Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 00:44
Behavioral task
behavioral1
Sample
9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe
-
Size
379KB
-
MD5
9edcd10eef30eee0315732ac3f22a717
-
SHA1
1c9766b8871a607a9f400e6a276c9865646f63e5
-
SHA256
4580ae34fdd3bb1b72ab5a734a74356ef68d8df0d1d033334ae966c61fe228e9
-
SHA512
3168f4068de89333fa12670ff2acff8cebd789c0c627438df75dad58d85bfd6f1fcce5bdfe09b8f07c560856d7b5a33b5c4b58bcef9da171ce5e87263496a2ae
-
SSDEEP
6144:N6ZxARAW+fYtScitAW9DJ1ECOCHaR4UDFJWo3LU1Zpc3nT3QZ28a/Tk:N6ZzJnF9DJjDnQFJZLwZ+3nT3Q085
Malware Config
Extracted
cybergate
v1.07.5
cyber
iconixx.no-ip.biz:1337
561ME6H74DCB56
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WinDir
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34K62T7D-CS35-1R7Y-L00R-21Q405T14XHO}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{34K62T7D-CS35-1R7Y-L00R-21Q405T14XHO} 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{34K62T7D-CS35-1R7Y-L00R-21Q405T14XHO}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{34K62T7D-CS35-1R7Y-L00R-21Q405T14XHO} explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 300 Svchost.exe 2520 Svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 300 Svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Svchost.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinDir\Svchost.exe 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDir\ 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2084 set thread context of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/2084-3-0x00000000028C0000-0x0000000002921000-memory.dmp upx behavioral1/memory/2084-301-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/2084-304-0x00000000028C0000-0x0000000002921000-memory.dmp upx behavioral1/memory/544-541-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/files/0x00080000000186cc-543.dat upx behavioral1/memory/2808-896-0x00000000069A0000-0x0000000006A01000-memory.dmp upx behavioral1/memory/544-903-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/2808-906-0x00000000069A0000-0x0000000006A01000-memory.dmp upx behavioral1/memory/2808-907-0x00000000069A0000-0x0000000006A01000-memory.dmp upx behavioral1/memory/300-908-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/2084-1956-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/300-1960-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 300 Svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 544 explorer.exe Token: SeRestorePrivilege 544 explorer.exe Token: SeBackupPrivilege 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Token: SeRestorePrivilege 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Token: SeDebugPrivilege 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe Token: SeDebugPrivilege 2808 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 300 Svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2084 wrote to memory of 2576 2084 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 30 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21 PID 2576 wrote to memory of 1424 2576 9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9edcd10eef30eee0315732ac3f22a717_JaffaCakes118.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\WinDir\Svchost.exe"C:\Windows\system32\WinDir\Svchost.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:300 -
C:\Windows\SysWOW64\WinDir\Svchost.exe"C:\Windows\SysWOW64\WinDir\Svchost.exe"6⤵
