Analysis
-
max time kernel
129s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/10/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
7a892fb6df573de496428779baddc5e8_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a892fb6df573de496428779baddc5e8_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
7a892fb6df573de496428779baddc5e8_JaffaCakes118.html
-
Size
158KB
-
MD5
7a892fb6df573de496428779baddc5e8
-
SHA1
297a6d2f97723dfb18746304ba3eaf2404df9e78
-
SHA256
1d5fd81b6eb16dedbe15de36fa03863846c517b3fa0de1dee0eb4c5b3b49a4fa
-
SHA512
87138c02d55127d501f298e77a9ec9ebc6dffa8966247002a29a1d17c947188ee8398c039d105c444578463dcf255e397f9417c100889e87df081d8a27dd3d14
-
SSDEEP
1536:iARTvy7fhZnkgyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iqWZnkgyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 2936 svchost.exe 1980 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 2712 IEXPLORE.EXE 2936 svchost.exe -
resource yara_rule behavioral1/files/0x00260000000191fd-430.dat upx behavioral1/memory/2936-434-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2936-437-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1980-448-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1980-446-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1980-450-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\pxD079.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12E5D571-954F-11EF-8B74-7694D31B45CA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436297100" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1980 DesktopLayer.exe 1980 DesktopLayer.exe 1980 DesktopLayer.exe 1980 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2704 iexplore.exe 2704 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2704 iexplore.exe 2704 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2704 iexplore.exe 2704 iexplore.exe 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2712 2704 iexplore.exe 30 PID 2704 wrote to memory of 2712 2704 iexplore.exe 30 PID 2704 wrote to memory of 2712 2704 iexplore.exe 30 PID 2704 wrote to memory of 2712 2704 iexplore.exe 30 PID 2712 wrote to memory of 2936 2712 IEXPLORE.EXE 35 PID 2712 wrote to memory of 2936 2712 IEXPLORE.EXE 35 PID 2712 wrote to memory of 2936 2712 IEXPLORE.EXE 35 PID 2712 wrote to memory of 2936 2712 IEXPLORE.EXE 35 PID 2936 wrote to memory of 1980 2936 svchost.exe 36 PID 2936 wrote to memory of 1980 2936 svchost.exe 36 PID 2936 wrote to memory of 1980 2936 svchost.exe 36 PID 2936 wrote to memory of 1980 2936 svchost.exe 36 PID 1980 wrote to memory of 2288 1980 DesktopLayer.exe 37 PID 1980 wrote to memory of 2288 1980 DesktopLayer.exe 37 PID 1980 wrote to memory of 2288 1980 DesktopLayer.exe 37 PID 1980 wrote to memory of 2288 1980 DesktopLayer.exe 37 PID 2704 wrote to memory of 1856 2704 iexplore.exe 38 PID 2704 wrote to memory of 1856 2704 iexplore.exe 38 PID 2704 wrote to memory of 1856 2704 iexplore.exe 38 PID 2704 wrote to memory of 1856 2704 iexplore.exe 38
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7a892fb6df573de496428779baddc5e8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2288
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:668677 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507b158d3ad32811549f6dbb55d9d4612
SHA1254f313202b61e0dd8f70d6882921b8678450a96
SHA25647749c21295b6d091c94482e3e88332232b0079191a2f2376bbeda066b764c1e
SHA5128d9a14a4daf9d36066579b5b71013dec6f81ef565b7a697c13bb0b676fd13b3c396353d689d7ad15379ae60a430a832ac90c19822874006839363146b641c81e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535d6245b06caca6fc355302314870e28
SHA13534ee93afa1f19c955a48ead52aec8c76f9a0be
SHA25603240e23cf5fc95efc4318cd53993d15a18533d8f2344c2ee45dd2596dcff185
SHA512cf74c92896baffed42635a04a1e727fe36eaad868a6317e3740f2fff6cf9ffafd4b8a9828b9cf8364333b50e7c484ec7a4ad1c145219b32c85dbe03f982c56ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca31908259d70838dd35b843b7bd7b35
SHA14298b3004bbc6a68f08cb7853495f16609c6e41a
SHA2562e23e7d1a9f6dc3c1e02b609533a4e1ea9bf711fb5ba2f80e81a437ad0bf97d0
SHA512f14e187fcdc386c66b5fca7e7d2223b66c1207c96ffb8654be7a5af6f43879221b23fc807ea523bbf8e10ff5a2d60a2bf32e8578bf58a3875459db98532e3190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568014f48bd69191533abedb2b1ef50ee
SHA10b366d804b28f5a6141fb5ce6a26ad6531cce09d
SHA256634d7f405506d693374b440976759eed3878d397baa8f67278b705fdcedcf400
SHA512ba4858eb17ee4dc60711e89cfccc28b2b89652a25814ea079b0405f6260fad0580e7b6b14c64ed64393ca4c07c3c533797dc3c7e07ab355133e1fdc59cc0bf83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576035c52678426084441edb4f360d72a
SHA11b47b46e269701873ded26a72364cb14eebdd57d
