Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 01:19
Behavioral task
behavioral1
Sample
f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe
-
Size
296KB
-
MD5
f6a1ba8a27922e45ae19322f412f988b
-
SHA1
0cafb1b2e41245a0d5bfe21b47bc5274bb004df0
-
SHA256
41ff787bbc5a98affbb97056f9b35a2ee29cb9c51ca7f6c30b30ecf5ecec2459
-
SHA512
19061367e6dc542c6646d569a45d93852d45c6327dba35b7e24021e45e81d1517f7f3f9961abbd1fcc4ce4342acf73894b1851ea2ebe74b4fb03fc569c4954ab
-
SSDEEP
6144:fOpslFlqJhdBCkWYxuukP1pjSKSNVkq/MVJbT:fwsl2TBd47GLRMTbT
Malware Config
Extracted
cybergate
v1.07.5
Cyber
hostname4630.no-ip.biz:100
X8N8W40IE10BDO
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WinDir
-
install_file
Svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
mavsrock
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\WinDir\\Svchost.exe" f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{RYG0SSAT-7H06-H1UD-BRL6-H4040X7G5UMG} f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{RYG0SSAT-7H06-H1UD-BRL6-H4040X7G5UMG}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe Restart" f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{RYG0SSAT-7H06-H1UD-BRL6-H4040X7G5UMG} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{RYG0SSAT-7H06-H1UD-BRL6-H4040X7G5UMG}\StubPath = "C:\\Windows\\system32\\WinDir\\Svchost.exe" explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4916 Svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\WinDir\\Svchost.exe" f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\WinDir\\Svchost.exe" f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDir\ f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinDir\Svchost.exe f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WinDir\Svchost.exe f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/4460-3-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/4460-63-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/1848-68-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/1848-67-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/5064-138-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral2/memory/1848-158-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/5064-160-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4228 4916 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Svchost.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5064 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1848 explorer.exe Token: SeRestorePrivilege 1848 explorer.exe Token: SeBackupPrivilege 5064 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Token: SeRestorePrivilege 5064 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Token: SeDebugPrivilege 5064 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe Token: SeDebugPrivilege 5064 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56 PID 4460 wrote to memory of 3424 4460 f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6a1ba8a27922e45ae19322f412f988b_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Windows\SysWOW64\WinDir\Svchost.exe"C:\Windows\system32\WinDir\Svchost.