Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe
-
Size
488KB
-
MD5
be72c0d39f337b92b8b2839dadafeb27
-
SHA1
f4e665b6ee5d54f1499be230a53169aacaac1969
-
SHA256
2232141d329267f88679decd77f3992b67862e751aa2deaa6585cf8116eddeda
-
SHA512
19df1dddc5b0305de37b249443fa43e89ed70bd42b70aa3f27740e7d2591a63bd9425a31a31ce7be836ffaa9f724f6c89cea4bfa5cc16c17a3f8d8cf30baf287
-
SSDEEP
12288:E2JylsKTUHPMrPEFMFn3jEFMFnPix1c60yaKmXHzSaoHuO:E2JyxgHPMrPEFMFn3jEFMFnzKmDSaoH
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1452 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys 3708 SOS.exe 3260 SOS.sys -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe" be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe" be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\SOS = "C:\\Windows\\SOS.exe" SOS.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SOS = "C:\\Windows\\SOS.exe" SOS.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened (read-only) \??\A: SOS.sys File opened (read-only) \??\B: SOS.sys File opened (read-only) \??\A: be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe SOS.sys File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\7-Zip\7z.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe SOS.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE SOS.sys File opened for modification C:\Program Files\Internet Explorer\iexplore.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe SOS.sys File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe SOS.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe SOS.sys File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe SOS.sys File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe SOS.sys File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe SOS.sys File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe SOS.sys File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe SOS.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe SOS.sys File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\7-Zip\7zFM.exe SOS.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe SOS.sys File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\SOS.tmp SOS.sys File opened for modification C:\Windows\SOS.tmp SOS.sys File created C:\Windows\SOS.exe be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe File created C:\Windows\SOS.sys SOS.exe File opened for modification C:\Windows\SOS.sys SOS.exe File created C:\Windows\SOS.exe SOS.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2 SOS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\WinX = "1" SOS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\legend of mir2\NowCount = "0" SOS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe 3708 SOS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4580 wrote to memory of 1452 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 93 PID 4580 wrote to memory of 1452 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 93 PID 4580 wrote to memory of 1452 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 93 PID 4580 wrote to memory of 3708 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 94 PID 4580 wrote to memory of 3708 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 94 PID 4580 wrote to memory of 3708 4580 be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe 94 PID 3708 wrote to memory of 3260 3708 SOS.exe 95 PID 3708 wrote to memory of 3260 3708 SOS.exe 95 PID 3708 wrote to memory of 3260 3708 SOS.