Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 12:36
Static task
static1
Behavioral task
behavioral1
Sample
6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe
-
Size
5.8MB
-
MD5
6e8b7dd81153ebc916967cd6c85334d3
-
SHA1
5e45f2ee1227b32d7e2bf48232810ea2bfb7f0c0
-
SHA256
0a0b6b4e25df3afae5bf65f6a227eda5ae9c7b6b959cb94c5d171b2ed2fead4d
-
SHA512
1890af3fb52f75ffc807b53db80e88c8c39089f028948b6bdf3da6af21479d48c5378ac18e0d5d1eef9c299d0f78a380f0036db3548b3da0ff991c583024dfaf
-
SSDEEP
98304:U2wc10DlRAGQz/bgNzRSq+S8Y0TXcSfkaFMOoPKhh3DunjgQYXGt//S:U2LGQz/bgNzRSNysXcSfkOM6hhzunENJ
Malware Config
Signatures
-
Blocks application from running via registry modification 5 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "powershell.exe" SMΔRTP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "bitsadmin.exe" SMΔRTP.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" SMΔRTP.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun SMΔRTP.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "Mshta.exe" SMΔRTP.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation Smadav1350-Update.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation SMΔRTP.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe -
Executes dropped EXE 5 IoCs
pid Process 1688 Smadav1350-Update.exe 2280 SMΔRTP.exe 4780 SmadavProtect64.exe 3008 Process not Found 2864 Process not Found -
Loads dropped DLL 7 IoCs
pid Process 1688 Smadav1350-Update.exe 2280 SMΔRTP.exe 4780 SmadavProtect64.exe 3440 Process not Found 832 Process not Found 448 regsvr32.exe 464 regsvr32.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\Smadav\\SmadExtc64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMΔRT-Protection = "C:\\Program Files (x86)\\Smadav\\SMΔRTP.exe rts" SMΔRTP.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: SMΔRTP.exe File opened (read-only) \??\Q: SMΔRTP.exe File opened (read-only) \??\T: SMΔRTP.exe File opened (read-only) \??\Q: Smadav1350-Update.exe File opened (read-only) \??\T: Smadav1350-Update.exe File opened (read-only) \??\U: Smadav1350-Update.exe File opened (read-only) \??\Z: Smadav1350-Update.exe File opened (read-only) \??\E: SMΔRTP.exe File opened (read-only) \??\Y: Smadav1350-Update.exe File opened (read-only) \??\M: SMΔRTP.exe File opened (read-only) \??\N: SMΔRTP.exe File opened (read-only) \??\O: SMΔRTP.exe File opened (read-only) \??\W: SMΔRTP.exe File opened (read-only) \??\Y: SMΔRTP.exe File opened (read-only) \??\Z: SMΔRTP.exe File opened (read-only) \??\B: Smadav1350-Update.exe File opened (read-only) \??\G: Smadav1350-Update.exe File opened (read-only) \??\I: Smadav1350-Update.exe File opened (read-only) \??\A: SMΔRTP.exe File opened (read-only) \??\U: SMΔRTP.exe File opened (read-only) \??\P: SMΔRTP.exe File opened (read-only) \??\R: SMΔRTP.exe File opened (read-only) \??\S: SMΔRTP.exe File opened (read-only) \??\K: Smadav1350-Update.exe File opened (read-only) \??\N: Smadav1350-Update.exe File opened (read-only) \??\V: Smadav1350-Update.exe File opened (read-only) \??\G: SMΔRTP.exe File opened (read-only) \??\K: SMΔRTP.exe File opened (read-only) \??\H: Smadav1350-Update.exe File opened (read-only) \??\P: Smadav1350-Update.exe File opened (read-only) \??\J: SMΔRTP.exe File opened (read-only) \??\M: Smadav1350-Update.exe File opened (read-only) \??\O: Smadav1350-Update.exe File opened (read-only) \??\R: Smadav1350-Update.exe File opened (read-only) \??\L: SMΔRTP.exe File opened (read-only) \??\J: Smadav1350-Update.exe File opened (read-only) \??\L: Smadav1350-Update.exe File opened (read-only) \??\B: SMΔRTP.exe File opened (read-only) \??\X: SMΔRTP.exe File opened (read-only) \??\H: SMΔRTP.exe File opened (read-only) \??\V: SMΔRTP.exe File opened (read-only) \??\A: Smadav1350-Update.exe File opened (read-only) \??\E: Smadav1350-Update.exe File opened (read-only) \??\S: Smadav1350-Update.exe File opened (read-only) \??\W: Smadav1350-Update.exe File opened (read-only) \??\X: Smadav1350-Update.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe SMΔRTP.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe SMΔRTP.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe SMΔRTP.