- Executes dropped EXE
PID:2520
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD50b2eabc8bc31f5ad7a2205e605aa4001
SHA1273b8cb0b8783fe1e6a3eeeaca7be2a1b0fc08e7
SHA25688d2aa53dfffa4aaba71b317723ae480688c31f3066514defd4d7ed706ba75fa
SHA512a434740c47125ddf17005c080442d5a06d7b65f5a966d3d1cd3d5440381227a11b410a0f297106d5ab5aa74f41672f8e07ad9409a17ff877c31e38101a7d7357
-
Filesize
8B
MD5ab1cd1be7245b8d7c7e316049b79b729
SHA10e93a29059b03ac31611925842512c880dca9b7f
SHA256e019a8c0ad3ac39b34ba75bd1dbbf8286c23d4ee15de931a48e8988d746db6e5
SHA5120ac73d4863b8a725d10fde8927c9ff8e5efab620e82edcd1c9e2ac1dcd64c246ae84e8e00a8025a237740df4e84aa36cde995b5a6b73581516168ced84b0352a
-
Filesize
8B
MD58fbe340d1afb07d937701da5b9fbed48
SHA1b0f6b1d4ccd837ee8ba82cf96086afc09da8d582
SHA2561f7fca47e9d607a7b039f616ae700bcfa962a0f87c2ae1817cd49ec10c34139f
SHA512bfb107dd4f2220846801bf076df2ecb6ef476fb6c19e755cc6940d8d2c9cb12cfd0925b925bec0556048a090def213d950cba12f27756a2243f1b1b694ea65ae
-
Filesize
8B
MD50a5573ff86e8fd50a45020969f7111f8
SHA1579bf0660d04dba9afa0f8921abdfc168980e0f8
SHA256a46430e0b19def55cb0492df6c62327161453f5d3cec8ed5f819bd21a45b6b9f
SHA512cb7ab97f88d67b6a52b475fa5a18d22b99a177553e211ecadb62637ec3111b23828cd82a0af6333dec4719c1a8c948856f035c852ba566d6206646507aaf396c
-
Filesize
8B
MD5b5b600086971c724f84b2d4909b3c0b0
SHA10c07330fe549c30208edd5deb76c43745da5fde4
SHA256d1258c3b972c1f5fb04a0be08222241c431ff2eeecb6b41071b15d90dd5464c4
SHA5123d76e4aa5c0d4acc23ba89935f58524d708f7f9577727f7954a5efabf7be3ed0c4ea1601095e7dd19c0e941c130b9905a00b6fa2df6834b135cee0cbf2351f11
-
Filesize
8B
MD52e08430eabefaefd5d51251592fea9b1
SHA166f838db005eb8b627c3bff091306200716a11b5
SHA256a13cbd96e4bb245161043489ff15203192477f18af41b1eb235186a53a52f910
SHA5120e06d3235d8171ed223202191f57a779633ab7c7207e8e62206004f069c0e8ab26fee30e298083cf2c44db1fdda98b2a356e676d8d3c050646ed8ab4e92eaa2b
-
Filesize
8B
MD5ec5e667dd9a5693c96bfba6b29bca81c
SHA15fcac1d4c76997ef7689c9301269b86cb16d69a1
SHA256af32dc5bbbc3cefcdeffa8f84cff60105aed823b3487920ca71f2edde2d39bae
SHA5128d40f165a124b3f6739686efe752058615a295594d9bc8100946e9175b23808c61d478e9672ce406b5363530b8c43abeac257b1bb58b230293ddb26f4a8ea16b
-
Filesize
8B
MD5e7917a13458a3523f01a7093efa61ef0
SHA1b673153244afcf7839c13566e218b70f0205a9f7
SHA256ca30c29aa8cefa46c756331d28ba03c60420f8f60a06546a297bb7dd189a1a7f
SHA512ff07e774f3f34fe0d103269be13c213800a3098100a8631a626e395d87e112a980f2f65bc68ae9b26f0fe431b23672e0b35ba0ff83c3c223ec10dd876075aada
-
Filesize
8B
MD59016d90ac8c2d588f885e1ca80fc0284
SHA1fc4f1d73ad3deb2085cb897d265fb82df3e29f38
SHA256a260599c5440aa9d84bc08e39d137589fe69e9c44b40bd5386ce8a009e297d57
SHA512eac2a4158b0927e859047e3bdf4d9ea95c2f8462b5fab14368e83c992a6657053dbc7f93ff8d0bbeefe821aeebaca01aea206e12a01056bf4d64a3d1123a4a08
-
Filesize
8B
MD5e8f29c114a76904c1bec56523558f480
SHA13869da7398f8540c6f37793108b42040832e89eb
SHA2568cf88c8bcd6ecd7b38181d2dc37affc353923fc51d19d483b37c1bd838110c7c
SHA512225d6a98dc630b008fda883aae0244eb9f4db20d1aca4db83f2655d1762eeef45e73baf753e49b1b726eef2a9096ff045ebcb0e0f5198bd44cca43921242596f
-
Filesize
8B
MD568c5df824ae4268bf00189e96306835a
SHA13770f1c7a6e399e2d53687a54c6b4ee5d926858c
SHA2566981f25ae79db5fde8cfe898e23568d413f62ffefa6d576d2f47c516571015e0
SHA5124db728525b92d512d1ad30a55a04e4227d406f1923e5f98cff175fb48fb663678dd8cb1460d0369567215b101d9fb647a06d6e431dd49e1056084c4e7177f2bd
