Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/12/2024, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe
-
Size
2.4MB
-
MD5
3fdb5d37254e426ea06376c5eb9a6b26
-
SHA1
43e93f996e693e4790bbf1b2e52d2eb8e5d22588
-
SHA256
ffd7db062fcfa687fb861868966a89742ce1600765fa5cbeeab3a88738b3de09
-
SHA512
8753aa5b1b98c2589bd11e7bdf5f1fd3bd627e412c21f4d4c3204ed3f519361b9f57d0642118efa3147a054917b6ba0d744c830172c1022b88e53e8520462834
-
SSDEEP
49152:26uE7ASqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW31qm:sE7AtrlyutLxC3sEwwM3Um
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023c0f-1.dat floxif -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023c0f-1.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe -
Executes dropped EXE 2 IoCs
pid Process 4916 minidownload.exe 700 SogouSoftware.exe -
Loads dropped DLL 5 IoCs
pid Process 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 4916 minidownload.exe 700 SogouSoftware.exe 700 SogouSoftware.exe 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe -
pid Process 4152 arp.exe 920 arp.exe 4772 arp.exe 2484 arp.exe 1028 arp.exe 2084 arp.exe 4672 arp.exe 2644 arp.exe 4468 arp.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File opened for modification \??\PhysicalDrive0 SogouSoftware.exe -
resource yara_rule behavioral2/memory/244-4-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/files/0x000a000000023c0f-1.dat upx behavioral2/memory/4916-20-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/4916-64-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/700-76-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/244-91-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/244-94-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/244-99-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/700-101-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral2/memory/700-111-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Drops file in Program Files directory 46 IoCs
description ioc Process File created C:\Program Files (x86)\SogouSoftware\crash\.svn\text-base\ExceptionReport.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\ThunderFW.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\dl_peer_id.dll.svn-base minidownload.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File created C:\Program Files (x86)\SogouSoftware\crash\.svn\all-wcprops minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\atl71.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\dl_peer_id.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\msvcp71.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\atl71.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\zlib1.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dll.tmp 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File created C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\MiniTPFw.exe minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\entries minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\id.dat.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\crash\.svn\entries minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\msvcr71.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\zlib1.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\all-wcprops minidownload.exe File opened for modification C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dll.dat 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File created C:\Program Files (x86)\SogouSoftware\download\download\id.dat minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\MiniThunderPlatform.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\msvcr71.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\MiniThunderPlatform.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\MiniThunderPlatform.exe minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\format minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\download_engine.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\ThunderFW.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\download_engine.dll.svn-base minidownload.exe File opened for modification C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dll 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File created C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\xldl.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\MiniTPFw.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\dl_peer_id.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\msvcp71.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\crash\.svn\prop-base\ExceptionReport.exe.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\crash\ExceptionReport.exe minidownload.exe File created C:\Program Files (x86)\SogouSoftware\crash\.svn\format minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\ThunderFW.exe minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\download_engine.dll minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\atl71.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\zlib1.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\MiniTPFw.exe.svn-base minidownload.exe File created C:\Program Files\Common Files\System\symsrv.dll 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\msvcr71.dll.svn-base minidownload.exe File created C:\Program Files (x86)\SogouSoftware\download\download\.svn\text-base\msvcp71.dll.svn-base minidownload.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language minidownload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SogouSoftware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023cb5-11.dat nsis_installer_1 behavioral2/files/0x0007000000023cb5-11.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe Token: SeDebugPrivilege 4916 minidownload.exe Token: SeDebugPrivilege 700 SogouSoftware.