Analysis
-
max time kernel
61s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
CraxsRat.exe
Resource
win10-20230703-en
General
-
Target
CraxsRat.exe
-
Size
41.8MB
-
MD5
13f7a89150f4d9014cc361333a11fda4
-
SHA1
9ec23eead82b5407507f954f8246813467d1ee2e
-
SHA256
4224619bd0192263ebc4fe70e1eef9bd3482ece592b20928680e281d8c58cda6
-
SHA512
f747ad818a34ae3bdb45e9315b229738384fc72fa95f68826bfafe91771f495a18f07d8f418825fb49a07209bb2f017682035ef3d6db15843a040b908ce06db3
-
SSDEEP
98304:r7fTTykeqo9xUZJkaOFPL7UcnFjBJvdg+2NVCCvdM2V51:r7fYzU8lF/UcnFjr72vNlHt
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1976 msedge.exe 1976 msedge.exe 1900 msedge.exe 1900 msedge.exe 1708 identity_helper.exe 1708 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe 1900 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1900 1148 CraxsRat.exe 89 PID 1148 wrote to memory of 1900 1148 CraxsRat.exe 89 PID 1900 wrote to memory of 2924 1900 msedge.exe 90 PID 1900 wrote to memory of 2924 1900 msedge.exe 90 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 4728 1900 msedge.exe 93 PID 1900 wrote to memory of 1976 1900 msedge.exe 91 PID 1900 wrote to memory of 1976 1900 msedge.exe 91 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92 PID 1900 wrote to memory of 4760 1900 msedge.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe"C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CraxsRat.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec1a546f8,0x7ffec1a54708,0x7ffec1a547183⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:83⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:23⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:13⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:83⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:13⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:13⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:13⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:13⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2784777066735828215,5422069847056496086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:13⤵PID:496
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=CraxsRat.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵PID:3248
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec1a546f8,0x7ffec1a54708,0x7ffec1a547183⤵PID:4208
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3340
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53423d7e71b832850019e032730997f69
SHA1bbc91ba3960fb8f7f2d5a190e6585010675d9061
SHA25653770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649
SHA51203d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d
-
Filesize
152B
MD53423d7e71b832850019e032730997f69
SHA1bbc91ba3960fb8f7f2d5a190e6585010675d9061
SHA25653770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649
SHA51203d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5a8e93b967d8851c7ecb56bd1fc0fcdce
SHA1dceddd19b49191b16b4e0ddedcb047a44a0d70cc
SHA256ef5c47efd4f746126be5592f6a829d47daebdf7874c0b72864474ecaea49d4a5
SHA512ea58ec39beb7bbb38b127dbe64744bb31d9553316ea7fe389638a0fb04d4a023c35533cace844ac05c67f18f1089985fd239da4d90b4e7cd9742874031aa430f
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5a1e8024b25a698f36d0cb83bd9c055a0
SHA1282c32781fb06d4fa00fb47da6524fb2597465f1
SHA256ffa04ef06aa863a2441a3a9526f03206e575dadf35f520d3a7d0db6dca6db81d
SHA512c45333d39a99fdadbdd4c156099e1929c16dfd7401a523415099e56fe7dd79b9a5658f407f638f34d7e8c19d9bb307a780b7c5a2a83a58f4e5db174ade0f6ade
-
Filesize
5KB
MD5b66743be2f88ca0ff38ea8ce6c612196
SHA1f9fabc1416ab720703d21ac4c9dbce240f276b32
SHA256b56a754d32e7b6724642496dacd11108a8878224ec014a5b896085aa4096ed89
SHA512c10cef246be775d84f09bba0c854d7406d2d3d58539544a285ab18c47c9d9e79db8b54ea8d3b83ef1f0462b52eaaa37ab93426029df27584733505ef00c7f498
-
Filesize
5KB
MD5f97cc6a4f15e8d68039551519c09e313
SHA1745504884f39017f4d8465af3370495e3fba29c8
SHA256660c9b0b2c14487d26c5d4f8fdbd30caf0cf42575846d993f6f81a1105823017
SHA512be714c29a55a5ca45374c8deb851ed355811370c35176e60918b7b16c2ea4935b023970f74a785b39a1ce93b660f9bcf26709a62b1696f1ee071e523bb2dadaf
-
Filesize
24KB
MD50e78f9a3ece93ae9434c64ea2bff51dc
SHA1a0e4c75fe32417fe2df705987df5817326e1b3b9
SHA2565c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68
SHA5129d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d
-
Filesize
371B
MD5c5b7b05977dde8165e17ce8763899816
SHA12283eb368a74947390dba72040b66688efd38b79
SHA2563e62c12c1dc1a117b6beae7a4f3a2136a2da7818ddb8f0fe22a0fd7313d48a9a
SHA512b75dcfd543814bb3bc5b0ac47bda561a7799ab25a7a6eebbe14f80d5e72914a68d9f38a732d9f0312c055458df6fe6f6b4584634e194f8d3eef43286ce7dac0f
-
Filesize
371B
MD53699b7059c666cde591606ab3e298eb6
SHA12304af22e74a7b1b1da881ab817347a63963a591
SHA2561250bb778e21fd09a59132db70c0d8b038e19db06aa868b2333a214450461c98
SHA512f7c42673955c5c69c3a0dcfba02bb6e555af327af701fda7082fd7f90aab816e0d227d492804b7198814a4e1c3ba21ab110ad24b48cd4bceeb401ebfcd5c458e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD54bceade5c513cf93b81272a253da190b
SHA1913ab097b1f349a40f8ebd0fa08eabef19b5b597
SHA2562782a7d7051392374bbc725b62864362be05ab43af90cdf93ada86e2ae7c6804
SHA5123cf1920922718d44355041b29f4321a3243b313f797ea9e06871d888f4c86f36745c6190865b1be5c7341a0f0a56ec9c3c946168285b63a57b508afde72ea2aa