-
Filesize
8B
MD56dd24a9964d0c502ee3e0138c5aa69c0
SHA1c352f50f02ea5448e91f5db97782053be2d549e9
SHA256051dd9bc64a3ec6605a7838c6f7420491e9f738b2f3150633cd5871c25227398
SHA51218a1e9452353a60260430179078bc1316d6b74f65d31e7366d1ee9983fc7ba8816f52dc73fadc1ff95fbefb2b15437ac8804de2b56eaedc898de9edc429b3b48
-
Filesize
8B
MD5b06c3e4e5d0b40fea52865c2d5578610
SHA17a4d6839181213acc5875ed34d5990ffbc796dea
SHA256e152a2f4b08425e30393402ccee8dd420f21cec80c962e3ebea26d61a33b4ab1
SHA5121868500a1d03c17f0b2029e08091f864668323946fa26fc810e9582ce12847c469d4fc2b440918d31a273d4030cdef2c0554f58653b59310474da94af9e542c3
-
Filesize
8B
MD5e5c38b389548b17fefcf85d3ba507881
SHA1c429aea11a33a67d546c8a709e960cc4d17b7850
SHA256ccbbdbc8d9fb4150f3fc967d2cab4ba0e9e4810b1a537f6cc72aa9b88927a86b
SHA5124f055aed48107be4cf797cd999117e5b91800de6485f60a007aeb5191c4f916348f2a24d9c0866ff91e066fb33ea98716ce65b32f574e2454b8e76a5a4d34782
-
Filesize
8B
MD54fe18d129be8a76253e50c9e4e9b2eed
SHA144411d5f771362b7a3cd630f70770b1d85531024
SHA2569dbba10290f4c75f8e50d43fff55dd11fac2b4003262d735b34c8b7f6f47c4d4
SHA512e6d606f7bb899dbdd72d377b5cd47fc103dc21044c6df035611c29961a70bcce2f7f82fbb42696e78816bbd83e88bc6d2a21e6c5f7532c997376745e28c60ae8
-
Filesize
8B
MD524c603ca291a537a8cde7426e44f6188
SHA1b0862d8709cdd4a7f23578c3f759ad1d8e17113d
SHA25678b6ddbb3a2b534ddd86ff61508a2416f629d47a57d12156ac50683951ffef2d
SHA5121c2376455a28abd109f5a8beeea240dd01bc30132c1c306c478325204d4c0b2bedce12f31c6799839d3a72a55af58b0ee5fb5ad98d4a7cd30852f670c59dae37
-
Filesize
8B
MD5e155c5d4d3cf724e09b56a70dcbe1bc5
SHA1f66006bc746470cce62874ceea529ec0e81d6e90
SHA256b5c53b20a3edd4577e2fd2c5ad858e732c4149047d751bdab78b2867f9e5ebd5
SHA512351d7b33d169e5b57b4a8926ace6287ac28b3b20dda062a5c35b5b7767da8e4864e08c8d263e869076afcee712a793d87c409c9bff89bc4f392cb9e06ff2a695
-
Filesize
8B
MD57e38094d3fdc6f67adaa87744f3cdb81
SHA1e0118cc508dff07a39c57fe267e7cee9604477b6
SHA256004c533bf66bfb5b6487534282a16b5cdb050c003344eb325ae2337afed2b89f
SHA51223be5686996883b9abfe0c93e54819a5ee1a2794a6c7a9496f81bd0c11590368447957b43789ace88f24faa7890ae56b052f245e4f7b8d20fd7f04d9e8289d3f
-
Filesize
8B
MD5cf3255b5a31c1a4cb89104fed93ebb59
SHA1b5c4c4da79ece044052994a7aa0a3209e1a06272
SHA2567314d278dec5068411ba8441764bd3cc13fa63a184537b922f6fcf193b72e71e
SHA512eddd53d410c47cab57da43a67c455b0f3ef3d301491dbcd7c04b7a14c8fcfb9d583f3c6a0f1b0db2081ab11bf42acb141b0527a4fff16ee53b9119ddedb7edf7
-
Filesize
8B
MD5d20f549a58aeada187b437c2650720d8
SHA1c71b24d808c2fb3f137f99e229ef404359835343
SHA256314a8c2ce7234e63ca1d9bb8a357d13cab27d10f263b7b6ea270471f022f4f35
SHA512d38519c2278ae8b2c9defbd6945d2a09c06898dc80b265c5d55fa004c1e0e463e5d26e397ad03aa8be5b3a81bfc1e3468352caacb3991797cdd8119e85ce494a
-
Filesize
8B
MD5df13addcd7578d03729f2a21cb163de6
SHA1bb53445824aee14f720fadf96093e7a2c0ba8e87
SHA2564afd462e335ba3c1b8180f236b6a13b9c1d4d4991052a4bf27d45132b02143d0
SHA51253f6418aa4764cccb5fa8304c5791cac5d25f8d5520fe586f61cfe35e3cad7a13670716b89d95a3a79ec6e83b123f43545ed39b4d30a322b29e30955a8331217
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
379KB
MD59edcd10eef30eee0315732ac3f22a717
SHA11c9766b8871a607a9f400e6a276c9865646f63e5
SHA2564580ae34fdd3bb1b72ab5a734a74356ef68d8df0d1d033334ae966c61fe228e9
SHA5123168f4068de89333fa12670ff2acff8cebd789c0c627438df75dad58d85bfd6f1fcce5bdfe09b8f07c560856d7b5a33b5c4b58bcef9da171ce5e87263496a2ae