Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe
-
Size
7.8MB
-
MD5
a2f36ffaaba47ded173db95da644f6d7
-
SHA1
b043c50ad63ec4d666c095404a17c7b9580019f2
-
SHA256
c9927d4bbb13ca2891655d695af037ffb449eb8e2163053dacf9d59a804d3a9c
-
SHA512
926a9851f1028081c8e39ee6559a2808e96560c0422e28d1a8ea46d3da2eafbf76535f8b19aa76e1cb90b6c3f93309587c04500516e96910cdc6daadf5669c8d
-
SSDEEP
196608:sjIIwvgsb87DwQiiFFL4an2L/dfXaI+fVcZ1:13Stl4LL/ZaI1
Malware Config
Extracted
azorult
http://gidrevi4.org/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 7 IoCs
pid Process 2148 cexplorer.exe 2320 cexplorer.tmp 2268 ChameleonExplorer.exe 2548 update.exe 760 ChameleonExplorer.exe 1724 ChameleonFolder.exe 2328 ChameleonExplorer.exe -
Loads dropped DLL 14 IoCs
pid Process 2148 cexplorer.exe 2320 cexplorer.tmp 2320 cexplorer.tmp 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 2320 cexplorer.tmp 2548 update.exe 2548 update.exe 2548 update.exe 1204 Process not Found 1204 Process not Found 2320 cexplorer.tmp -
Registers COM server for autorun 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\LocalServer32 ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\LocalServer32\ = "C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe" ChameleonExplorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chameleon Explorer = "\"C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe\" /startup" ChameleonExplorer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ChameleonFolder.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 5 iplogger.com -
Drops file in Program Files directory 24 IoCs
description ioc Process File created C:\Program Files (x86)\Chameleon Explorer\unins000.dat cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-NM13J.tmp cexplorer.tmp File opened for modification C:\Program Files (x86)\Chameleon Explorer\Folder.dll_backup ChameleonFolder.exe File created C:\Program Files (x86)\Chameleon Explorer\Folder.dll ChameleonFolder.exe File created C:\Program Files (x86)\Chameleon Explorer\Folder64.dll_backup ChameleonFolder.exe File created C:\Program Files (x86)\Chameleon Explorer\Folder64.dll ChameleonFolder.exe File created C:\Program Files (x86)\Chameleon Explorer\ExplorerHelper32.dll ChameleonExplorer.exe File opened for modification C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-KGG9U.tmp cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-0MBHT.tmp cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\ExplorerHelper32.dll_backup ChameleonExplorer.exe File created C:\Program Files (x86)\Chameleon Explorer\ExplorerHelper64.dll_backup ChameleonExplorer.exe File created C:\Program Files (x86)\Chameleon Explorer\ExplorerHelper64.dll ChameleonExplorer.exe File created C:\Program Files (x86)\Chameleon Explorer\is-36I1B.tmp cexplorer.tmp File opened for modification C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder64.exe cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-T84R7.tmp cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-E8VKJ.tmp cexplorer.tmp File opened for modification C:\Program Files (x86)\Chameleon Explorer\unins000.dat cexplorer.tmp File opened for modification C:\Program Files (x86)\Chameleon Explorer\ExplorerHelper32.dll_backup ChameleonExplorer.exe File opened for modification C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\is-QCNL7.tmp cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\unins000.msg cexplorer.tmp File created C:\Program Files (x86)\Chameleon Explorer\Folder.dll_backup ChameleonFolder.exe File created C:\Program Files (x86)\Chameleon Explorer\is-VPQOF.tmp cexplorer.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 48 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Applications\ChameleonExplorer.exe\DefaultIcon ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory\shell ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory\shell\ = "open" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory\shell\open ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\shell ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB} ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\LocalServer32 ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\shell\open\DropTarget\CLSID = "{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException\CurVer ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Applications ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory\shell\open\command\ = "\"C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe\" %1" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.zip\ = "ChameleonExplorer.zip" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.zip\OpenWithProgids\ChameleonExplorer.zip ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\ = "Chameleon Explorer Autoplay COM Server" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\ = "Chameleon Explorer Autoplay COM Server" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException\CLSID\ = "{4286FA72-A2FA-3245-8751-D4206070A191}" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Applications\ChameleonExplorer.exe ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory\shell\open\command ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive\shell\open\command ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException\CLSID ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive\shell\ = "open" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.zip\OpenWithProgids ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\shell\ = "open" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\shell\open\command\ = "\"C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe\" %1" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\DefaultIcon\ = "%WinDir%\\System32\\zipfldr.dll" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException\CurVer\ins13 = "installed" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Applications\ChameleonExplorer.exe\DefaultIcon\ = "%WinDir%\\System32\\zipfldr.dll" ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\LocalServer32\ = "C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\ProgID ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\shell ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\shell\open ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\System.RangeException\ = "System.RangeException" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Directory ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive\shell ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\shell\open\command ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\CLSID ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\CLSID\ = "{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\shell\open ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive\shell\open ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Drive\shell\open\command\ = "\"C:\\Program Files (x86)\\Chameleon Explorer\\ChameleonExplorer.exe\" %1" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.zip ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.zip\DefaultIcon ChameleonExplorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\CLSID\{A20662AD-1909-4774-8FC2-5F8BDC3A21AB}\ProgID\ = "ChameleonExplorer.AutoplayEventHandler" ChameleonExplorer.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\ChameleonExplorer.AutoplayEventHandler\shell\open\DropTarget ChameleonExplorer.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 2148 cexplorer.exe 2548 update.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2320 cexplorer.tmp 2320 cexplorer.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 cexplorer.tmp -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1448 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 28 PID 1576 wrote to memory of 1448 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 28 PID 1576 wrote to memory of 1448 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 28 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 1448 wrote to memory of 2148 1448 cmd.exe 30 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2148 wrote to memory of 2320 2148 cexplorer.exe 31 PID 2320 wrote to memory of 2268 2320 cexplorer.tmp 32 PID 2320 wrote to memory of 2268 2320 cexplorer.tmp 32 PID 2320 wrote to memory of 2268 2320 cexplorer.tmp 32 PID 2320 wrote to memory of 2268 2320 cexplorer.tmp 32 PID 1576 wrote to memory of 2356 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 34 PID 1576 wrote to memory of 2356 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 34 PID 1576 wrote to memory of 2356 1576 a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe 34 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2356 wrote to memory of 2548 2356 cmd.exe 36 PID 2320 wrote to memory of 760 2320 cexplorer.tmp 40 PID 2320 wrote to memory of 760 2320 cexplorer.tmp 40 PID 2320 wrote to memory of 760 2320 cexplorer.tmp 40 PID 2320 wrote to memory of 760 2320 cexplorer.tmp 40 PID 2320 wrote to memory of 1724 2320 cexplorer.tmp 42 PID 2320 wrote to memory of 1724 2320 cexplorer.tmp 42 PID 2320 wrote to memory of 1724 2320 cexplorer.tmp 42 PID 2320 wrote to memory of 1724 2320 cexplorer.tmp 42 PID 2320 wrote to memory of 2328 2320 cexplorer.tmp 43 PID 2320 wrote to memory of 2328 2320 cexplorer.tmp 43 PID 2320 wrote to memory of 2328 2320 cexplorer.tmp 43 PID 2320 wrote to memory of 2328 2320 cexplorer.