Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe
-
Size
95KB
-
MD5
6a7a86fc52db240005ac12693962236c
-
SHA1
2a31d2fe79ee40009065db3033e51522aed23c99
-
SHA256
13911037f0144dc3154ee627451bb63cd11c4c831824a29fa158dabad511cda4
-
SHA512
e7173028c74133f06654217457c8d72d2382dc3c0b8968d03062f0bbcc3be65037e682edded9886ac21a31596f1f6db55c05c12bfd2dfec12f6faddaad0a8fce
-
SSDEEP
768:H06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:dR0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 1628 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2380-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1628-78-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1628-72-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1628-600-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcf.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\jnwppr.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEINTL.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL svchost.exe File opened for modification C:\Program Files\Windows Photo Viewer\PhotoViewer.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\mpvis.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\skchobj.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\eula.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\ieproxy.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libGLESv2.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\osclientcerts.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\fxplugins.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\xul.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 1628 WaterMark.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe 2172 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1628 WaterMark.exe Token: SeDebugPrivilege 2172 svchost.exe Token: SeDebugPrivilege 1628 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 1628 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1628 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 30 PID 2380 wrote to memory of 1628 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 30 PID 2380 wrote to memory of 1628 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 30 PID 2380 wrote to memory of 1628 2380 JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe 30 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2760 1628 WaterMark.exe 31 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 1628 wrote to memory of 2172 1628 WaterMark.exe 32 PID 2172 wrote to memory of 256 2172 svchost.exe 1 PID 2172 wrote to memory of 256 2172 svchost.exe 1 PID 2172 wrote to memory of 256 2172 svchost.exe 1 PID 2172 wrote to memory of 256 2172 svchost.exe 1 PID 2172 wrote to memory of 256 2172 svchost.exe 1 PID 2172 wrote to memory of 332 2172 svchost.exe 2 PID 2172 wrote to memory of 332 2172 svchost.exe 2 PID 2172 wrote to memory of 332 2172 svchost.exe 2 PID 2172 wrote to memory of 332 2172 svchost.exe 2 PID 2172 wrote to memory of 332 2172 svchost.exe 2 PID 2172 wrote to memory of 380 2172 svchost.exe 3 PID 2172 wrote to memory of 380 2172 svchost.exe 3 PID 2172 wrote to memory of 380 2172 svchost.exe 3 PID 2172 wrote to memory of 380 2172 svchost.exe 3 PID 2172 wrote to memory of 380 2172 svchost.exe 3 PID 2172 wrote to memory of 392 2172 svchost.exe 4 PID 2172 wrote to memory of 392 2172 svchost.exe 4 PID 2172 wrote to memory of 392 2172 svchost.exe 4 PID 2172 wrote to memory of 392 2172 svchost.exe 4 PID 2172 wrote to memory of 392 2172 svchost.exe 4 PID 2172 wrote to memory of 428 2172 svchost.exe 5 PID 2172 wrote to memory of 428 2172 svchost.exe 5 PID 2172 wrote to memory of 428 2172 svchost.exe 5 PID 2172 wrote to memory of 428 2172 svchost.exe 5 PID 2172 wrote to memory of 428 2172 svchost.exe 5 PID 2172 wrote to memory of 472 2172 svchost.exe 6 PID 2172 wrote to memory of 472 2172 svchost.exe 6 PID 2172 wrote to memory of 472 2172 svchost.exe 6 PID 2172 wrote to memory of 472 2172 svchost.exe 6 PID 2172 wrote to memory of 472 2172 svchost.exe 6 PID 2172 wrote to memory of 488 2172 svchost.exe 7 PID 2172 wrote to memory of 488 2172 svchost.exe 7 PID 2172 wrote to memory of 488 2172 svchost.exe 7 PID 2172 wrote to memory of 488 2172 svchost.exe 7 PID 2172 wrote to memory of 488 2172 svchost.exe 7 PID 2172 wrote to memory of 496 2172 svchost.exe 8 PID 2172 wrote to memory of 496 2172 svchost.exe 8 PID 2172 wrote to memory of 496 2172 svchost.exe 8 PID 2172 wrote to memory of 496 2172 svchost.exe 8 PID 2172 wrote to memory of 496 2172 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1604
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:884
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:764
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1104
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:856
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2336
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1052
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1140
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1180
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2404
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1788
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a7a86fc52db240005ac12693962236c.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD56a7a86fc52db240005ac12693962236c
SHA12a31d2fe79ee40009065db3033e51522aed23c99
SHA25613911037f0144dc3154ee627451bb63cd11c4c831824a29fa158dabad511cda4
SHA512e7173028c74133f06654217457c8d72d2382dc3c0b8968d03062f0bbcc3be65037e682edded9886ac21a31596f1f6db55c05c12bfd2dfec12f6faddaad0a8fce
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize204KB
MD55f79e9a48a2a2addd2debbb5b58d9f06
SHA1b79bf8e490b32c312997dff9c3280861ea8f1932
SHA256c0765eedb4f75e5929a0341b192db19e8f4d47328758982bc16f35a1016104a6
SHA51265c3da20c2de4db3081f273053d0216f4727cbceab20d9b47f3e21e93c7640628f694e8983905918f61a71e22375b45a47e3a947dc3155585152fdb528c28d0f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize200KB
MD572733703e60d023458f9ad4494ab5287
SHA1a1f359d7d48cb59116d55dfbc278ca81a113ce65
SHA25633cd027339b847b697bc23b87a7e19f99eeaf12dd94396ddaac5e0ad240b3fdb
SHA5124cf54a86369ba66903f92d7493934f58c418b772d2fbc660823815cec989fe461f8206bb024c74e44b73af5a7f6ba6fe07e6235191f2eabd54cae9b9ea8b2bb7