Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 23:06
Static task
static1
Behavioral task
behavioral1
Sample
449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
449fa0a171a7362504184fd4adf63feb
-
SHA1
9c60c01056e1ebab238d8b445179967858c64c63
-
SHA256
9dcb53352730371b688998699f6ee248ce732ba7ab31fc0fbeed5ad75af43173
-
SHA512
1718bc873cbe5a42456e666fe66efafdb024136d1004ae72577ac42dc0058f224e2eb33061b1956d45b9d6ffc05f8ba990b3171ff558284dedaf28c8242a3be9
-
SSDEEP
24576:frJKUK/juqkncxnfS//2oYP+ENxuIW/Rjl/lVlP64htKQtsVELVDiicYQRebMyHz:f1Kb/juqgcxfSE+HIuRjl/lVlP64htKB
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3112 crp950D.exe 1588 hpet.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json hpet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crp950D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpet.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 1588 hpet.exe 2172 msedge.exe 2172 msedge.exe 960 msedge.exe 960 msedge.exe 4628 identity_helper.exe 4628 identity_helper.exe 4604 msedge.exe 4604 msedge.exe 4604 msedge.exe 4604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 3112 crp950D.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 3112 crp950D.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 3112 crp950D.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe 3112 crp950D.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3112 crp950D.exe 3112 crp950D.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3112 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 92 PID 1680 wrote to memory of 3112 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 92 PID 1680 wrote to memory of 3112 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 92 PID 1680 wrote to memory of 1588 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 93 PID 1680 wrote to memory of 1588 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 93 PID 1680 wrote to memory of 1588 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 93 PID 1680 wrote to memory of 960 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 96 PID 1680 wrote to memory of 960 1680 449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe 96 PID 960 wrote to memory of 3176 960 msedge.exe 97 PID 960 wrote to memory of 3176 960 msedge.exe 97 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 3460 960 msedge.exe 98 PID 960 wrote to memory of 2172 960 msedge.exe 99 PID 960 wrote to memory of 2172 960 msedge.exe 99 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100 PID 960 wrote to memory of 704 960 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\449fa0a171a7362504184fd4adf63feb_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\crp950D.exe/S /notray2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe-home -home2 -hie -hff -hgc -spff -et -channel 1623412⤵
- Executes dropped EXE
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/file/9q0PlJOb/Finder-CWM.html?ref=downloadhelpererror2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe57b046f8,0x7ffe57b04708,0x7ffe57b047183⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:23⤵PID:3460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:83⤵PID:704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:13⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:13⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:83⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:13⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:13⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:13⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:13⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10837960163318268498,8193988096386574143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3228 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2796
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3476
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD536988ca14952e1848e81a959880ea217
SHA1a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
-
Filesize
152B
MD5fab8d8d865e33fe195732aa7dcb91c30
SHA12637e832f38acc70af3e511f5eba80fbd7461f2c
SHA2561b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA51239a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
-
Filesize
6KB
MD580e133039508bae13bbeae7675cb3791
SHA128a0c2a6d9d9bed6e4f8f73001587bff6454e8f6
SHA256f9d103e665a609e8842ccf9628c655a69da96a46cd5374ae580349b5fd2f54a7
SHA5120bb418ec3ab70b61fda32c787984e90b9fc1dc66914940027699b1d2e80c98376685707586f7b414668e4e3b47580dc7f96dde4380ba10a558f5e5ff20746612
-
Filesize
6KB
MD55c5c49b551eb6babb317042977e6985d
SHA13fac9a9958889ce898ed996a96bae7ee8ac37497
SHA2568a7bd04e44df5b30701c32306ea9e383671826bfeaf9cfdfe7f8298824d4b350
SHA51293a85b5b59dc1fcf644acc56a5dffe1f5cead3c090f379e2f4ee042a9ddb249e86e54fa99b36819447530678b4c5f9db05473adfab29961abfb5cfaac5648894
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD583defeac3f43aa306ba2a65fc7e5a373
SHA1452dd53e704cde96aac7414602c09c18d453ef14
SHA2569ccb3035c42306c678b04d38b94958649539b6a88bffa3774f952433a8c57887
SHA5121d3f5fceb804c1e711835553366b2d48dd2da87194a0f44070d9944d7abe2cbdd8f705d35e63019a5365517a5740069f801df904ad215b32b77ddaec73658e45
-
Filesize
806KB
MD5661cf9c90eb099fb7b6a394dd8cde2e4
SHA13704e119ea16a3c336f63dc808176a22fbb8582a
SHA2561570e0efe0cb98623913d942cf40f2eb5b10458f49842097125c6d6d8604cd07
SHA51213c26a514c2022a10b42566a527ef98adaaa9932ffd07612ccdeb371888c037be3b429c956ecb7705699a2b6e3463758735332c9e26ea5f4493a91f30dfb4761
-
Filesize
331KB
MD5a3e93460c26e27a69594dc44eb58e678
SHA1a615a8a12aa4e01c2197f4f0d78605a75979a048
SHA2563a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6
SHA51239d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530