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 5805⤵
- Program crash
PID:4228
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4916 -ip 49161⤵PID:3640
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD54a4015fd5248da22a68db2857518e7e7
SHA166eaf6d47352d1048fd16b673593f84f4c05924f
SHA256305cdf931110c6af1d48741123c902cf8e5bd8a7d067e9cac447b369771010dd
SHA512909202f6467b21ae2a7fa30c7432fac7f24f89e4f7ee36fa60b773861ba1783f81c54a74e2d46aa355616e89378f84d12130f671b0a2a7869944a8439f217f23
-
Filesize
8B
MD5bdbbd36965f6d61abdee2d1f9c2308ca
SHA150293c5d172357ca0575aa0f417bafcea831eefe
SHA25600f3ac9047df6739243db7e43ef765bdb90871d5dfac9427857d96048b2247cd
SHA512d2deaf856353c762ea977306a8ee8efc11702a6055ef1e76a15a505fc7cb51f8ce569eff77248c8bb2fb774d8673397f36ffcaac7c975999bf4c36efdebebef3
-
Filesize
8B
MD55cd541fd4dd5536812c4496558886319
SHA1d93f0214854c0f65c64fc5c5f91a714858d9dbf3
SHA256876aac54af11a5201a00789308ab92ac07972ca8dc0260f0b0546b6c7b0af803
SHA512a2231c948e0f00b48166f81f69e60afa94b072a0536c629b140abdc132a88c7a7eb5c2897e43fc34029556c7ecd4c922bf05f2ae57ca5eb557305107ce9cf404
-
Filesize
8B
MD537252b36e0723cf8e349e17221c83a50
SHA15486ab4c653c1eb7c6fe844ef935323ad29a9d66
SHA2563a258cac4cd6a99014b892645887aeeca040630d65afc4a526405d73a3c1da7f
SHA5128f9e9a5d74ddd5424d8a1740038bfcf00e327aeac12e6fe2c696c40c4b1b409d2de3884cbe716b8642cfca265d6ebbf3b133efc297c80dd72125e98d9e4dcb01
-
Filesize
8B
MD5ac3960e9a102b60c6085e9870a7d1013
SHA12de1b10808b579d96218523507e7afb46d952058
SHA256c407e9fbcaa1cf541cc063e3a6d778e85551e027cb1f8fba3976fd3bdc0db1cc
SHA5121b4998a8c38085599c19296344019cae15e6ccaa474a7e4bc0eb53d1ca760c99f3e575586fadf59be9dacf0e68c08673804ba222c59bc3991b2aaf78cda3132e
-
Filesize
8B
MD566869996d4c1c069c8f7d110f69735b2
SHA1a3af38a5edc0f5e020b0bfc4a40ecf9a53b512a6
SHA256f981ac4382af0a580820eb6949fbd4d08ab5da9dd1f4593a72fc18fb1f9e0761
SHA5120c0e97a6ddfc2614c2076e04157769855cb286a4b3aae79ce9b554056ae2c1f8c54ff9e3e96eac1e35ed7058618b76f470132cb12a48c0b36a121014cbaec2d8
-
Filesize
8B
MD5b85ce8bc436f465a67527cd1265d54ef
SHA15c71b5d489a329225256dfbc82c54f51cede55ce
SHA25613b0c40abc3b46438ee45b7421a6658bb7ba22ac64ef9e80059843d16d0f5e19
SHA51259bb54ce70492a382cc7f1235a3123062a373a374269a20a0382e282dbe9a0fc83cba590a4d9808c6f33c7d2a6211e812f3474473624f926dde1ae25af3e4d0f
-
Filesize
8B
MD54bbbfad545f7a80d84d19d61cb175b0a