SHA256627a391d11bbd77d5f3ca5f001332d82ab1562ff21eee8d07e8035593d17cc98
SHA512301e447f1e240ddf6d8a6c380a1074ba173a4f17b9f3de576ddbfc3c68cb72ececb1113166ded81ef2e968554ba7f5e4f408473539333a0f8dbde4b311905f99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c1cab7f2ac6feef6a8815b8fdfaed47
SHA10e3a8c0baafae8cb1d3c8733d0a6a19e9fa6e96e
SHA256365588e4ecddcbb8935abb0fbf69643ad033d626b843af885a2e48f8bb49e429
SHA51284f2d8c8da458888cd17b39bb2f2dbfb8a16e6b910cdf7f65f4bf9dabb676f7f5f3409568df27be1c15d63e1bdf92ef5ab497c1620666c9dbee213c56b09ddfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518dc9ee5e69b46b627860b86493ce209
SHA1fd8e629a39f4f236ab79150ef4ff298f45e70c24
SHA25686e2477975e196424ba24ff07efdeae03b537e504c23060de53147f8aea2fe65
SHA51256e52caf987156b026c4d096d8fa42ef8eca3da217d2ac71a84369f2cc0ac69481e7e01beaf071bb8c00598552327d04a850a25fa7b51afb045ac63c4288516d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50633718bf087f86d6cf8f105bdf1f706
SHA1eeef0633ce89254997dcfb701f13404336f7d6e7
SHA256ba8197ce1ba909a59c4c785d7de232f46ea3faec655ee05c1f4514f406340630
SHA51202de94ea58dd9a614504d08748fb3492977260861f2e6e02b1963b4c79a4c728c26686aa2e46e4a3ea14d37573b8962087ac3103b831f63c258f6217aa90d235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e00e0adb477ec4f95eb50084369d05c0
SHA1fc69f4068a3f5af11c42874aab66ddade355afe9
SHA25674adafa4762b55fe2224640577aeb92b57c05a08e2c01980012320a8ff62be49
SHA5121113a2d8d44156212e521216f2376f9b40397cc26d772edd38e1647a7e91790c77b917eb6cb5ca9ac738bebd30af434227c683544bedb770a15090e5352078f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f743c14863e2bd0c62e648e5e8b5d233
SHA12c508a8ef745191c620547fa2a285f613a2eec89
SHA256c443ec735020658de6917389b47d7bf71e95f2709734075ed5cd14f4a190aa6d
SHA5126c9bac7b1f3e44b85e1cc33face51c02e1c69f55eeaac22211b087ded19bf5c3fc98d7ec4abf16de2594b4e12018cac9998b94e5728bbbe6c10367c358b58637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536f24671411a4f1e710d409251f2cb1d
SHA18dfdef29f43cffb5e534f17096caf78ef79dae93
SHA256ec1ecc0c5d7c53c76585580e375dcc210822a49e24a4ce4cf754289cd71f8de8
SHA512f3a9a58f8a488f438d2d5b86ae359b6ab37b33a012e1f1de1981fb8d4e637cb678f344bf01c493d800ee642faf3bd358a4abdeb49087a94069d06e6f91540a41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560cf10e8f07234c9199a60e7cd1d4162
SHA18e70bfff6e80d5c0b5b29d0d1948ec86ef4c3ff0
SHA25656bea18dfdcb58bc0f7ebbf3b824d68d081177a35b50b24f886370663c2e89d5
SHA51220fb7d0e7ac96cb9596536a56d000bd6454d387d7cbe0aa54be8dfa2f97eb1fae1b0b6e468a95cc63028b20dddc121e061d38b624b68983133c857682f757ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e649dac9fae90bc9a7bb15908b9be58d
SHA10f14de48af9f022bf9e26d29cc924b6bf080bf8d
SHA256714c347560c895fd8abf4024acb3c69bd810adbc1802bd30a06c0855c93d812e
SHA512c325cceaca8ce64f43813f027c6cd599557e440f53c57a17beb16029fe3b18aaae3a070aad9455fa153efbe29a3e3172c84ad1de19b309d31b7d9583ea99c608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c6338a44febe67a46c921b277b68be8
SHA1d7c439ed091c914b977d25c39cd0b71051789cbb
SHA25692f43807045155667170be1edaca3029911bf8a8db7ceb49882807c0da9f34aa
SHA512614fe052c2b032bf1758fd57e862cd1592629dd90fc1473984fc8798521d4a18e9d10bcd7efb31bac7e794cae90b5f7b2326e3019a06db81cb3f65d0240c03a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb0dddcc475a40156eda4bd93153127c
SHA11a542374ab65bc12903bf3f22f768984496df8b4
SHA2564ee34ee46df50cd0fd998a5a7b11f1a7152f5a1a5582268460088740ded7c7b6
SHA5120c035451250fe302c406e67b27d54a94d46847f540b9c2c9986f876e6315cf1427a07e6c381e9003933cff21506e01e50c903a6293e268e092be36098e67117b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4d62f698210a08e3e678444edc1d196
SHA1c64fef5408e4fc09c020d09efaf8a822cbdaa028
SHA2566935f4f54d985bd6df6286b94b52225a968ee3893d60f75470ddf56cdfd9085f
SHA512297fcab4641ad84be80dc9e1009e6c230df98ef8b8740abf4510cbc6021cd4f649d0fe771a27fb3cf6431fed66adf8fc1bfbb1180b3c00edd773e468ec6f4c95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e892a7c5027a044491b1754a70857ea1
SHA14603badd22900e6c3401ca7b4e896da343c39423
SHA256e9df318a7e2daf76f87fb8949f06d5d69668a7c56a9ee2ab3810893afbd8f7f1
SHA512e722b190f4ea5081828654bd33eafe1ac2c9a2d452996906bcc9f5d517fca91a17f1db6480939ebf608af72a6d23f92021e1205c7445112954984f07b711ac0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebdc05840246af0bd5a3437d170aa182
SHA1f253efa64bc20ee4933b290c7b9dd82bac92baae
SHA2564732017d384a89553a88500aabf33bb4e7b1c8d21c40085102781fd4499a0cbd
SHA512311f3972fee069a87e0613646ea542ba4e6f3d89205512d09c62744baeeb1a107ac5868d1578948bf3f3ecc6218e4d74a2c30219f9ad26290d39f4b049254c22
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a