Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7705e861e12db869c9a318328179fc24.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_7705e861e12db869c9a318328179fc24.exe
-
Size
123KB
-
MD5
7705e861e12db869c9a318328179fc24
-
SHA1
917ad00a5beb8824d23fe6bae3338aa0ff2551c6
-
SHA256
25a2c7410eb0c4cc5b0c8e04d8463f2b13a00e08b991fe9e398d32bb9c32f81d
-
SHA512
db2af1faa0ba319fda77935391f2e88ae50ec15d4b8d4e37437cc7691e7638206d4b3336fa8fcc7b5cbb31debf246e59c4177b68d6a4b058ee62b611fa2e5ae8
-
SSDEEP
768:f06R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:FR0Zn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2948 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2036-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2948-23-0x0000000000400000-0x0000000000441000-memory.dmp upx behavioral1/memory/2948-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2948-27-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2036-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2948-70-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2948-590-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\notificationserver.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\pdm.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\osclientcerts.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\t2k.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\IA2Marshal.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwgst.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll svchost.exe File opened for modification C:\Program Files\DVD Maker\WMM2CLIP.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penkor.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jfxwebkit.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pe.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\prism-d3d.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7705e861e12db869c9a318328179fc24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 2948 WaterMark.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe 1864 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2948 WaterMark.exe Token: SeDebugPrivilege 1864 svchost.exe Token: SeDebugPrivilege 2948 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 2948 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2948 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 30 PID 2036 wrote to memory of 2948 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 30 PID 2036 wrote to memory of 2948 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 30 PID 2036 wrote to memory of 2948 2036 JaffaCakes118_7705e861e12db869c9a318328179fc24.exe 30 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 2660 2948 WaterMark.exe 31 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 2948 wrote to memory of 1864 2948 WaterMark.exe 32 PID 1864 wrote to memory of 256 1864 svchost.exe 1 PID 1864 wrote to memory of 256 1864 svchost.exe 1 PID 1864 wrote to memory of 256 1864 svchost.exe 1 PID 1864 wrote to memory of 256 1864 svchost.exe 1 PID 1864 wrote to memory of 256 1864 svchost.exe 1 PID 1864 wrote to memory of 332 1864 svchost.exe 2 PID 1864 wrote to memory of 332 1864 svchost.exe 2 PID 1864 wrote to memory of 332 1864 svchost.exe 2 PID 1864 wrote to memory of 332 1864 svchost.exe 2 PID 1864 wrote to memory of 332 1864 svchost.exe 2 PID 1864 wrote to memory of 380 1864 svchost.exe 3 PID 1864 wrote to memory of 380 1864 svchost.exe 3 PID 1864 wrote to memory of 380 1864 svchost.exe 3 PID 1864 wrote to memory of 380 1864 svchost.exe 3 PID 1864 wrote to memory of 380 1864 svchost.exe 3 PID 1864 wrote to memory of 396 1864 svchost.exe 4 PID 1864 wrote to memory of 396 1864 svchost.exe 4 PID 1864 wrote to memory of 396 1864 svchost.exe 4 PID 1864 wrote to memory of 396 1864 svchost.exe 4 PID 1864 wrote to memory of 396 1864 svchost.exe 4 PID 1864 wrote to memory of 432 1864 svchost.exe 5 PID 1864 wrote to memory of 432 1864 svchost.exe 5 PID 1864 wrote to memory of 432 1864 svchost.exe 5 PID 1864 wrote to memory of 432 1864 svchost.exe 5 PID 1864 wrote to memory of 432 1864 svchost.exe 5 PID 1864 wrote to memory of 476 1864 svchost.exe 6 PID 1864 wrote to memory of 476 1864 svchost.exe 6 PID 1864 wrote to memory of 476 1864 svchost.exe 6 PID 1864 wrote to memory of 476 1864 svchost.exe 6 PID 1864 wrote to memory of 476 1864 svchost.exe 6 PID 1864 wrote to memory of 492 1864 svchost.exe 7 PID 1864 wrote to memory of 492 1864 svchost.exe 7 PID 1864 wrote to memory of 492 1864 svchost.exe 7 PID 1864 wrote to memory of 492 1864 svchost.exe 7 PID 1864 wrote to memory of 492 1864 svchost.exe 7 PID 1864 wrote to memory of 500 1864 svchost.exe 8 PID 1864 wrote to memory of 500 1864 svchost.exe 8 PID 1864 wrote to memory of 500 1864 svchost.exe 8 PID 1864 wrote to memory of 500 1864 svchost.exe 8 PID 1864 wrote to memory of 500 1864 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1560
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1696
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:760
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:860
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:772
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:296
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1076
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2388
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1760
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7705e861e12db869c9a318328179fc24.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7705e861e12db869c9a318328179fc24.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize260KB
MD5be914cb584956dbb0f2e6a9738ea3f58
SHA1d3aea9f65ff423f6ad0b68d9dee7101748e3f34a
SHA256fdd332abcef33277f655414b07a26e39692cb00425336d980cb31c3f5f92d9ef
SHA512c08e8968770da5cb73c77c6b5861512bede6b2afb82c0db5e26ffefcd7711fc70fca9df1111412f3c7ca0f95cae43fb98afd0df4014a59bd70784275ab880056
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize256KB
MD5cc9005fdc5124929bdcb391547cdd81f
SHA15d06c53f8be685ad9cbdc978093ce8235221ae76
SHA256aa322b559b7c356a3d40b13351516d252f56fae78b6f59ad1e84ab1e078eb79d
SHA51286a6adda13f1fecd23acd4c1449218a3520d19bff024b26bd3c769623bf19d58d135d649b0c8561a6d3d16702ecf661ea0ec86a0012c33cd3429f63530aee83b
-
Filesize
123KB
MD57705e861e12db869c9a318328179fc24
SHA1917ad00a5beb8824d23fe6bae3338aa0ff2551c6
SHA25625a2c7410eb0c4cc5b0c8e04d8463f2b13a00e08b991fe9e398d32bb9c32f81d
SHA512db2af1faa0ba319fda77935391f2e88ae50ec15d4b8d4e37437cc7691e7638206d4b3336fa8fcc7b5cbb31debf246e59c4177b68d6a4b058ee62b611fa2e5ae8