SHA140e4d6d4b6d858a539b539a48d3cc6fd83e91885
SHA25678adb6499a73ae6e8d744b2dbfacd3b7ee06021752b8b25023c2f90f95f7471a
SHA512f2d4002c0fbee8d06d3c2a230dcd4a41163e9d8794e6f63ad19d5af2b37e326f87156c9f9a1889f54d3bdb6b18701752709b8c86f7629ac78f6ffe8fcb1ef108
-
Filesize
8B
MD5c8777365eadb0f512dc84c056f32e227
SHA1cd9d965004f5b196e43d937b0ab68052e89f887f
SHA2566655dc5763e368c3fea53c75a49b084f14fc3ec2c17dea997015a4884dbad0c5
SHA5126f41fe45be33e161b76b16e851288a6af3b1aaf925c29afefe942681ca5137c63cbfa8102c59244d6d632f9782bb808442e51331dfe5c3514d6085b7045d99a5
-
Filesize
8B
MD5944ac91028b82aef794bd04005e524ae
SHA1d0b59af6437cb870fc158624f86a93b0d0cad0d7
SHA25682edbb66ddb69b4d193a03cd8037f1cad444037bec1eca6686f86ced86087994
SHA512cf114937016f1ca8e9ef98abecd75fc3d171e2cc9227bbe306c411160873d704c62e88fcce508dccaf9a4f6b256bc827d17bc4f565b077388cc8e2ecf37a1b97
-
Filesize
8B
MD5c83e8c381e2bc36f69a459f4159d1827
SHA15db51c6008785526f7532bfcf66c74565ddebc92
SHA2569217e47566fc94b7e83c9b5afed11ce92c335328f79d227a527e45bd5f500b73
SHA5125316cf0bdba15c30920adf8c6ba1075dacd28dcbddde8c660c4ad5dc048407869ab755da718f5cf1dc73590f6df64ab51e7714378a1e6fca081f6a3cd2c820cd
-
Filesize
8B
MD54fa81249bd9644e2fd6df8f931a8cf5e
SHA11493400ad6909c5d158d49465761ef408b6bd40e
SHA256d1f8491be9680ed4efe8e0bc314d5f2efc201b778c9d39e66e05efe068092261
SHA51211b812f5e52e85feb489071a8162ec0f68d938af3143cedeae60b032f2450e8efc8b88dca8116406dbebf020749d0825d4daf1eb36cc86c431964f8d0e4c1d20
-
Filesize
8B
MD5be7986255db46ca4ae0ab08122904c0b
SHA1a0499bb8b6bc340e25bb4039834cb2abf47a39ff
SHA25675fac7314f8f00c470d6d9f8f8e3957515561fab7ece90b08004a4f90201e232
SHA51203a6605d500824e69f761275511be804b8892563a6715de74baeb95131831932585d36e956f14d6660fcb63cc0f2dfaa9d9166acf21189c22eefc1cc1b2351d2
-
Filesize
8B
MD5354a28d1523ddd6146ea0db4d00fc065
SHA1b9184d92eb64ab237046e1fed4c7053201e5609a
SHA25654ce69828bfbe78ef77e5fd9ff1442cdf462ff2f3809bdef5bd4293c602eb81f
SHA5125bc4ccd099d1a6c7b9901175a5384e6da21f94ea77f5362c0a988c22c8185582f09cba6d836e52639799d84bc5b3c1535f2413218c59d7ea1ef216fe2455d43a
-
Filesize
8B
MD5b57617886d3fd708476825845e48669a
SHA1847bc645a24b9f192676cbe20cf51c0f471558f5
SHA2568c15e444eebc75284601e28950c90be95a8985071b96b6d0563dc2454b192b13
SHA5121bcc058780fdef05d3a2804166cd43af1fe619dd06d3fd7caf66a49ee4f72916241d550ca0462068a5167d8059c793c4942002f3c3900423ee1ee5b921984216
-
Filesize
8B
MD5e570b3195aa62d4f188f13f58ca1bd71
SHA16942b372aee3e73e5d9076d9e772d6789370f766
SHA2563af151e4d7b3c9ae7f066a0ddb8db202af17796268eb061a86fdbf0b9418daba
SHA512f8483df67a01c86463f40e750bef72ce7eec85620fb085eb5b1738399bcbd974cd5d313b0eaf1a2cb89456dc3f9254ef164f58431588e5ba6d4b9128dd5de7e8
-
Filesize
8B
MD5d33366059e19bcaad22546e0706f7559