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a2f36ffaaba47ded173db95da644f6d7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cexplorer.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\cexplorer.exeC:\Users\Admin\AppData\Local\Temp\cexplorer.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\is-LTVQV.tmp\cexplorer.tmp"C:\Users\Admin\AppData\Local\Temp\is-LTVQV.tmp\cexplorer.tmp" /SL5="$701F0,6397385,121344,C:\Users\Admin\AppData\Local\Temp\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /trialregister5⤵
- Executes dropped EXE
- Modifies registry class
PID:2268
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /replaceexplorer5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Modifies registry class
PID:760
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe" /update5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:1724
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /update5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2328
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\update.exe param1 param22⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe param1 param23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
786KB
MD5dd5ce4d765edd75eba6f311e6e0ea10a
SHA19ea7f6516e5ad0755b74463d427055f63ed1a664
SHA25664b7f8f70a7b037d10da72eaa769078b7e4d1ac8964c5eae5515d373e816ed6d
SHA512d2782310df7cc533cc9ffaf5c1903d5bc6a500c3bbe48148c1339fb5de19c835e4a8c765da1b80b3744ea231353f76f22ba4e04c78a3d950d7ee291d6eab2216
-
Filesize
1.2MB
MD5de5f74ef4e17b2dc8ad69a3e9b8d22c7
SHA142df8fedc56761041bce47b84bd4e68ee75448d2
SHA256b89a6a57b48be10103825440d2157f2c4a56e4c6b79ad13f729429cd5393bf32
SHA512515e9b498d8cd9bb03f8d9758e891d073627dfd6fb0b931650a47d6e53722aa6e1cc3caff8c0e64f4721ad2abef7a81ef4e7b49952d3c8fc325deb5bba6b3314
-
Filesize
750KB
MD5fb76f4f533203e40ce30612a47171f94
SHA1304ba296c77a93ddb033d52578fcc147397db981
SHA2563de05f18ffe9fda589a45ea539a464e58a30f70d59d71444b018064cf831c4a6
SHA512a416a6d6efbbd69209e1867f12b9d1d11b21160f6dfe07c510b43112c22c317f805c67dd9402744a6c7e1541f6b3a061c49942fe28fa70f74aea670ba9c71995
-
Filesize
1.2MB
MD596f92c8368c1e922692f399db96da1eb
SHA11a91d68f04256ef3bc1022beb616ba65271bd914
SHA256161408b86eed7c4d9a5882aa00df3f8765ed28fa4fd9aab2c9b3dceadbd527f9
SHA512b3d3fb2d78fe2df864f0e07a8bc1610ee9d65251957e0495a34c1631895293590e0fca965ec9deb160f48a4e09a2feabd3bff6fb9a0c22888a941e308de39d14
-
Filesize
6.5MB
MD5b2e5a8fe3ca4f0cd681b5662f972ea5f
SHA1b7dbcfaee55ecbf0158431d85dabdd479ab449c7
SHA256e71c48c03b8cfd37bf17e62460733a4bfe9c484e947fd9db291f65405a2ba9e8
SHA51240b7140f5c182cd51cee142a2575bd70dc9bde311ad3952119fb9769b5ceeb467695aa5a66fc90520712d9a39458930efb965496d6443665b7597cfd66247aaf
-
Filesize
170KB
MD5966e665be4fd295ae5dffd564002d7d0
SHA149a401c19506454fe1a1d851b27842ec8174d3c9
SHA256631aee3a20fb36920fb7a3c7232aba62cd35cf6d2a546739006053b1786dcab6
SHA512d52d9cb7fdafd34376d5e3b9e83b90d14046c0c3767426116eb6bc322169539149e577bdbfd1c8583d6c949cce8bc026e56792b3cb8b632b35d5ab8ec81b33aa
-
Filesize
14.4MB
MD592a3d0847fc622b31f2d0c273a676c0e
SHA1e642d694367cc98a8863d87fec82e4cf940eb48a
SHA2569a9923c08d3fc5937b6ed189e20cf416482a079bc0c898c4ed75329e0ee3ae89
SHA51201d13fd9a0dd52bc2e3f17af7a999682201c99ecf7218bca254a4944a483fd1dec2a3e6d59def501a024ad760b849787902ecb55bd33d23fa9651c0a7689cd1c
-
Filesize
4.4MB
MD55b0ae3fac33c08145dca4a9c272ebc34
SHA1940f504d835fc254602953495320bb92456177b9
SHA256137723bdd388f6e5a50b7942eff02f4cc70e6b86d8650a41f9e8956ea1e4de3b
SHA512015ffc133ad3a6937222bbc057f68b60abfe22b900b5e7c4e6ca3ec7dc6b09abaf54b595f00fa9212f370da8531af1ac5fc52b39953e1f685e81c66d1ec61f8a
-
Filesize
1.1MB
MD5729bc0108bcd7ec083dfa83d7a4577f2
SHA10b4efa5e1764b4ce3e3ae601c8655c7bb854a973
SHA256b1c68b1582ebb5f465512a0b834ccac095460b29136b6c7eea0475612bf16b49
SHA51249c83533ce88d346651d59d855cff18190328795401c1277f4e3d32ff34f207d2c35f026785aa6c4a85624d88bf8c927654907faf50db1d57447730d9d6ac44c