Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2025, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe
-
Size
431KB
-
MD5
fa0875613ba59041df0416e786cd91c7
-
SHA1
5d95a99ebe5e1fa3f8f4634561f42e73080e0428
-
SHA256
c02a39afdc5f43b1bc9a10b7b2a87051d77f6e938e830b94b8b8c25e61795672
-
SHA512
ebc54959db28d8a6a429322ad122e7e45a6d50441a78d7ab339941440236f0c35b569a262eef4b638f895bcf6ef8c35ff811b4a146698aa1aaf4bcf0c75a7d03
-
SSDEEP
6144:DRemMrliCiP73FDrSsXe8BoLa3Zyr0Xi2VYWFuOWXYZIMElkw4+0D:8HliCG71CsXnd3qCJFu5XYZSPJ4
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 13 IoCs
resource yara_rule behavioral2/memory/4408-25-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-30-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-51-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-52-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-54-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-55-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-56-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-58-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-59-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-61-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-65-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-66-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades behavioral2/memory/4408-69-0x0000000000400000-0x000000000045A000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bswm.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bswm.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 54 760 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe -
Executes dropped EXE 3 IoCs
pid Process 1964 bsdone.exe 3640 pirate.exe 4408 explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalware = "C:\\Users\\Admin\\AppData\\Roaming\\bsdone.exe" bsdone.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1964 set thread context of 4408 1964 bsdone.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bsdone.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pirate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1104 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1318997816-2171176372-1451785247-1000\{3E0F848D-59D4-4C9D-BE54-3C7CEB58157F} svchost.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1896 reg.exe 3104 reg.exe 1232 reg.exe 940 reg.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: 33 2536 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2536 AUDIODG.EXE Token: 1 4408 explorer.exe Token: SeCreateTokenPrivilege 4408 explorer.exe Token: SeAssignPrimaryTokenPrivilege 4408 explorer.exe Token: SeLockMemoryPrivilege 4408 explorer.exe Token: SeIncreaseQuotaPrivilege 4408 explorer.exe Token: SeMachineAccountPrivilege 4408 explorer.exe Token: SeTcbPrivilege 4408 explorer.exe Token: SeSecurityPrivilege 4408 explorer.exe Token: SeTakeOwnershipPrivilege 4408 explorer.exe Token: SeLoadDriverPrivilege 4408 explorer.exe Token: SeSystemProfilePrivilege 4408 explorer.exe Token: SeSystemtimePrivilege 4408 explorer.exe Token: SeProfSingleProcessPrivilege 4408 explorer.exe Token: SeIncBasePriorityPrivilege 4408 explorer.exe Token: SeCreatePagefilePrivilege 4408 explorer.exe Token: SeCreatePermanentPrivilege 4408 explorer.exe Token: SeBackupPrivilege 4408 explorer.exe Token: SeRestorePrivilege 4408 explorer.exe Token: SeShutdownPrivilege 4408 explorer.exe Token: SeDebugPrivilege 4408 explorer.exe Token: SeAuditPrivilege 4408 explorer.exe Token: SeSystemEnvironmentPrivilege 4408 explorer.exe Token: SeChangeNotifyPrivilege 4408 explorer.exe Token: SeRemoteShutdownPrivilege 4408 explorer.exe Token: SeUndockPrivilege 4408 explorer.exe Token: SeSyncAgentPrivilege 4408 explorer.exe Token: SeEnableDelegationPrivilege 4408 explorer.exe Token: SeManageVolumePrivilege 4408 explorer.exe Token: SeImpersonatePrivilege 4408 explorer.exe Token: SeCreateGlobalPrivilege 4408 explorer.exe Token: 31 4408 explorer.exe Token: 32 4408 explorer.exe Token: 33 4408 explorer.exe Token: 34 4408 explorer.exe Token: 35 4408 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4408 explorer.exe 4408 explorer.exe 4408 explorer.exe 1392 OpenWith.