SHA1467b5dac05e0b8ac65f6cd5a715f6dbffe66c77f
SHA2560ba5edca31003be166c7105751a7262192ea19659dabda98049da75647ec6518
SHA512a7faba3235d8ec3b60c585e4da932323d39e195a4e0899681aca448062409805e3578b346a84453c3fd8886de5929b183b58bab45d3d3430e6ca23cdb456012b
-
Filesize
8B
MD5a5b17ebfc5f60df767e6fafa992c84e8
SHA1957cffb46915e3f933dc846d7c04909c2f40bcde
SHA2566d06ccb703e22b5c62edb3ed68242018f1ec7370c3f6302d2862297e05f99461
SHA5127b457b7eb2ba6ca9127d07f6e3068097ec543b208945b526c7bd5aa4cd254d704ecdda7752c071d4beb20bb83f042c7aa31fc8ac64598f293f127fa02620bc64
-
Filesize
8B
MD5209e36b3d255811acfa45a97d2596674
SHA1c6f22f9687cca5adafad9a8ce1464ebe5e12f04b
SHA25657c61f47e95bdd5d8c5c684d977bbd87a1847d1aa8ad67e12b8847183d8511a0
SHA512519e80898406745be1b64475c510f0105ff4163c4ef2e3146cdce8e1652a2a99ecc9611226a2330de7fdc734d3e444a12859ed83ed882b2bca77846cc485c8fd
-
Filesize
8B
MD5c7875e0694440043905f99e65a0f0a72
SHA11d24184134bbe640eb57c2964d31d5383fe74889
SHA256296c8d151a4ef71b92c44044e993f61f1ca7432aea2656193c716825040abbf7
SHA51217ac2a212f6c24aca4858a2b207d76a6f0564cf0eda08d87bd3d56fdd68344b2b2f0c10be2ff56dcab46103f1403fb35c110b4ed1d6b60a417757c486fec3d63
-
Filesize
8B
MD57a706db4ba00069326c82fc055619f3f
SHA16b4dbdbcd09cc37c6c5c74f4dad198927ca3caec
SHA256d4a76854ffd6a840b0fd21759ecffd388dd713aa48852b693296d837d9d3b40a
SHA5120cd6741915f5442f0367760b54008aca8fc511dd1fe5dad6ca3c9208eeb8a46c9cdb173884b41d4d811527c2e8ea70853162c2a162203ad2f9029c43cfa86eaa
-
Filesize
8B
MD51857619ca5e840a86d80939f43b97155
SHA16ee409dd7fbcc485ea204486d7cd08daa25f8a4c
SHA256d2807847afdd7922b477a8477a7378d9ad0ebacf130e06afe0c4621cb36689fd
SHA512ade70fd4ea6b47f629e5bb9d9ff45df20825282dba8420e31c45e3efdde51e9f062750a0d4892bb3eff5d8ed22a0ce5977de7f55150d52a8288920352efbc43d
-
Filesize
8B
MD5c58fe4db73cb2a6b7aad65ce6ba1e706
SHA1d0e7cb57a391e9b8b5b4720a1e9db492c94a24f0
SHA2562cf03f75f7f63a3c690e8066f309e66cf37ac2b4c454a91ff452a366c981ee19
SHA5129d63c34fb5af5a662465472bd201b8289c28a35e530c726a9a758b3e4cbdea6856eb42609ab761c2bb38ed7f982f235afefea713ba0fe22479e743d41de24113
-
Filesize
8B
MD5e97cb2c15ac1a7013e35a7cb627e4bb9
SHA1e962663d3b12c9205f2af81b540649c71eda85a4
SHA256dd7bdd1a535a27c01e7c7ab48904f90228249c7c4854dea4123a417555f6db9b
SHA51241bdd87ca2369421b4f9a1c47e6370ee75400ae4a4b8e709ea207f4f62415fc89960405c218ee5842616674b6fc89ee7e7cac362221fd26ba25e929276e2f040
-
Filesize
8B
MD56d0a8ea719639d73e695fbeccd0832fc
SHA10542e9d5257c50443a3667e84175bfe12b6da23b
SHA2569ac3283c14111c7f7a65ea55c5fccae88d8ee1fb3cd586c7fde5c9a0211e7414
SHA512512da21799aab68b888b785d24cb2a580c5f8191604616377d96322b3edc74c4e064b4e476b325a595e38e40f005ae28b12c3c05c05591b2f7feb403119a3265
-
Filesize
8B
MD538c857a5ef8f71da3632cbedeaaac6fc