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sysC:\Users\Admin\AppData\Local\Temp\be72c0d39f337b92b8b2839dadafeb27_JaffaCakes118.sys /zhj2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
PID:1452
-
-
C:\Windows\SOS.exeC:\Windows\SOS.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SOS.sysC:\Windows\SOS.sys /zhj3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3260
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD57ef657b550fff87b44d760e257f52f99
SHA1a3fe8cc7e2c2e7ad2583bc21e5e146a0b5b02805
SHA2560281f2be872589a8f82787455a30ed0fc2d2ba6bdf6c36f4e09076dfcaacd47e
SHA512d073cd5232abdce06230cfe3822c0a4334a59d8956220bfad3b397c2e1832c6e6a7373f4b39babd90e7fb3eab71e600fea062729c4a876c6f124ec0daa7f6a0f
-
Filesize
1.4MB
MD537699a910b34695709850895e068b202
SHA12101bc757b1864d81d5b442ae8faead6cc8fcc40
SHA256cef8ae968839a424a7563ceeaa756b5971d47c134f149c3f0c4d5efa38b50354
SHA512b55d507722b3d91e98e582a8cb18eee3c076b4d70970c2f3d8e3b492e0ccb82e461c913e5f6b8e702bde68f8731ed7f3097d60d73990456ba804f70a7d34a84e
-
Filesize
1.1MB
MD5989a0ec6f0b7201da0023c12ed98351a
SHA1df00bda8f4ec56087094eb6d44da5cb3c4a6a1a8
SHA256add5cb8e047a69295866508e7879c6edd58ad80994d78c3d3f5f6d8b9e975a23
SHA512a5af5db8a9c6d6e87fb16298f73c4a50a888260ec611d851d6af16812ddc6372ee942ddc64d91e867d1475536b7fdd9ec640f0dd076641996ce00972bc6f1a30
-
Filesize
502KB
MD53d8300ffbbbc8f0c3abc46883fa6ab78
SHA18566fc7a7d2f99622a8d6247bc384149337faecb
SHA256aa0749b576077d91df001fba54357bbdb936bbff4e08f837c94d2a770eaffc73
SHA512de271841f29e461f220414b30818bc66072a0f86bb13a02bf0e1e78925425e53f2c5412bc2969bd7a198ed62943ec4135c971aa64301fcc47d1629777b0d57dd
-
Filesize
4.8MB
MD5d62e55505895a35f33556ef239ae09be
SHA1c5432f4d6fd65c0806753bb41d88e05010714462
SHA256c5dc3f957c4cb7d5c2271e9bc445054ce3e7a48557c8061ee2f5e38b06c0f61f
SHA512dadf51663a980c7b98f18581993f8225e51254230e6ff5c7985d07d208b739b5f7755a5be6b8e4b9aaeb2c09e82b23b382ff982b85064eb3346fc465aa0ebf09
-
Filesize
2.1MB
MD5f619fb90777d52545da76808beef11da
SHA15955f7050fc5ccf2b1d2dd79ebab26d900133b92
SHA25646cf5a06e5c52dbb6c01699f765f503485844f12f92fc1da00e8a82e44227374
SHA512da5987e69f293179cc240f7e4c5c56ce90a5f3c4c5091760cc3dbf257208abb68fda728846eb8e69bfe5159bcf9f5902588458c9e76327e5df78b2e6f6df77a4
-
Filesize
1.7MB
MD511d4e55617e1cfc7ef3aa95a8653a3eb
SHA1a4e7d07c58a4bff69dd8cefe7ca3090dbc0e0411
SHA25689060ae52eb3e15075534f041525b8a465112c602d3d3c74da3fe682a7ec7d43
SHA512dec41424804373bb47b3ffe42046a530e54f8b7ad05d0ece751ebc094996b80de58ddb52579929ae785d93acfa0862ce9520ebb4bdfd326fdae05227602a70af
-
Filesize
1.5MB
MD5089808397d26fd7f1d67fdb9c0a9e416
SHA1c34d524ed897baeb84948ce6ec330edad1cb5402
SHA256a1483d486e2ee76698daa4749c56e1ed92d2cd4dfec0cedfe50a1c975d6ba297
