Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 16:13
Behavioral task
behavioral1
Sample
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe
-
Size
276KB
-
MD5
9ab644449c7139b4ae722c8044383e4b
-
SHA1
04356f283d8278241598c5d97261344bcb2fd8d1
-
SHA256
5b85a3101295d1b0bfd0f843a3e733747d4ad7447b996048ba4eb23934cc65f1
-
SHA512
f45cc5cf5bf52ae93a7ab8c921e31999f083c71508997e50cf7bb99cbd8ecc7bd3d77301ac5117ecf3eb414fbed465f82b2d5cac05a3f6dca5e180baae0c8fc9
-
SSDEEP
6144:Dk4qm8zcCzjrTvmXAtEZghSNdKaRafNDPKGviNI8h1hfwO:49/LvmwiTNdiPK/Nw
Malware Config
Extracted
cybergate
2.6
vítima
189.5.87.27:81
PSICODELIKA
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\install\\server.exe" 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\install\\server.exe" 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exe9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\install\\server.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "C:\\install\\server.exe Restart" 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 2864 server.exe -
Processes:
resource yara_rule behavioral2/memory/4636-0-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4636-3-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/4636-24-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4636-66-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/1928-70-0x0000000024080000-0x00000000240E2000-memory.dmp upx C:\install\server.exe upx behavioral2/memory/4636-140-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2808-141-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/2864-161-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1928-162-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/2808-163-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2808-164-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\install\\server.exe" 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\install\\server.exe" 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2008 2864 WerFault.exe server.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exeexplorer.exe9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exeserver.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe -
Modifies registry class 1 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exepid process 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exepid process 2808 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2808 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Token: SeDebugPrivilege 2808 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exepid process 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exedescription pid process target process PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE PID 4636 wrote to memory of 3424 4636 9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9ab644449c7139b4ae722c8044383e4b_JaffaCakes118.exe"3⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\install\server.exe"C:\install\server.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 5645⤵
- Program crash
PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2864 -ip 28641⤵PID:1480
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5ede4ab0dc240d253ec6719bb232ced84
