Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/01/2025, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe
-
Size
123KB
-
MD5
9ebe84ee3e13889d88909147a1298510
-
SHA1
4ec3c49f77e3d7e06cc1e5237b8360fbcdc04455
-
SHA256
11050b608ca0e74b75bb53459717006c0f533bed71cffc2be3e0720082f383cf
-
SHA512
42993691b488e16c8cfc86d25ab67cd2c91e9b28f394eaf9e5923c55ef8470857ffa0c2d251ecaae6c12e771d08750979b2cbfba89fd1bb84d5ac0025c6b1f18
-
SSDEEP
768:406R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:2R0Zn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 2988 WaterMark.exe -
Loads dropped DLL 2 IoCs
pid Process 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2212-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2212-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2212-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2212-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2988-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2988-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2988-27-0x0000000000400000-0x0000000000441000-memory.dmp upx behavioral1/memory/2212-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2212-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2212-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2988-74-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2988-586-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2ssv.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXEV.DLL svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\perfcore.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VISSHE.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\javafx-iio.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libEGL.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\DiagnosticsTap.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSORES.DLL svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaterMark.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2988 WaterMark.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe 2936 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2988 WaterMark.exe Token: SeDebugPrivilege 2936 svchost.exe Token: SeDebugPrivilege 2988 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 2988 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2988 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 30 PID 2212 wrote to memory of 2988 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 30 PID 2212 wrote to memory of 2988 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 30 PID 2212 wrote to memory of 2988 2212 JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe 30 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2292 2988 WaterMark.exe 31 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2988 wrote to memory of 2936 2988 WaterMark.exe 32 PID 2936 wrote to memory of 256 2936 svchost.exe 1 PID 2936 wrote to memory of 256 2936 svchost.exe 1 PID 2936 wrote to memory of 256 2936 svchost.exe 1 PID 2936 wrote to memory of 256 2936 svchost.exe 1 PID 2936 wrote to memory of 256 2936 svchost.exe 1 PID 2936 wrote to memory of 332 2936 svchost.exe 2 PID 2936 wrote to memory of 332 2936 svchost.exe 2 PID 2936 wrote to memory of 332 2936 svchost.exe 2 PID 2936 wrote to memory of 332 2936 svchost.exe 2 PID 2936 wrote to memory of 332 2936 svchost.exe 2 PID 2936 wrote to memory of 380 2936 svchost.exe 3 PID 2936 wrote to memory of 380 2936 svchost.exe 3 PID 2936 wrote to memory of 380 2936 svchost.exe 3 PID 2936 wrote to memory of 380 2936 svchost.exe 3 PID 2936 wrote to memory of 380 2936 svchost.exe 3 PID 2936 wrote to memory of 392 2936 svchost.exe 4 PID 2936 wrote to memory of 392 2936 svchost.exe 4 PID 2936 wrote to memory of 392 2936 svchost.exe 4 PID 2936 wrote to memory of 392 2936 svchost.exe 4 PID 2936 wrote to memory of 392 2936 svchost.exe 4 PID 2936 wrote to memory of 428 2936 svchost.exe 5 PID 2936 wrote to memory of 428 2936 svchost.exe 5 PID 2936 wrote to memory of 428 2936 svchost.exe 5 PID 2936 wrote to memory of 428 2936 svchost.exe 5 PID 2936 wrote to memory of 428 2936 svchost.exe 5 PID 2936 wrote to memory of 472 2936 svchost.exe 6 PID 2936 wrote to memory of 472 2936 svchost.exe 6 PID 2936 wrote to memory of 472 2936 svchost.exe 6 PID 2936 wrote to memory of 472 2936 svchost.exe 6 PID 2936 wrote to memory of 472 2936 svchost.exe 6 PID 2936 wrote to memory of 488 2936 svchost.exe 7 PID 2936 wrote to memory of 488 2936 svchost.exe 7 PID 2936 wrote to memory of 488 2936 svchost.exe 7 PID 2936 wrote to memory of 488 2936 svchost.exe 7 PID 2936 wrote to memory of 488 2936 svchost.exe 7 PID 2936 wrote to memory of 496 2936 svchost.exe 8 PID 2936 wrote to memory of 496 2936 svchost.exe 8 PID 2936 wrote to memory of 496 2936 svchost.exe 8 PID 2936 wrote to memory of 496 2936 svchost.exe 8 PID 2936 wrote to memory of 496 2936 svchost.exe 8
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1268
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:372
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:688
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1168
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:2908
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1052
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1588
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2260
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2264
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9ebe84ee3e13889d88909147a1298510.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize260KB
MD5a4437e673c48bfe7b0cc1096d115938a
SHA105ead7938b7592a4b3140f56c7b78422819bc70c
SHA2561250d11559b525bf262e6974ddb8d06d478daf4cf3e63c4fa8824bf61f60d596
SHA512d5acf583ddca6cc62531c437db21e5963a68bb83452c1b98d166df04908fc47b46e44e96b05d7b61357fac52a2d9131b2933777e36ad191c7a9a80cfbca04fb8
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize256KB
MD54d851bb61bc7b654f1a211985e1f6c60
SHA154172f677a7994efb511d9374041224612b08f79
SHA2569d0fe6f609905e30d0e5b3551fc087e1ec802719ce4cb0e4191460e5b1132b01
SHA512aa55e5828d069dfc073ab4572b1f228516ec4d1ed68a43f77713d3306aa1a3d6a349ed45f276d53881201497419823dd98e2ea20901b02d46058e9fb1c9efae1
-
Filesize
123KB
MD59ebe84ee3e13889d88909147a1298510
SHA14ec3c49f77e3d7e06cc1e5237b8360fbcdc04455
SHA25611050b608ca0e74b75bb53459717006c0f533bed71cffc2be3e0720082f383cf
SHA51242993691b488e16c8cfc86d25ab67cd2c91e9b28f394eaf9e5923c55ef8470857ffa0c2d251ecaae6c12e771d08750979b2cbfba89fd1bb84d5ac0025c6b1f18