Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
db295321c287aceba94bdaa3b2141cb6
-
SHA1
18aeb11cf5e1d3579fb30862c56a70ace4b7ac45
-
SHA256
5203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
-
SHA512
07720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaGPoPqZyONw4jDVslGWvn0GZ85:mJZoQrbTFZY1ia6d1jDyIYn0GZ85
Malware Config
Extracted
cybergate
v1.01.8
remote
freeforfree.ddns.net:999
upgrade
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
updated.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
FUNCIOANL EXECUTOU
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe Restart" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{445N60N3-08V0-S2B7-RWIS-4QV11S48Q5X2}\StubPath = "C:\\Windows\\system32\\install\\updated.exe" explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 1472 updated.exe 2600 updated.exe -
Loads dropped DLL 2 IoCs
pid Process 2284 explorer.exe 1472 updated.exe -
resource yara_rule behavioral1/memory/2508-543-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/2508-891-0x0000000024070000-0x00000000240D0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\updated.exe" db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini explorer.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0023000000018ab4-545.dat autoit_exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\updated.exe db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\updated.exe db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\updated.exe explorer.exe File opened for modification C:\Windows\SysWOW64\install\ explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2592 set thread context of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 1472 set thread context of 2600 1472 updated.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updated.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 1472 updated.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2284 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2284 explorer.exe Token: SeDebugPrivilege 2284 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 2284 explorer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2284 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2592 wrote to memory of 2776 2592 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 29 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20 PID 2776 wrote to memory of 1252 2776 db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db295321c287aceba94bdaa3b2141cb6_JaffaCakes118.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2284 -
C:\Windows\SysWOW64\install\updated.exe"C:\Windows\system32\install\updated.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1472 -
C:\Windows\SysWOW64\install\updated.exe"C:\Windows\SysWOW64\install\updated.exe"6⤵
- Executes dropped EXE
PID:2600
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD50746e5babcefa3b07c8f315a42fcdabb
SHA18f6f15241bfe1d9f15f0f86af11e25f92d144cc0
SHA2567ead0f724ec2fd62f1ed50b0856fda637fa8ef2ee5de8eb33fef1df58faa3806
