Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe
-
Size
393KB
-
MD5
d5a4b88bed3a38f350ca15b8c79355d9
-
SHA1
4ec772a58fd5810ca7ab9272ae55e95c144a6815
-
SHA256
3061e093987b420788e4e77535589b50d63c74aa8d658183b891bebb231795fb
-
SHA512
1e0b19b8974970242ad2e23d4f95b7b4c653430fafc6c170fdbb696ef5eac4cc3beb63f192f547fe8dcb3909d5be6d9913b784c78eb23534e2761dad0299a2a6
-
SSDEEP
12288:5c/m4JmYYkJUL47Botwz41mRtnJ2fRfvWuA74:5c/m4IHBLiBotKlJ2dG4
Malware Config
Signatures
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3560 Server.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3560 set thread context of 2840 3560 Server.exe 118 -
resource yara_rule behavioral2/memory/2840-47-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-46-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-49-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-50-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-52-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-53-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-54-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-51-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-56-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-57-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-61-0x0000000001610000-0x0000000001715000-memory.dmp upx behavioral2/memory/2840-62-0x0000000001610000-0x0000000001715000-memory.dmp upx -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe File created C:\Windows\InstallDir\Server.exe d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe File opened for modification C:\Windows\InstallDir\ d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe File opened for modification C:\Windows\InstallDir\Server.exe Server.exe File opened for modification C:\Windows\InstallDir\ Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2840 explorer.exe 2840 explorer.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 2840 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 2840 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 432 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 82 PID 2428 wrote to memory of 432 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 82 PID 2428 wrote to memory of 2420 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 83 PID 2428 wrote to memory of 2420 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 83 PID 2428 wrote to memory of 2420 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 83 PID 2428 wrote to memory of 4916 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 84 PID 2428 wrote to memory of 4916 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 84 PID 2428 wrote to memory of 3860 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 85 PID 2428 wrote to memory of 3860 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 85 PID 2428 wrote to memory of 3860 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 85 PID 2428 wrote to memory of 4672 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 86 PID 2428 wrote to memory of 4672 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 86 PID 2428 wrote to memory of 2336 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 87 PID 2428 wrote to memory of 2336 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 87 PID 2428 wrote to memory of 2336 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 87 PID 2428 wrote to memory of 4412 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 88 PID 2428 wrote to memory of 4412 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 88 PID 2428 wrote to memory of 4088 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 89 PID 2428 wrote to memory of 4088 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 89 PID 2428 wrote to memory of 4088 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 89 PID 2428 wrote to memory of 4540 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 90 PID 2428 wrote to memory of 4540 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 90 PID 2428 wrote to memory of 916 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 91 PID 2428 wrote to memory of 916 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 91 PID 2428 wrote to memory of 916 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 91 PID 2428 wrote to memory of 2964 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 92 PID 2428 wrote to memory of 2964 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 92 PID 2428 wrote to memory of 4732 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 93 PID 2428 wrote to memory of 4732 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 93 PID 2428 wrote to memory of 4732 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 93 PID 2428 wrote to memory of 464 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 94 PID 2428 wrote to memory of 464 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 94 PID 2428 wrote to memory of 4832 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 95 PID 2428 wrote to memory of 4832 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 95 PID 2428 wrote to memory of 4832 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 95 PID 2428 wrote to memory of 1124 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 96 PID 2428 wrote to memory of 1124 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 96 PID 2428 wrote to memory of 2788 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 97 PID 2428 wrote to memory of 2788 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 97 PID 2428 wrote to memory of 2788 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 97 PID 2428 wrote to memory of 1948 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 98 PID 2428 wrote to memory of 1948 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 98 PID 2428 wrote to memory of 2204 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 99 PID 2428 wrote to memory of 2204 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 99 PID 2428 wrote to memory of 2204 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 99 PID 2428 wrote to memory of 436 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 100 PID 2428 wrote to memory of 436 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 100 PID 2428 wrote to memory of 4288 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 101 PID 2428 wrote to memory of 4288 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 101 PID 2428 wrote to memory of 4288 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 101 PID 2428 wrote to memory of 1216 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 102 PID 2428 wrote to memory of 1216 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 102 PID 2428 wrote to memory of 3656 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 103 PID 2428 wrote to memory of 3656 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 103 PID 2428 wrote to memory of 3656 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 103 PID 2428 wrote to memory of 2544 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 104 PID 2428 wrote to memory of 2544 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 104 PID 2428 wrote to memory of 4300 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 105 PID 2428 wrote to memory of 4300 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 105 PID 2428 wrote to memory of 4300 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 105 PID 2428 wrote to memory of 4736 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 106 PID 2428 wrote to memory of 4736 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 106 PID 2428 wrote to memory of 5012 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 107 PID 2428 wrote to memory of 5012 2428 d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5a4b88bed3a38f350ca15b8c79355d9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:432
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4916
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4672
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4412
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4540
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:2964
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:464
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1124
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1948
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:436
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1216
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:2544
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4736
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4360
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:3876
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:4708
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:1620
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵PID:2176
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵PID:3040
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD593e00066d099c0485cfffa1359246d26
SHA1bc69a773f37b2f2071e25f755a66d47b871e5d98
SHA2563b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde
SHA512d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02
-
Filesize
3KB
MD5ebcffeacd1132ec28c15e761dd00dd8d
SHA1d2dc07a7c6cc2c45f6edfcddd4036dc74a3b32c2
SHA256f1099d99bddcfc16036610dd03a1871c8b3f25d5c93afd01360fa34ccc1b3e77
SHA5120c8f72e466d42c7d73c477904feb8c422d27a8e5fb406d6c4a2c4117ab31d42cae1a3cc2eeabb4db61d38efea7897fec350d586abab898e16030e3833f448286
-
Filesize
346KB
MD5b6d63330959896290103db9786bd33d6
SHA1b2558e1b4c6d9e012801a6e6564cf44fa16d6d14
SHA25638d68f85dd0d99524efb7b537ce8fc5c7494126da1455a8d700cec51ef021c24
SHA51254cd768f2df8e7e570a95073e1727465c6c22945334e33b835608b8933ef81d59eb33b3b5b434dde5c8b2f25130b417a076916fa4b7fcd9c33a133681cecc9b2
-
Filesize
393KB
MD5d5a4b88bed3a38f350ca15b8c79355d9
SHA14ec772a58fd5810ca7ab9272ae55e95c144a6815
SHA2563061e093987b420788e4e77535589b50d63c74aa8d658183b891bebb231795fb
SHA5121e0b19b8974970242ad2e23d4f95b7b4c653430fafc6c170fdbb696ef5eac4cc3beb63f192f547fe8dcb3909d5be6d9913b784c78eb23534e2761dad0299a2a6