Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
431d52eecffee9238010f5479a45da01_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
431d52eecffee9238010f5479a45da01
-
SHA1
5fd9ed8d94df62381dd76077fade0f201490387b
-
SHA256
dd7cbd59edd300dae05075e96dadc574728ce900bda00ce0131ab7bff4117a38
-
SHA512
09a9d4a8886d135a320132d090115e48f5060bac53210e4f327102ba6564c45e92f5aacb976fc685b67e2c76249b639f5dece3076d9e8d58de5e1264a5eecda3
-
SSDEEP
49152:/I0Dszc4WyPoBJFEswLXDnZh/klmMoXLuejK:/hszGJF76T//klA79jK
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\Drivers\etc\hosts 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1864 msedge.exe 1864 msedge.exe 1660 msedge.exe 1660 msedge.exe 4064 identity_helper.exe 4064 identity_helper.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe 4808 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe 1660 msedge.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 528 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 87 PID 4512 wrote to memory of 528 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 87 PID 4512 wrote to memory of 528 4512 431d52eecffee9238010f5479a45da01_JaffaCakes118.exe 87 PID 2196 wrote to memory of 1660 2196 explorer.exe 89 PID 2196 wrote to memory of 1660 2196 explorer.exe 89 PID 1660 wrote to memory of 4204 1660 msedge.exe 91 PID 1660 wrote to memory of 4204 1660 msedge.exe 91 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1584 1660 msedge.exe 92 PID 1660 wrote to memory of 1864 1660 msedge.exe 93 PID 1660 wrote to memory of 1864 1660 msedge.exe 93 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94 PID 1660 wrote to memory of 2252 1660 msedge.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\431d52eecffee9238010f5479a45da01_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\431d52eecffee9238010f5479a45da01_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" http://www.sf9.com2⤵
- System Location Discovery: System Language Discovery
PID:528
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sf9.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff915c446f8,0x7ff915c44708,0x7ff915c447183⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:23⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:83⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:83⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:13⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:13⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:13⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:13⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:13⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:13⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:13⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:13⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11050948584012576420,11192270093714531594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5488 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4808
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
6KB
MD5122a5ab69428aa9221841f8c1849beb0
SHA161c0ef3a717cdb63705ca078bba9b9c3597cc5ae
SHA2569e3ed4835dd78b691b163874f162740f56d2c02890dbf2a5428cc4c61e0e5739
SHA512f65384581d00ee165245a29476b1318d07bb7907c902feb0456cb956ff45470b030f760a7ef19f7016e3c980f684580da47b2293177d1e8b3532de2dcb6c8b3b
-
Filesize
6KB
MD560b9050985de3415db3f7e30feef845a
SHA156dc273186ff26322e60c5f48c699d04ce534722
SHA25671f52f83f86f2cbe252c17d2a98fb165bced85ec62aae598f3f91c6756eb78dc
SHA5124d25275e2ce222d131a04eb89650b7f42c211146771656ca2aac0e31cf389916c634e5c93c035fec1af856cd3800d0504bcc31732b3b213aa2a6f8190e7a04ec
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5b706ae69b23eb2688fa9f64dab0a359d
SHA1133741c2af23c2a4364f8284289f6c9d9ce3af1b
SHA256d0cb845b4e21505340f9ca5f2519d6cd24e93c0c8fd0f0c727fb48b01744a601
SHA512c05b02f0235d4d81f0c0486c4649c5f592420faf735ef4090f288add3c210f9749cda401030de1ae3e238270e0a4a5253892aab15dc25d19f58cc0d65e61a48e