Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
662d2b626bdb7e5685a7e45781382580
-
SHA1
5b0ec800c2af4db04160ea1b89163939eed18081
-
SHA256
3690f778383bf6668e90a3def4fe87a8878ab07b6ff1739d91064fa254424707
-
SHA512
b249bbb221234c3828dc81b3b7bcef9a6ba9e043a8605c2e615208f45ffc61fd42eaa759ee9b1479b92a144f4f8fb524f070a8adffa2eb2bd832ebb47a058185
-
SSDEEP
24576:hrJKUKRvzuei/bc6EGn5u5TtyJ8adjCzjyhhcDkPQcKiwMH5yUKc5thLfrXa7sju:h1Kbxzur/bc6/nRJ/aOheDkPQcKiwMHk
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 780 crpCFB5.exe 3100 hpet.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hahpjplbmicfkmoccokbjejahjjpnena\1.2_0\manifest.json hpet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crpCFB5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpet.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page Before = "http://go.microsoft.com/fwlink/p/?LinkId=255141" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page Before = "http://go.microsoft.com/fwlink/?LinkId=54896" hpet.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.b1.org/?bsrc=hmior&chid=c162341" hpet.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 3100 hpet.exe 4492 msedge.exe 4492 msedge.exe 2516 msedge.exe 2516 msedge.exe 8 identity_helper.exe 8 identity_helper.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTcbPrivilege 780 crpCFB5.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 780 crpCFB5.exe 780 crpCFB5.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 780 crpCFB5.exe 780 crpCFB5.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe 780 crpCFB5.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 780 crpCFB5.exe 780 crpCFB5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3648 wrote to memory of 780 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 92 PID 3648 wrote to memory of 780 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 92 PID 3648 wrote to memory of 780 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 92 PID 3648 wrote to memory of 3100 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 93 PID 3648 wrote to memory of 3100 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 93 PID 3648 wrote to memory of 3100 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 93 PID 3648 wrote to memory of 2516 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 95 PID 3648 wrote to memory of 2516 3648 662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe 95 PID 2516 wrote to memory of 2944 2516 msedge.exe 96 PID 2516 wrote to memory of 2944 2516 msedge.exe 96 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 3848 2516 msedge.exe 97 PID 2516 wrote to memory of 4492 2516 msedge.exe 98 PID 2516 wrote to memory of 4492 2516 msedge.exe 98 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99 PID 2516 wrote to memory of 1692 2516 msedge.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\662d2b626bdb7e5685a7e45781382580_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\crpCFB5.exe/S /notray2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:780
-
-
C:\Users\Admin\AppData\Roaming\B1Toolbar\hpet.exe-home -home2 -hie -hff -hgc -spff -et -channel 1623412⤵
- Executes dropped EXE
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.4shared.com/mp3/gjRF4A-N/jose_augusto_-_sentimento.html?ref=downloadhelpererror2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd314d46f8,0x7ffd314d4708,0x7ffd314d47183⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:23⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:83⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:83⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:13⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:13⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:13⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:13⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,923422943171323756,2891797880527496914,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4396
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
5KB
MD5511a3f6862e3d5a9ef4982ae126c772e
SHA1e595de85bcfc5b89e728bde6781ad28f79e7dfc7
SHA256e2be1286151464dc98cceb0611826f9d6e7206f602b09836a3688ed8406bdbaa
SHA512a9d392e196e17fd3201756ddbf882efca36deebfc8d5e4ec069b5086bee8a13593956b5b1ad55126404f418f5ff37d68f0404d40c2e3296c37b31c63050f512b
-
Filesize
6KB
MD54a21b752301b56bec363845c59c62e07
SHA13b7af305d54991b215a0f2af29c35c69bf8e87a8
SHA256f97f568ff78d4cbf2fb009e2d40d9e39e9671d65c38789830d606f21355b7a55
SHA512be0f0007bb7f5b136d14fc9a644e688fd030bdb6d5fe5e1d549dfbee0791a8be7a52022ef87d1af5c0155bdef3724bdb2a7e0e8c3edebf714995b0a328effc07
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b5db1dde7a51f7bb219d036acfb890ec
SHA10a182f2df567eada90a5f6e42aabc91bf46a358a
SHA25677c3999cdcb50fbc8dd3bd466fa91310e728c21a2c15955aa3fed27000380054
SHA5129d3b1df4a80b379f2e9e9f9db482817d15cf8a081f0a0e639751b5fd1abcb56763360d818caacb68e434cf1e32897f7cb9b9924d85107558757a3e420431ade0
-
Filesize
806KB
MD514ec55240339c1239a400fbb9bc060a6
SHA1428982e064e12a4ebc3dbaab1f205aa17ab6b7c3
SHA2569755e30cf56ab363aa55a4b6a74896ab41011c448aaa6c8d658de97c231ff084
SHA51256074ff17160fb81aa6e6f0e408c4e91f4e9a8607b0d8a21248cc3b0b632a461f4e2ea4deaa1918cb29c114bb4008f10ce49e32c776a956771b77521bbbbc29c
-
Filesize
331KB
MD5a3e93460c26e27a69594dc44eb58e678
SHA1a615a8a12aa4e01c2197f4f0d78605a75979a048
SHA2563a81cefbc928fe136056257b8b57733164f2d1fa9d944dc02897b31b171335c6
SHA51239d17b7190f3ff5b3bc3170c8e21d7bba5c32c0f55bd372af2e848ff1ef1392083218a562f3361fdc2db95e4133a19c4ec1cab3e982174d76b8276358dac6530