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe SMΔRTP.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Smadav\SmadEngine.dll Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\Smadav.loov Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadExtMenu64.dll Smadav1350-Update.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe SMΔRTP.exe File created C:\Program Files (x86)\Smadav\SMΔRTP.exe Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadEngine.dll Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadExtMenu.dll Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadavHelper.exe Smadav1350-Update.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe SMΔRTP.exe File created C:\Program Files (x86)\Smadav\Readme.txt Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\Smadav-Updater.exe Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadavProtect32.exe Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadavProtect64.exe Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadHook32c.dll Smadav1350-Update.exe File created C:\Program Files (x86)\Smadav\SmadHook64c.dll Smadav1350-Update.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\sysmon.exe SMΔRTP.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe SMΔRTP.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe SMΔRTP.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe SMΔRTP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1880 schtasks.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ = "C:\\Program Files (x86)\\Smadav\\SmadExtc64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmadExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SmadExt\ = "{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\ = "SmadExt Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8AB81E72-CB2F-11D3-8D3B-AC2F34F1FA3C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 Smadav1350-Update.exe 1688 Smadav1350-Update.exe 1688 Smadav1350-Update.exe 1688 Smadav1350-Update.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1688 Smadav1350-Update.exe Token: SeDebugPrivilege 1688 Smadav1350-Update.exe Token: SeShutdownPrivilege 2280 SMΔRTP.exe Token: SeDebugPrivilege 2280 SMΔRTP.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1688 Smadav1350-Update.exe 2280 SMΔRTP.exe 2280 SMΔRTP.exe 4780 SmadavProtect64.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 448 wrote to memory of 1688 448 6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe 82 PID 448 wrote to memory of 1688 448 6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe 82 PID 448 wrote to memory of 1688 448 6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe 82 PID 1688 wrote to memory of 2280 1688 Smadav1350-Update.exe 85 PID 1688 wrote to memory of 2280 1688 Smadav1350-Update.exe 85 PID 1688 wrote to memory of 2280 1688 Smadav1350-Update.exe 85 PID 2280 wrote to memory of 1880 2280 SMΔRTP.exe 87 PID 2280 wrote to memory of 1880 2280 SMΔRTP.exe 87 PID 2280 wrote to memory of 1880 2280 SMΔRTP.exe 87 PID 2280 wrote to memory of 4780 2280 SMΔRTP.exe 98 PID 2280 wrote to memory of 4780 2280 SMΔRTP.exe 98 PID 2280 wrote to memory of 448 2280 SMΔRTP.exe 102 PID 2280 wrote to memory of 448 2280 SMΔRTP.exe 102 PID 2280 wrote to memory of 448 2280 SMΔRTP.exe 102 PID 448 wrote to memory of 464 448 regsvr32.exe 103 PID 448 wrote to memory of 464 448 regsvr32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6e8b7dd81153ebc916967cd6c85334d3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Roaming\Smadav\Update1350\Smadav1350-Update.exe"C:\Users\Admin\AppData\Roaming\Smadav\Update1350\Smadav1350-Update.exe" slt2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Smadav\SMΔRTP.exe"C:\Program Files (x86)\Smadav\SMΔRTP.exe" rtc3⤵
- Blocks application from running via registry modification
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\Admin\AppData\Roaming\Smadav\smadav.xml"4⤵
- Creates scheduled task(s)
PID:1880
-
-
C:\Program Files (x86)\Smadav\SmadavProtect64.exe"C:\Program Files (x86)\Smadav\SmadavProtect64.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4780
