Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 04:34
Behavioral task
behavioral1
Sample
d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe
-
Size
440KB
-
MD5
d38cf91a537cfabf451abb0364a12373
-
SHA1
d508bac952cb07634128b7b529e66c36529af0a7
-
SHA256
1c20922d342bcee8fcd2200643cc436d94354821417606b82966a351dcc05530
-
SHA512
7a5c4fba36441a2a4bef72b75931d9888c5e1d23a4ac7a197dff4785d73350e7d5b3dc20929dd8db194cac4cc8dc83e9ad89257cf5625f36c96f1c1c0d2d801e
-
SSDEEP
12288:nV6s/WNzhczofNu/l5GMavm8hdMD7YALsMY:nnekzoE/lgMz6MDJsd
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4496-0-0x0000000000400000-0x000000000054E000-memory.dmp vmprotect behavioral2/memory/4496-2-0x0000000000400000-0x000000000054E000-memory.dmp vmprotect behavioral2/memory/4496-36-0x0000000000400000-0x000000000054E000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\SouGoo.ime d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3524 msedge.exe 3524 msedge.exe 2184 msedge.exe 2184 msedge.exe 2720 identity_helper.exe 2720 identity_helper.exe 3328 msedge.exe 3328 msedge.exe 3328 msedge.exe 3328 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 1080 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe 91 PID 4496 wrote to memory of 1080 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe 91 PID 4496 wrote to memory of 1080 4496 d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe 91 PID 3284 wrote to memory of 2184 3284 explorer.exe 94 PID 3284 wrote to memory of 2184 3284 explorer.exe 94 PID 2184 wrote to memory of 1452 2184 msedge.exe 96 PID 2184 wrote to memory of 1452 2184 msedge.exe 96 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3012 2184 msedge.exe 97 PID 2184 wrote to memory of 3524 2184 msedge.exe 98 PID 2184 wrote to memory of 3524 2184 msedge.exe 98 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99 PID 2184 wrote to memory of 1432 2184 msedge.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d38cf91a537cfabf451abb0364a12373_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\explorer.exeexplorer http://www.52hln.com/2⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.52hln.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9b7bc46f8,0x7ff9b7bc4708,0x7ff9b7bc47183⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:83⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:13⤵PID:852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:13⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:13⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:13⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:13⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:83⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:13⤵PID:1468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:13⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:13⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:13⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,16786702824090278538,9738513289983811650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3388 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3328
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
5KB
MD52bbe677f2211f5e09e69ccecb6695da4
SHA19a0ebf8325bad9b780a7ca2046a779a084d8c432
SHA256e8f245b7826aa61a057992720bf8ab6d81e8a5d3a35974e369aa6e4d21bf197d
SHA512f448cffc29695e321613624a8f2a1dbfed25001270d81e3b71e527b26958814c8f2df9004414147470ea1ca56d4eaf21b544fd37fac05439c0e54854ade5d73a
-
Filesize
6KB
MD55631443d7e51ff491a7dece3b92ed9f8
SHA1b7163c3f5849c5830b4ee1afeee99a5c86154162
SHA256a7efec3e413cd84305f939a5231f932c6ff3bbf4558a0a2c764784d32cc8d16d
SHA512008f6bd82faaf1ad3974283b9301a620782f14cb1aaa485d865d4bc89011c63ae9c8b1c303d409a32e6e32ad18896de3bd3f297908f84b577fe57d1da12d7c48
-
Filesize
6KB
MD5b31cb2df0d194a27ddb0328d4403579a
SHA18ab643f4761cf1b4773ef6389ab2c7fe65816c15
SHA2561d59bbe97ef7c9434386015959f28b18db4ebb0afd2c089896a023c00f194a10
SHA512d79f77f3326d8d3b3c4f8604242ce95862091cff82fa6ea33e843682304d1a2fa8219e614ab37e027e362ff2a1aa84435d4678b10f30c671a37ba91186716b02
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5b2ce5e603003156e513f5b552b6a06ca
SHA1c610741ba7ce2bf149cbf473261ea7a6fc6ca211
SHA256f7cc3ccbb99fb2b726b799815a6278af3dd968f00a95d0201935891392a0499c
SHA512b02f23ef69bf4a4b0e7af99a4f74dd0055fe7fe1fce87fc0b0b904b91a5bfd318b0ddccc07e9331b09128c46f79be39971f10aac5ea71b0d604e422b0b1e6ab0
-
Filesize
52KB
MD5b60da4e2e5aceba3ce3d87ee2cd872ee
SHA19bbdbf1f3ce2c000a86e0473da756a4b1031db41
SHA256b581fcc82c0462d60286a80912ab2ce5aca7d7b11c5cff0b5f74716dbb7dc453
SHA512664d6f893484252b339ff8f413a4cf9da9b0ef82ed74b097ba86a5f00b4d9740eef6e8a5b81e8be7e82ae4009928097baf15e65a03f31c4b92e44f593ce39874