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1964 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 90 PID 2884 wrote to memory of 1964 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 90 PID 2884 wrote to memory of 1964 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 90 PID 2884 wrote to memory of 3640 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 91 PID 2884 wrote to memory of 3640 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 91 PID 2884 wrote to memory of 3640 2884 JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe 91 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 1964 wrote to memory of 4408 1964 bsdone.exe 93 PID 4408 wrote to memory of 420 4408 explorer.exe 94 PID 4408 wrote to memory of 420 4408 explorer.exe 94 PID 4408 wrote to memory of 420 4408 explorer.exe 94 PID 4408 wrote to memory of 4016 4408 explorer.exe 95 PID 4408 wrote to memory of 4016 4408 explorer.exe 95 PID 4408 wrote to memory of 4016 4408 explorer.exe 95 PID 4408 wrote to memory of 1932 4408 explorer.exe 96 PID 4408 wrote to memory of 1932 4408 explorer.exe 96 PID 4408 wrote to memory of 1932 4408 explorer.exe 96 PID 4408 wrote to memory of 4940 4408 explorer.exe 97 PID 4408 wrote to memory of 4940 4408 explorer.exe 97 PID 4408 wrote to memory of 4940 4408 explorer.exe 97 PID 420 wrote to memory of 3104 420 cmd.exe 103 PID 420 wrote to memory of 3104 420 cmd.exe 103 PID 420 wrote to memory of 3104 420 cmd.exe 103 PID 1932 wrote to memory of 1896 1932 cmd.exe 104 PID 1932 wrote to memory of 1896 1932 cmd.exe 104 PID 1932 wrote to memory of 1896 1932 cmd.exe 104 PID 4016 wrote to memory of 1232 4016 cmd.exe 105 PID 4016 wrote to memory of 1232 4016 cmd.exe 105 PID 4016 wrote to memory of 1232 4016 cmd.exe 105 PID 4940 wrote to memory of 940 4940 cmd.exe 106 PID 4940 wrote to memory of 940 4940 cmd.exe 106 PID 4940 wrote to memory of 940 4940 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fa0875613ba59041df0416e786cd91c7.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\bsdone.exe"C:\Users\Admin\AppData\Local\Temp\bsdone.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Roaming\explorer.exeC:\Users\Admin\AppData\Roaming\explorer.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bswm.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bswm.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bswm.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bswm.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:940
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pirate.exe"C:\Users\Admin\AppData\Local\Temp\pirate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c0 0x3381⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3088
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NjdGRjREQUQtOTdFNC00NEE0LTk4OTUtMEVFREQzQTU3RDhBfSIgdXNlcmlkPSJ7RkNCMkNBMDctNDJDOC00NTdDLTkxQzktMEM1MkY2NUVGNjE5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MkM5QzIyRUItQUYxMi00QzQ4LTk3M0MtRDhEOTQ0RDhBMDk4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mzc0Mjk0MjEzIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1104
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
466KB
MD58383f44534f16f7951b0a485006ed7c0
SHA1e15b9dd6432ebc8a005622697e295aa6551811b9
SHA2565dc18afaa4d54d02f53e2f26cecb7c25133a34567882884bdc4ef9ed5156a21a
SHA51256752380a0fad49f916de3ad59ae0a8f0395592ce745742f67d4c33904538c9beaad0bba0e69852776c45c7fea00ad0f80d60a9d4d782bfcc22d3330f5c259dd
-
Filesize
215KB
MD55fa762608ab11c579fb0c373ea6f3f5c
SHA19324cd2813b01d19051e18fcbdb5aad17d152ece
SHA2566b14a44674acd8e1062736dff4199e3cd8647dd5f45f108f8c5a07a43eeb3129
SHA512f5edb631b49fdb366a34b9e6cf590571464db39eaa91c9bb151c2275ab8a4f05732d39ec1171e66d8adc4df6a4e8a00fb8497d78a037b17e5f44516f04e1f6bf
-
Filesize
1KB
MD5bd1829843641d264c9ef57ee175a68ae
SHA1298cdbc7f30583f964a6533bf62fb7aff501aa52
SHA25687cff8f9ae3660c6ff6fc7d6262c61b7c19b2271ae9a95abe7b9d744d386259c
SHA5126165d8d47c2e32407c0888b28989ae293f592c4e4771e43d8d09d303e3ad73f895f1c852a176677b3fbd78449536579570cac67a17b2e9135774236b159b2827
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c