SHA1f2e3d4558906ee268dd36595f1b5b22a37764c65
SHA25676e94dfb3166cb8794b3be486bdfa5fb1566ec06a780c5fe328a8090cc67fbb5
SHA512a1fa26d4c0487a2536269f19c9f98726c416cafb8fd16a7d02aff504c3c9a4c13db31778dbb9a9ccf94e1ca8802aaa2064ae2be734e2901ff4eae17be7287eb4
-
Filesize
8B
MD50ed06331028d63d49b4ee01f2641e352
SHA12a76c44528446443fe834ea00504df8e925cd000
SHA25666d61dec7c65089d46126a3491ee7530969a4cbd60a211ce42f2d286cf1fc4ce
SHA5121f78ac0ec1e8aa9cac135cc5e0acbd058b8409b687ed71f6c36a1748d99d619cc224570306608925e745835c85f424a2815e5882ec24199580dcbc33527897d3
-
Filesize
8B
MD52779c84ceced72a3d34b16b6df3a2741
SHA1bacf8a924fcf87660c78b38932458bf42cb7811f
SHA2565e1ad37e803217090dbb19d5f0583fe9b6bbd97760361bc61782573504d08461
SHA51246ecf84435a008aad5171380ceeefdcb542318150bc8f06025d1f7e1e2bc8871072321d1ec957843f61594e66d276574a8a094d634b97b14b200c3772f144601
-
Filesize
8B
MD534d92c2987f6e95b83f84e300837ad18
SHA1ed4e214b926098ffb26edda4c7c139f7b72e5c05
SHA256214aed4cff482c2355a6c17908e88eb595fc9fd62e8e6ced533eb77a30a30a74
SHA512e300a3e916b7132f96f271a147232322533cc6280be96d7cc0565049fd8aefb5ca8f6e170fee9e4ae4262db7f7463af068e19dc5175c4e63781e1ecfef59ef94
-
Filesize
8B
MD5fb6445b5335a91922c5e6e68cc71d520
SHA1f21e3cd41ada38f307dbd7d89c3e87811278416d
SHA256b5f0ddece953bb5203c8d7ca0039b72acc90b1df5849655b6a99df58ec3ef75c
SHA512a0df91c1eae6591318f6c29e1d7a47b5d99d8f1e2a1646d7ce51e42dbe22041ccc5cefe8a82e2485197bae028c7f1994c1a77aaf769bcad6ae9636d71d3c0834
-
Filesize
8B
MD51cf765ecdf79c04773488dac4785327e
SHA1959fd2d22c4b47904255fe3c418ab7c6814c4140
SHA256162172801ccc25363aea0ceffde08b4cae340b839fdfaf23b4664932af889462
SHA5123bc547356b4c4d35b1dcf454249fc94b164b0b01888d26b104203967d179d9fb77c0bd122fc9547cae78392ecf866ca148ed4ade91d433ea8225277c420eff88
-
Filesize
8B
MD5734339e3dcb0dd446bcccb852ccdaf80
SHA1bca375481f3e554addc47a5c36692438a630945c
SHA2561547acab6d10c894e1c9b9a05b381c769a4af1c61fa3290f0c0b43a0f70be7f5
SHA512dbf6baad219a554f20342db66fe6b718e12058d73854f426e65b3739e62372855641cd2d4717893915e57f3746fe7d0e16a370382a4acd8ae7a91d33080c7494
-
Filesize
8B
MD54bec79e0cfa17c450a618803aa2b5bda
SHA13d609504d946b86f60589229ca44f07a828deefd
SHA256ef1eed846e3de911f319cc90f26c8d8359b3a58934e9da99676c2e03302afe49
SHA512a36dc78d7cba4c89cdc944e753345a2a223271bfe3e6d271c380a43a3767425b09d6e250ba72c446e8ca7653c41e91614c2ebccf209e32e01a4a27e45c3594c8
-
Filesize
8B
MD5a7bcf93b2e933b7cc828cdaa41a96670
SHA1fe7fe6a6e2b8c9f0a4c6ef1c0f8145623b87e203
SHA2560736c6dd3c4f7502d717078d58227f8d2c8eb79e9435ee8631cfc9c5d4e15750
SHA51270b028eebc28aac649fa2857d797e9d32777b0359c9695e29e4605d099a3677358df5d8ad6d9170480bb7c9f31b399709984883a5958ba2384424ebdd80f2413
-
Filesize
8B
MD5f12bf4538897f8a3c64ca2c6d4384ebb
SHA141d64e502c7cbd6e5242caea1bebcee6e2f883fe
SHA2569c2d188ba427261a512947e2c1ce9a99d467f735a78a73330780da045e8d7bd3
SHA51250cb1bddc319c01bf76ee5e58ee040c3289247d8530e57c1c248083a4a80dc225a04de5ecf0713adc941422bdeaa9aaf4bbcae77877b52bb375330c0bc51596f
-
Filesize
8B
MD5550a067fda5040bf35d9fbc2ecde6803
SHA1f2dbdb2f452db37a8354270b03b9ed4040455bee
SHA2563f76b9626e359555e5f7ec4e99b1c8e06bb139d360bb5f77f842536102f3ded3
