc20f3274a873fe121788156793db
SHA134a2cfd41873dbd37d23301cfff6511e6997c308
SHA256a2d8506b43852c6363840476016181ff30ba7a0c0d56663aa2224333d9151b70
SHA512cff8f036ec66622da3090c45504cf1da7f2ef3ff2da25d82e1de0611d76a7389e9c7ba59abe0dd9db3cad127b0c537adcbfb62b1e81146a71eb58fdae302c161
-
Filesize
147KB
MD516b23aef3ac4cff120269deb5da405ac
SHA1510d2fc6569adde0e5b6d8f8394e505afbc64269
SHA256166d2c129ac315154e2221306ae85292a63370370d793ccba4315ebb2ba2b71e
SHA512c7a93a4a29554e4ba9593836fd651d9f18c7e30a02e97ea1507a6281dc1c28e03cc8bb7bb041ecdf09c0714d657e821442921317c2646317643554c659aaf109