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Smadav\SmadExtc64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Smadav\SmadExtc64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:464
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5fc0039902c200e248d91a29f7284ce27
SHA1cac93ff81a3f74fc835e314b3491e97dba55ae66
SHA256642029c8be51ee7be9434aff393ddd0c2d5f5eca987b4ef74fb6d2fd454de309
SHA5123cd0d057a83c10faab37a0373959b9baf7b1d4faaf995a39e241cb8494488ad72a934a9cabba689d4cf9b0adeccc08b74ca4bc8b8bf102e9fe87f250c1243e9c
-
Filesize
2.0MB
MD5261e5c68c36dfa0117ece262a930c491
SHA15224b3a1c3f35664cf2b375e6d05f465c1282dbf
SHA25620056e4d321b46b95c683b4e2c1c4c640808ec12c279c9a926c3940d57a819ab
SHA512dc7a29a842a0b7af16b65ce25d1e3a225f5d78ef011e9d26a7d89419ca2bb2630132f96d3e431cec2d6ec1da7d7f58b00af1dea2e3997fc8b09ee0b4d368d60a
-
Filesize
102KB
MD58664c342e54226b9310f36bedf1fd3f3
SHA17c2b98ea13483869cc14749a9764c519b2ededdc
SHA256f645315156626921e177c32a52bc130d62050be2d8f0e9a400a85ef8dd79fb70
SHA512c64e0fea71a67da52e3fa397af50b69217515ac589203f30e8f50913941262ff17bf3fe3a10f61854245154d1de7d13e51f46973b90ece537f33445d7d2d71a8
-
Filesize
110KB
MD588b17c40fdcb541b1a3865f6e138f172
SHA11bdaf9a1a2fcbeb97ef1e0938507ee0e0bb95eae
SHA2568ad35ed3589fda9737499b6a5cdef240a80f7aba50fbe3c92d562a00d16a0b77
SHA5125129ae7142ed9569f88b0e5c5d83f5a30a671ae236f3a144a0799bc67226fb5be12f6ae006774f39271a63961206cfb30c738f28b91d8a75f96cb79d3f2368da
-
Filesize
74KB
MD50559f6b65e0f9637c4feedc75a0d5e9c
SHA18b3e3a4501682ec4b1a69fef3aa91bf6fd9ad09c
SHA2563b30456e6aa2ed946ac4c464a9885c944659f3650d7b50e17e2c2c7e9fb40504
SHA51229631e7ccf5ca425c65b03239ec54b8b00aacb662b149ff2283348b68fe5cae9b6d357b394b4f187c5c2e8e1acdcddcbc46397e6c262fa513b21f75550adcb7c
-
Filesize
79KB
MD5a9f63ea781c1c6dee62178b90a47122b
SHA13e720fbb7f662686334a71975109b0d59d999572
SHA256d0a178bfad1b8b08335e1bcdfb1c4dc6914c4b7d28962ceb83ca6f5d365400f4
SHA5127da3e651cc68313cece1c238f0c7d2c44565cadca20baa6bac59975a3a85f4e1fc1ca6c01b1a6e0a07881ba820685e4fee43682de2a167c1f253e1b283d59a64
-
Filesize
91KB
MD593c0e3a80b75758120ee278c5123e698
SHA129020a4b5d9ae79ebb4f3f6e71a0153908b3c7f0
SHA256150f54a0aa90f659190a1ad3bc138a2f4330c9c291eebfbbceb59a54ae28342a
SHA512bc6928fa9633bcec0da74217f89cedb33c81ad381d2a33fdacc04e900375f78843a2bb9b1898ee8974b6d3249bc9bd14f94819ee082c3a0c95144cdef210ee1a
-
Filesize
3.9MB
MD5fc08c6d48f0b74c14bb51aa80c75fbde
SHA1c19283abfccd000930741dee5471e17521d8482e
SHA2569bf48691e2a0ef54f3d5ade886ef04a1e3d5b843218dd576f16a4d9f65537a4b
SHA512152e92171db41a4cb6f03db8bd76ad073b306322e5a94a6825413f74541906c8c7962e72d1d27d964fcecc5a1213dbfb9aeed49f1b95e209007c638c603ba120
-
Filesize
1.8MB
MD50fd95bbc6908244cf1bc7234d05bab33
SHA1b1374661391ba84dbed1395d9c5b0635e4f65899
SHA256b55f4d9fcad0be6a44b370f83af3daae1c09ed8d8925746ae25b68785356f0d7
SHA51265b9282cf71c23ca9a75ec53e1a5d3b3f3a6b16a805b2a3f5592d12a47a8287d4384b802b3421b5233b058615d7a2d0ce65949d0384fcfa59c43e6c56fb86320
-
Filesize
141KB
MD5723ddb0ae654f2588c9c84419cacfa21
SHA1fb763384587d945dcb6de5e2299be9bc8c5edcb6
SHA2569ee04c5c99b1e9a351cfc1c2a2db4ca44944778ae0a0f814f7a33d621119d30a
SHA51262a71a1a262ee91d10f567ece6527419907a64a06567efb75c046e116b27a8360106b06936a77392d19c8f1fbac3876681e90b58fffbff3d7b4d168dd1629f4a
-
Filesize
65KB
MD5155de7d464125b8c35b22dae37428aba
SHA1598a81402437a1a7844b9a7ab17f9d7a606aa4b9
SHA2564f54a6555a7a3bec84e8193d2ff9ae75eb7f06110505e78337fa2f515790a562
SHA51274fb67f791a28804891a324c626f847e41e54743049f31b8b033d11c2dc0357b9f440431552f1e690e3b381d9898b294d9a40ab4ce560773c03bfdfebf52fd5a
-
Filesize
68KB
MD5e0860f86501ae7b6dc8b899baf990461
SHA1fe6f25edbf107f2977dce2b274cadf8bb5718e37
SHA256fae713e25b667f1c42ebbea239f7b1e13ba5dc99b225251a82e65608b3710be7
SHA512a25319ba501d2e51029f0f93c2f7e6aa981ebc22dc0c374c7038ddd6323683dc7dfb8beece132e3e6207e8bbe7e3207e3ffaec94e5624ce3abe8b3a6a8366b8f
-
Filesize
2KB
MD54d5d867e7af077e2a061f645561c69f5
SHA16102e907a4104b24a7b3b6a5d7af705272a763e7
SHA25613637a1bf6e753bb35858157b2c308bf11aea522de6fdfd31dcee8177db8ac53
SHA512230b247827f37db5abc3e8dbf616ffad229c020f5621f29efe2a90dd218a1dd418c4bd11368a917778337ba37649440e29836c0db7f0f18a00782f1462e739c5