Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/10/2024, 19:44
241028-yfzzwswbnl 319/09/2024, 17:46
240919-wcq7gasarn 314/09/2024, 23:25
240914-3egt5sshjc 629/08/2024, 08:30
240829-kd8mcs1hph 929/08/2024, 08:05
240829-jy9jqashqp 329/08/2024, 07:45
240829-jlqabasell 329/08/2024, 07:24
240829-h8gq1szblh 329/08/2024, 02:45
240829-c8p5hazemc 327/08/2024, 21:54
240827-1sjjsatcmf 826/08/2024, 22:44
240826-2nwtzs1brm 6Analysis
-
max time kernel
103s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/09/2024, 17:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
Resource
win11-20240802-en
General
-
Target
https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2512 2816 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NexusFN.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier msedge.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2528 NOTEPAD.EXE 3108 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3452 msedge.exe 3452 msedge.exe 3868 msedge.exe 3868 msedge.exe 4436 msedge.exe 4436 msedge.exe 1176 identity_helper.exe 1176 identity_helper.exe 4576 msedge.exe 4576 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 3484 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3484 AUDIODG.EXE Token: SeDebugPrivilege 2816 NexusFN.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 1360 3868 msedge.exe 79 PID 3868 wrote to memory of 1360 3868 msedge.exe 79 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 4368 3868 msedge.exe 80 PID 3868 wrote to memory of 3452 3868 msedge.exe 81 PID 3868 wrote to memory of 3452 3868 msedge.exe 81 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82 PID 3868 wrote to memory of 1072 3868 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffffad03cb8,0x7ffffad03cc8,0x7ffffad03cd82⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:22⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4576
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1104
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3076
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\nexus\combo.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2528
-
C:\Users\Admin\Desktop\nexus\nexus\NexusFN.exe"C:\Users\Admin\Desktop\nexus\nexus\NexusFN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 13002⤵
- Program crash
PID:2512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2816 -ip 28161⤵PID:3744
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\nexus\combo.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b4ae6009e2df12ce252d03722e8f4288
SHA144de96f65d69cbae416767040f887f68f8035928
SHA2567778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d
SHA512bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1
-
Filesize
152B
MD54bf4b59c3deb1688a480f8e56aab059d
SHA1612c83e7027b3bfb0e9d2c9efad43c5318e731bb
SHA256867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82
SHA5122ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5d5a7a56b0c4960df03730258c9ea7994
SHA17570ed5320fc5ce011c190c75a99f21025a98c82
SHA2569e9056f1cf0aeac3d87d7b02b35b833347564b16ca6b1b1cf8df1cc6536c486d
SHA512585f63da0b5a7e227e17d51d75f00b9576597c0975768998516a913875099b31917ac845e3016b0ce6baa8ddf9b7964e4deddc33c0d0faa71136500f489f58d8
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
188B
MD5008114e1a1a614b35e8a7515da0f3783
SHA13c390d38126c7328a8d7e4a72d5848ac9f96549b
SHA2567301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18
SHA512a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b
-
Filesize
5KB
MD5a7561724ad0089afd41ce91271624b76
SHA137f90b06d68b840a44bd420d08ebd314a16dd0a6
SHA256c71096685ea347b65385f69e7623d58f433f0cbe30395fd9b9c947563ad21999
SHA51271ca0ad9c7a15e6edac4d8f96dfb56b749d989cf1d6c3283809d2842a5782e08a96b8d0db690af81b1a79c90fa1fc69260e7c4710725b2e1606b031bac9e0597
-
Filesize
6KB
MD5c85b30149587c5a12b71e6868f6eaf29
SHA190c7b418e4a6a3383aa341ec586d74a642015631
SHA25663a1c5b38f6ff34c3e3502b3fe45f5df807bd2c065cff53608f6a79872384e23
SHA512f9096e2106f6ba496818b3c9d22872380962da434b1de931e68cd7776a2bf41dce65efd2999c02d241da9a153e6d7cc04c4b587091b349f655beb721f9e2a7cd
-
Filesize
6KB
MD591f79b5fe1189b0f27dcce3b964daa3d
SHA18320b2e841bdd2c584ceded9544eb5c27fbd5851
SHA256c1398a911f3a24ae031b4dac144e2951c08a1a0df1f5f3f56474f410f38979ba
SHA5128a77d640777348957cd3f6a3fb339d8d9e3116f70e4cf4810af9ead1f09183200ce02bffa69ade77e4ec798e7fdbfc9c340b8c15591ca870cfa8c098702481b5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD577cd6b61360c4cdc3d0924f1adef6e7b
SHA1bc36a7259d85756c5e4a4fcd9fd5f93584bf3e34
SHA256d55cc011c1d457e5505023cf6c4152752c2c66bebed7aeb85f65ca0a715419a0
SHA512537112f80a510e12c5e2977d999be7848e328b46b35fec755fdc8fa1024f26c1e89f7f54dc3c6d3d54d22f49708a32ddab01d1f47ef893073a6fd79809a7fdb6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c2e2.TMP
Filesize48B
MD5a62fdeaab528599a0d0ea13c3fbdf78c
SHA1b59699161494a9f851a3c0b2af0026832e5768ae
SHA2563023563c04e9dc4e6b49f2034cbcab30e53a7dd5eadfac5128fecebe7af52d06
SHA5121f62c0849ee19212a7ffcfcb928c6f0f534f2cb2ee5197902e0da128c8a2e24b4965ba01f61243d68a8da06f3d184d52311611aa361ebd915b9d3a676092a73d
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5e3240bd165e9cc85cb335a249ea9f520
SHA1235f9a5f3f3b9273d1dd47ceb3172639680cb7e8
SHA25612a14e8fd7bfc3249fc142cceae5a6ada83272a4a11f5cc188c1c304a853a0a0
SHA51267ac96d7fb3f85aa1b8a070aee145e75d93f7a434d469258d9fcf228d7d93b0ae4cc4b1c1deb13901e7d53cf117f3828adbdf7a517bd02962653098617b27a03
-
Filesize
10KB
MD58e98d209ca97aae3be5d9de804e372eb
SHA12631fc86bf81bc17c55cc9aee15e21c3b7eff834
SHA256c67b222984b903170fa60dcdcc5eab2f508a5e74f2f87318e7fba827149c2d32
SHA512b1b10b08d9a7459b5a66aecb038d9d6ddb9906bcbb83df3261ab9c491e8b22648a48fdc5cb281fe0824083cec465bfac070cae5986e1b359c806bb4566d983be
-
Filesize
52B
MD5dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1ba515dc430c8634db4900a72e99d76135145d154
SHA256161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
SHA512c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d