SHA5128025ba2a59c712dadfe932bfcce90a1a111e6b72a7346d0e114001afadb8e85d9374a857be3897f785d4a0dc5967fb2ea2ab675d46a69e79263758b8ee44ea8f
-
Filesize
8B
MD5f9b2e83dec24981e83f8d65db8a9b102
SHA1bf460acba8f7620c29481a97ba43e40a9f50d73a
SHA2569751be5ac7a25caaa41431423f90e2eecc71112329a14fc93a9294125a1b6328
SHA512a12c27f22de3ace3d88d5f6e9f369c9c55bd4ab37dedf39d81a4ae4e86b85dbca0ae2519027077e6b4042ed64c5e7ee394687bc57ac173162cc28e02e15b83d1
-
Filesize
8B
MD554e01f5251006d8fcd218f5994fc2e5b
SHA122f7fdb8fd52271ae806456425118fea50fc5203
SHA2568cc854dfd9f5a483337e56a3ffba6eda2c1264aacd38c1d2373a62056c2f635f
SHA512d11ae1d34a948e2585a7c49e096d141dbe4d8fabbe1237627b623c9c487792844c8bf8d0e2b119079f13e57e301347091119b7e4dfcc5847daa79be4ca26b82c
-
Filesize
8B
MD532ee19a3f1036e7bcaeff1752e8425f9
SHA186850e6558a130bcc44723c378a02c1ee1410b3e
SHA256e14d39fd72edac8c0323978d2119514c3dbbf8e318daa968e106bda638c1aa52
SHA5122a5227ffb6c14c6c2a1c1a9e8f88f258c246d62ce44f7e1d65f5ca578423d73d7fbfa0a487f4b2f9d5da7a66ac4e10b19e383ea29c18557be403e5059abe56df
-
Filesize
8B
MD57bc3ad4c6f6aea06392573002643965a
SHA11e8cc6ac9c639388a57a77348e9fe90f3be59a54
SHA256c7634d92c98d6bee72490e27a8223e434c0c2d3e064412de41a2684c58e9b77d
SHA51218f5e7c192e3d1840b5c884e496b45162da04d28b0dab38773add46c0146390a21357e9ea79742e7b877b698c6ff6a8455b302396e575953c017e86723f401d1
-
Filesize
8B
MD51d52b9ecc0f3bfa8714abe02b0c7ce58
SHA1d725cd89b55f93a8673b2b7f8d1956896aa9b4eb
SHA256cadd44aa778b9113a0c30162a7ecf37e4a43400ee09ef455f702bd89a4dc364b
SHA51219effaade0933116a47a7314c30b051409e3e31280d6f48d9e971dd227251cd0aca6c1b30711d0ce339043f62180e3a6676828d359b04722e0da4bf5000b9715
-
Filesize
8B
MD5e8eeaa3559a37812cdeea64c466c58f5
SHA1d8f99a25f5f4d7d726d00896da4d57103dbb2996
SHA256ace7444032ce78d7d9ee9a00c550e682bc41358fafb76783deac815cca9fe4be
SHA512f39d962d524a36ddae4f90fe20e858ae934ae0762da6382766c38f6a874f8042a641c205579e52c303003261ff831fd72a0967bb02596b28071043417864d293
-
Filesize
8B
MD578f43182e71d2101b83a424fe77497e1
SHA1e94432409bf5c45dff7a643ff29c918a8b1aec8b
SHA2564c0be6f09f426cc2e3506353301349f37d5c4aafaeb9ea3df3a03b7d41d55629
SHA512d9c93439ea5b5be3afef4106ce3b1a5c3c526bcb85eb1910de5f2896900bdcc2c1396bbb2db21a286409d22c9ba5610cc7c625fac56faa16d62d451b6094212b
-
Filesize
8B
MD583dab600735c9b58b3998e219636c16a
SHA19414cfb84797ec2fc7fa892fe8f150585884da94
SHA256025085ecca5a15c025c3c56eaa709faebb947ac4fc5e8523ce9ae6980cd07d60
SHA512f289c491a7b198957b4cb5449dfe564f6532d1d4a6401990a12a00d543bbcf8fd0a2cd5b8bcceb4c18ae091ae00383255be03990fce21b84c7d2a924d3850b19
-
Filesize
8B
MD5d6b32c8a822dca415a95375fcd89d049
SHA1c2479022cd43b9167eeebfd5a1fd46b61c9edab4
SHA256aae604d9281f80bfbf0b0dd7ff929f216bc82ec6eaf40ece1a15a68773ac6019
SHA51277f9fa7ff70b0bb410f7617f080690e5a4509a462da4494230a275e0fac040399e3df504ed0f6fc5de35f499e65230555ff75b0a78fb2ad1d4f17ad788f1afb4
-
Filesize
8B
MD5fb7b221dc8ae3214e17c604682446d4d
SHA1f15f2021cd0d146a198cf8b198dea2b48e83b75c
SHA256575cd6e7f144d9edd1bfed552eec49c35dc4b3a745f109789c0f5228d7bfcf96
SHA512d266affa38bd020c18bd63d84a5815b5db75b3826238f5d19a8e2a805369a402b9b5e8ebb13c8ddbfd7fdfc68eb46de47b6d62cd70b64cbfbfac0c46c919807b