SHA512742bdada4a3e432b3f20969a1516c5f2a05d3f3c6114666e127fac052fc913a7c2f44f9efda07cd0f96d6e4295a54adfa844ee831affee1ec82d59f9ae637033
-
Filesize
8B
MD50c59284fc3e6fd5a27d8e6063a3cfb11
SHA17ba57b8b43ef48b54605735d52bf6a69feba02e5
SHA25666323070d53b29c70a95a28033ab61c1a9a991b8c897806eb73f5388b629d479
SHA5127cadc74d292208a3e9c63c29c5ee77fb9d135e1730da689106fb83f00294d7b9525e0cd689c7ad5701b13966f7be816fd8a3d6ba530e6e02823f20ea21032661
-
Filesize
8B
MD58b77986f78fecca844187ffa90f226f8
SHA18f2f505561f495cc297d05805ba5e523d6e147ad
SHA2569d5dcac8ef78cc0bcee912f0d8508627607f9e0b40d299c5929216040bbf0ada
SHA512deaf6a8e128ac8988c5b016561292228ab609d96398ddcf9ff5a6854015418b1e98222519296b156ddbaf1486529f74eb775c9d886a27d0267a81f0fe2f01d31
-
Filesize
8B
MD521e4851d992d171d03070c57f6264571
SHA195722a82701400a574ecdbf54cf98025f9a61e18
SHA256934db246b0319b5a6c5b3de78c59e3a814fc5095d26d4268b8c907bd6aa08b6b
SHA5122fe08f82f01fa081834dd4ea605cbe94d2b5a6fac31260af65a0b06b4b0ece332df69e47d19e0704a2c1064b64fcbc71d3aa165f5b8f97f4f7959284275b8820
-
Filesize
8B
MD5687d5b1c6f0a45f44808453c8d7a421b
SHA1707c35a7a18c34567feea6f35e0ea2cb8722d3dd
SHA2561b060df76a0d5c748e458f705637c50525cadd8c5d371c2c93838308c422cffd
SHA51243f82013205971d219ad9afa95041d4ca1fbd608a1e47a76ddbf767f4821297ada714676558d383686fe4c847a63d47570201d30118b988cca0dfda5a4e8b00e
-
Filesize
8B
MD5c2438a51f22d06fb7352c5cf46ced941
SHA1f0c627f143760a936fac093d2622b2ff26842611
SHA25694b262cd319996e00d317ebe7f2b8673c27bd1ec8d5d11b5987bd2a85873b53a
SHA5122b988dbd427d14ea989d0401ccf42bfdde627455a71db2533b492ca83e73e58ad5ecaff1e8507394c45a6ea8c85a3a1523eb395da1d01f03146639387412821e
-
Filesize
8B
MD51d827f505228ca285b5fcf109be773a7
SHA1e2699cfdd258ddd7978a2877dd9f82bbfb0497a5
SHA256f468fc79f590cb7e6a12a1ec2ae0f6a67d0c198a781b5c7212431e402e2aa7d1
SHA5123745dcf03d6197a02d2346880d675d02772be47ba0e737c22342b3ca3f59675ea6dafd944978bf096dcb4385fc59224e77854115ecd253c994a26298d621c1ad
-
Filesize
8B
MD574797a74c178f3c0cf5186efa6174d33
SHA1d9d307dbe3793b568404acbbc68e62a8b2475d60
SHA256d1a0133d311a61e6dbefe97e1255ab48aefb78c7492c21a844c7f9f3872d5a14
SHA51254ee1a7140e974d94db69a8e076dae08470f86fef30ee9d4f12c7e32ffcfeed08cf7bff49d7bf3688890eb41a4b9da13b820d309da988883c2d6b684cf207d64
-
Filesize
8B
MD5aaffd81975b243aeda71664f74738c43
SHA18e28cfed3ada884f66a11b46f4332fb413eef807
SHA256a314947908bc63b29b1cf8452991d1bf5739135499f10b50fa892c5a3720ecc8
SHA512245d02990e6c8b750cb0d20cd3f423bb30d5a5a95792453c555c1e3aae102a3c257b3b8096281d5968121afde61ca6047348cf1c894a057bb0f4d556afdd3636
-
Filesize
8B
MD5056466b5b74a107a79a26819cf1746e5
SHA1586293c832636c76dd2605e38530660c92c1bf62
SHA256a239b18edc6841424cafc988fd0ae78c56364fb55b056983cbff026b58b00441
SHA512788e586ae3e3fe37e003155fb4b8018c3b197ca7ddcf0485a98eaf3f5db09825353b6ee368b4085206292b4a8c626297608f2bdb2a6b226967bd99847c6f896e
-
Filesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
Filesize
276KB
MD59ab644449c7139b4ae722c8044383e4b
SHA104356f283d8278241598c5d97261344bcb2fd8d1
SHA2565b85a3101295d1b0bfd0f843a3e733747d4ad7447b996048ba4eb23934cc65f1
SHA512f45cc5cf5bf52ae93a7ab8c921e31999f083c71508997e50cf7bb99cbd8ecc7bd3d77301ac5117ecf3eb414fbed465f82b2d5cac05a3f6dca5e180baae0c8fc9