SHA512039c9d9f78d12693ec2a290f19d5fa4ca5e0b067f92e5ee18ba558d1a90d4a666fff3e3f1abf2155424d1761a79d7ed604c02fc501fb15d1e107a0f96f46119d
-
Filesize
511KB
MD58270f87cd16fe955ac4783943c6a9d23
SHA1271b35217260e07b6da7379c72bcb88082b595c2
SHA2565d0fb47a80fe65bd37b51bbb7ade151b871b65c01791681dea05031195f43146
SHA512d6a5af0faac5d927d4e49f899684bf392fb9bcaba61f196d23788688cf7373c318ea42a97141503c78d51eb1ce610bb0089f32a238c4a8d62efae698777a2b30
-
Filesize
511KB
MD58747fc04840ce0119c257deee4012625
SHA199d59d52e2521e5d7f4b673a1bad985f9cf44c84
SHA256f1c2e70901265aa2450539998404ff559a2d75f655846f360e1cba0b47dc65d0
SHA512963d7ed4d9b1c5195baa2660c98eb56c95baea8727b3d0d0de0f41d2b6555beed43ccfdbef14f657c7dd4d414884b8063aa510559788a45a3d7b5a0b8431b31b
-
Filesize
511KB
MD549f4f1cbca24e52cdc4ec723855e3056
SHA16bb30106fbfc9a63cff8610a1f891d0c3c1fb8c2
SHA256914edb58089f7e7925ff68f1e044144f36b4357f8e9b801ade9ba8e87cf7ffd3
SHA512124a39b178b04eebaa8f4038b3f9456b40530766ad568abaf14e5bdaed9df4bc783bc1e7ad8de5df1a3418b039fa93a99eee187e914219bf2432f270399854ed
-
Filesize
511KB
MD5260db4c728aa2c399eaa6db613fcd29c
SHA170891e6eaeb7811f0ab8d03cb834ad29e6b741ab
SHA256dc7005d476638b05a4fbd8e3979d005414378031c0264da760ebe6aea191e5ad
SHA512880e70a1e458e476a1328e97e91813609c6b447bc39ed937b2d8482589ece672964133f12ae70449078a7dc5da7ab2f628b09f5f98fd33c8f949a40594790fed
-
Filesize
511KB
MD507af30f4c733549e5631433490015968
SHA15c4b83f2289c5d49335748a90ce6bcd4e2e63e38
SHA2561845f5fbf497db61237e426d44168df29a4c9d11ed26371db9755988cdfc312f
SHA512eaf8dd5c5b9f0a76fd35ac4dee143c3c34e734ea6b35eb93f350eba16b96bca98aea1418e38ecf7038c6b8c1cefb38362f6d870ef053f3d0ab1e59f26464292e
-
Filesize
511KB
MD59a840a6c5abb6a9018ae0567eb0399ce
SHA149069a58306a1e9edad7cf75f9cd1a30aa05bb1d
SHA256142dfe004b9a58f1adce8fafd5d6069bf4d303e4864607a9bb0787599a36784f
SHA51204fec6d91a74e11cd6b6a678658fb6b478de15f5cf19143decff5212be1a97ba1042cb8cca983651810c10ab8605d78dec425087cb0120d9f80775a0364c5a5d
-
Filesize
511KB
MD5d36054f1d47850105c899d4a5d2e7817
SHA133b52eac323935a22b3999b4e1fe084acc0c4520
SHA2564cb664599fb404d97d4b9b35b3df82fabe724ad91eaa097f7a0544702eb4ca5f
SHA51228cc1d4bc110de208f68d9829d80c3adebdf4389927c8473b519e4b9b8662b57554f33101000909978d4cd082a6dc5a71f7c1af12b882d617aee507baf44fb4e
-
Filesize
511KB
MD5d2fef46a639254dbf6859ce47f9dd668
SHA1f00eb967aef50bc46058ac42e7aee84cbe721921
SHA256a6cbe4d414bfc3cdfcbf01ccd433ede39e3b3941c203d505d76b5159c02f1818
SHA5129b6163568036abb26823a5aac8dc1cf14257e4a09d045562816b4ae2d7c74601378f9c83557bb844e6b28308312ba42ff0f710ab52feb27c9c506e4c1792b4d2
-
Filesize
976KB
MD54f63656cdc0e15b0ed3dae637d72d229
SHA13fd1654df2b3215d199404eb9f195180ef2f93f0
SHA2569b8619fbbf4384c6cec2ee8a8731797e43e6b6c61ce21414856ec01233157ea1
SHA5126fbd85d13b19e3d92d49416f0f972dd87eb5d90f39377e61da601d5b05e275399efe29b1c0c08e7cb72d3447ae1be0f48cb454aa9be634330bb3ffb5c7f185f0
-
Filesize
488KB
MD5be72c0d39f337b92b8b2839dadafeb27
SHA1f4e665b6ee5d54f1499be230a53169aacaac1969
SHA2562232141d329267f88679decd77f3992b67862e751aa2deaa6585cf8116eddeda
SHA51219df1dddc5b0305de37b249443fa43e89ed70bd42b70aa3f27740e7d2591a63bd9425a31a31ce7be836ffaa9f724f6c89cea4bfa5cc16c17a3f8d8cf30baf287