-
Filesize
8B
MD51c6afe8378053ce62efef55990a7c28d
SHA1fcc63f39c555bb473d58adc19800f08997279a1e
SHA25681f5690aea9eee0eef572c9f1c1777650b34fbc31009dc5901ac24b38a4a4038
SHA51279c0d488403213ba8bbefaa90ff99ca6e44b6a9a7f53e322042ac14743f6d91ca23cc38c43751ca807d85eb33433710d9b169431d667d6a8d709936843abf46d
-
Filesize
8B
MD5b1ddb3f25f35a4f986bb505d62e7af27
SHA19743d2fbc537140d9a08cb52993be103c4233b49
SHA256fb1266a77d2aa24320cf24d6f92e9b3078d355aa26e949f7ebd747fbe6840911
SHA512c99950b5d2654f9c81c3b84dd4b1681db7772082004f92c0d1a285aa1badababefe46ee02e5388e47d5f1b02b61ca413e16c1326b40782e32c74b99d976b2906
-
Filesize
8B
MD5323c1a7fb83d1d11ef53b6f8ff916d00
SHA119e3f3eabe89f5b0edbf396d822fad5ba7fe387d
SHA256650c98ee09afb12538c1f689a510c83f0095a5db008739eae2689455778564eb
SHA512f08d14fbe5e75b4476d7bdf3ddb205910c9245c2160a204e83c0d425c85321229764ea7803e8cf7d32cc6dd4af213dea8d8a9a8f993c37a9899d844271b62738
-
Filesize
8B
MD5fdf9d479c147fbfce17f09ce56d6dc03
SHA1bd8abe835bd5e9123532c9aaa4f16fdc7e69af19
SHA256faec86df7d0beb35d30acce4e2b10fcf13f15a29dad1a9e3d62ebd83464d5a66
SHA5124bc9f9a313f7f659d2cc905949439335ee092b41c8ff86d1ba37860e62a9fc01fd5521e774dcf58e74f5b277587e5992f74516c498d700c4e14090ae02e04a8e
-
Filesize
8B
MD5a9d48d2e680a078ce83b6b9b878de286
SHA12603a5662d0eb7216599fa1190233c78212c9081
SHA256055ba281787b1307e5efddd6ed64e4cac7f6a6e687801cdb65b66fd4d27b99ed
SHA5129706074aa69b9b1427b3e114c4b893a1af087c1dc05bda794cd0e9eb93cda6b034d39e03656cfd859c8b1f88962326e44a8304eccf25496e07d02709e1a9ea22
-
Filesize
8B
MD596ebedf49e077764575255842e89048f
SHA162e6d37177d993be411b9cde5ad55bd458e24f50
SHA2569b323711ede5882c1f87510ce576f55de66b304debd354e0f810c5555bd8623d
SHA5125edd6ef76e04b1f47fd9871f19bb70dcb8ee22109f8cf7d832e8b5f8f420105a5dc5f734022ea866a8570d4b23e68755ad135e41a229dddc4e00507e1d4becb8
-
Filesize
8B
MD53a61d1283118c9936336d638e187d3d0
SHA1c05fd667f772bc59e4b9cc43f0e88d1ffb8876c9
SHA256de7a79107fd2a106cd901882f9b643121207fa215f64104d4a6ca3c9445e2a36
SHA512b0be1072ae9a1d0a459b1b14cc5827d31cc7d5126a400e1a65bb7d36b1fa6445fc30098e6e655a18cb62245b70fb3605c2d88e5d591dec7380efab0d3449e6d3
-
Filesize
8B
MD52d7393948189f350373501be93788c20
SHA1663cd911c615af9e7f1ea09860fd92059b8d0626
SHA2562c652637810cc1d70cc4f97a4d8050a035979295e3587dddf01a568466bbcbbc
SHA5125cf79bf452633d34959c1e4d009a6408f88bc9ab269f485bf24238e3e16387f5debfc5489315dac562a396e94d64eae19674f1e49e3af87d187ceee41120d2c9
-
Filesize
8B
MD52d3a030a1e66bfc5befd4fa1cdf4f20f
SHA1e6624d6a4cb2e49bc054f12d6217103fa3e8dd2c
SHA256bd424affe026db8f55a85fea707b07dd1d006026263d78036ffac6502345d65e
SHA512721e16e2ce9961f971b1ae7c3e79ec29a7e3ffd16f23d246a38c1022e972ca0ee7ae22764bc1d5c0629128af9d8bf4c7803e700310097180c0e59a934aec4855
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
1.1MB
MD5db295321c287aceba94bdaa3b2141cb6
SHA118aeb11cf5e1d3579fb30862c56a70ace4b7ac45
SHA2565203699ca3784d105e35cb5ee1092afb366653b4b57717bbc09d77f0e48386f3
SHA51207720a0d47e8c616cee15a3874cdbdf586f24bb072e23f965e0350e4325724a7d841cb2642e5b0d0536ebf531ee912aa5d57d2690074ff38851b25fb4b767d88