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 244 wrote to memory of 4152 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 82 PID 244 wrote to memory of 4152 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 82 PID 244 wrote to memory of 4152 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 82 PID 244 wrote to memory of 2084 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 84 PID 244 wrote to memory of 2084 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 84 PID 244 wrote to memory of 2084 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 84 PID 244 wrote to memory of 1028 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 85 PID 244 wrote to memory of 1028 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 85 PID 244 wrote to memory of 1028 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 85 PID 244 wrote to memory of 2484 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 86 PID 244 wrote to memory of 2484 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 86 PID 244 wrote to memory of 2484 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 86 PID 244 wrote to memory of 4772 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 87 PID 244 wrote to memory of 4772 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 87 PID 244 wrote to memory of 4772 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 87 PID 244 wrote to memory of 4468 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 88 PID 244 wrote to memory of 4468 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 88 PID 244 wrote to memory of 4468 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 88 PID 244 wrote to memory of 920 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 89 PID 244 wrote to memory of 920 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 89 PID 244 wrote to memory of 920 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 89 PID 244 wrote to memory of 2644 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 91 PID 244 wrote to memory of 2644 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 91 PID 244 wrote to memory of 2644 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 91 PID 244 wrote to memory of 4672 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 92 PID 244 wrote to memory of 4672 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 92 PID 244 wrote to memory of 4672 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 92 PID 244 wrote to memory of 4916 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 100 PID 244 wrote to memory of 4916 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 100 PID 244 wrote to memory of 4916 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 100 PID 244 wrote to memory of 700 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 102 PID 244 wrote to memory of 700 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 102 PID 244 wrote to memory of 700 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 102 PID 244 wrote to memory of 2132 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 103 PID 244 wrote to memory of 2132 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 103 PID 244 wrote to memory of 2132 244 2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-21_3fdb5d37254e426ea06376c5eb9a6b26_floxif_mafia.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4152
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 cd-a6-63-16-12-3b2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 17-58-a7-df-64-322⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1028
-
-
C:\Windows\SysWOW64\arp.exearp -s 37.27.61.180 72-92-3a-ba-69-932⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 d7-41-b6-25-bb-cd2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4772
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 94-3f-83-36-07-a32⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4468
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 f9-3c-af-24-0b-ad2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:920
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 e5-6c-38-07-d3-c42⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2644
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 d6-fc-ba-1c-79-eb2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\minidownload.exe"C:\Users\Admin\AppData\Local\Temp\minidownload.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe" /Loader /DownLoad?status=true&softurl=https%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3DG30HdQ8G4ngDpbEHfW1gEXYhwD6lzpDc8HlTAHx7scbrxDthotkHK0HexvlOWvJbJd76eqnPU0MQPeaLH3gS2w..%26pcid%3D-2241203717467645359%26fr%3Dxiazai%26source%3Dxixi%26filename%3Dpdfwjt.zip&iconurl=https%3A%2F%2Fpic.cr173.com%2Fup%2F2014-4%2F201449152326.jpg&softname=PDF%E8%BD%AC%E6%8D%A2%E9%80%9A&softsize=19.05MB2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- System Location Discovery: System Language Discovery
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1AppInit DLLs
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD50bc2d003fcfe3fa65f4c3ba7a015fa41
SHA172ed85bc1c57259b4f2ed36d16ce3fed4e30607c
SHA256388069590fb9569b6c498f941d0565416cb52fc803648ee21b8c59917c63eb4b
SHA512ae8d83e6ca21ee9b0d5e5845fac3a4dc01c6038243da36b4360b2f42763478265cdafc89072c47672b9738de1930e5e5191e2bf91715055cbd16a949d313ff24
-
Filesize
450KB
MD5b1ce2dba9515e144908aa34ac77f5a46
SHA10a3e601eeba273a16d815c5e59793eb73db9daad
SHA2565a7349e46f16ec394af8575b666c132c010bacaa2c59da472b842ffeccc5623f
SHA512d0a78b5de9126b8126b531fb8f72ae375aac898930dccd8a61f173c28470895daab56b368c34a5925020dfdc642785651445967904d8756bb1ce7c1d2f95525a
-
Filesize
531KB
MD51eefcf39330f1f3c2a85a8e567db3250
SHA1230be6cba3d89a3b49f2068b6b8a569f7c64180f
SHA2567192cb6e287f6fe8fd37c8727b0ca82f3243e986d689e9fc1a5516b8d97d1159
SHA5128bfe0aad7c87fc5efa47951a78b5d3186b98f037f997f15e8c795b5336e3c01d279c7c79b1534216f2cd359686472541907bd65db793dc49ec019364350621ac
-
Filesize
53B
MD5113136892f2137aa0116093a524ade0b
SHA1a0284943f8ddfe69ceec90833e66d96bdf4a97f0
SHA256ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02
SHA512d3201cc19ae702a9813aa8bc39612ebaa48138903e9ede64dcadff213691f6e711876aa4fa083887c545325d5d8bf70649523c528090542459f2b01697180e99
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e
-
Filesize
1.9MB
MD50618e9851ea4a522abeded8d40c2f19e
SHA1c6772967fdf545e32d28f3b46e97aec5b9ff99f5
SHA256506c374fbdf14420306e2da8d123c2138c2ceabd2046178317508a25949d3dc4
SHA512b8c4816d81aa14646a3b690da76c0d33f59b7d419305638747503dba6bb84a63b906fe7d0ced59850ad25db37c1e0e6f3bd614a902f2f5ffb3d2bf74ec4e571f