SHA1fd2fd39878422a54e2dbb3dad312eca528374bae
SHA25673a193078d6bf088fcba52f67e84c98b635b15baee7077f5de4fd03148006425
SHA512c675fc06f048e76644e2385ed33aeef9e272cb6fe83c02fc62fdebe6c59a657717473fe9a97b1f78001ed7a82701084b668ccb2c9114f706882ab5bdb421673c
-
Filesize
8B
MD583c167c97459801d6206284df115e451
SHA18e5616717e191b39f821b539322fdac7c840f7e3
SHA256e924db7936d772d859b6b9e9cfdec1fc6ab04323013aed7dfd8dc65c8bcdf864
SHA512a3e4597179a99e2858e7b9ff21da6f4b25e2255a0392a27241d8ada149b3b04b10c7aefd389b4c17c52e3c496e9042d3ed0a71a42037244ecde3e0ff5e69b5ab
-
Filesize
8B
MD502ebfb4c11a70c2257876a293cdfc06d
SHA12ca4016b64a9a0316c4be11dbb43f2bb9929d5a4
SHA256175ad0972f9dff60cfa01174fd5be1127e1db21194d5623441920322004cba94
SHA51223d11d7b32f3cd6529e4b2f93166160a93970bcde1b563741e259aec2de6110cdfbfc043d9138df568e6c0025d47fa7b1e53df2ed97a60817c8af1939b96f2b5
-
Filesize
8B
MD5b769db75cac52a4b32d0c955d0db47b3
SHA1f5df87b28d67696e79dd62f1be4136b763989b28
SHA2561dff7f29e7bc02a38f1202e8f5140f487dc45c7e42aa9c50a1faaecf8f4e3372
SHA5126f9e1f765f82fcd00b319cc53d762713e485e11b4e57fff32df89c552a63287158229d1edf74dba443ba63504565cb7c1b76ed8fbc2f4d1e6d2416b851b2a31f
-
Filesize
8B
MD52f3aa34d498988fcb67bc8e9557d6785
SHA1f5dee627b02565a644a4944cde7cc6f5a0924cf9
SHA2564d00ee5fe293356bcc56bc90e1db7137e4287d406bf2706d34df1c8150bd609a
SHA5124f53504f306fb88dcc54c554e1e1e8984f3369f9d32289f9002ced6c4ff3e3529e31ac13bea260f7367a9145a13ed9ef8ec621afb50095b858210c8b0feac968
-
Filesize
8B
MD51046a34fb2af9bedb62403b1ea3505d7
SHA1cbbe7e01e6ede15788d3fb74275640e4f622e9b6
SHA2564a93b6191148fbca7459d2f89fb36dcda433474b15eb937fea4a55640d3cbafa
SHA512c3f7cf20bb1e76b8e9dcb89c4bb4563ed8f97dcc2d4db0a494552c3422349b0bac593823a4c5dfb2e608925299c14badaca1ff5e56abf21246ca7884b7867e4c
-
Filesize
8B
MD5848ef5d3adfa8a2a7044ed74468c9faa
SHA1ea5c89181b452b45cc7e13a07353c19a167f152c
SHA256233fd1f254f5ad6ac01bf69b198fde82a90e8af71527fdef117a2bfa10e6e720
SHA5120b2867671e4955981df2db1d7aa11e2c87238cbc948c05477527338c81b863d744b5979eb39b4114b10bf98b5934d958c03f70665113214a5f6bacde0d2215b5
-
Filesize
8B
MD52aed44640c24ce7e41ba2e4f37696e93
SHA140f5a00175aec3d7ec8fcf2ad825c430daaac991
SHA2560fb5f6c15aa07f10935b94be837cff76374536eb9eef42304b43f09ef651640c
SHA5128825cfe5f425db70d1eab758fd5a210ce3c2170ed797989beadabea640152d23577283d449f941a06f802c3421e85c9eea904dad1fb6b78f57f4bbde12d37aeb
-
Filesize
8B
MD555b74b3fb92e0ef7bee93925be0d6efc
SHA1a40dde2afa94d4d6b7971ae56f02d411c7762744
SHA256ae552fa05c02298d64c6c882bbfd70b02bb753fc6fe6090b31a1a8cd5d1c65a7
SHA5122130abba6598ba213c24bda6cecd4a00e403b775a94cc61f58fb26869c276915cada763eb41565be47f5d21608a6484cdbc7f049cb4efc3dd7da69b13b8ac981
-
Filesize
8B
MD5dce8935b49c195121a66a1cf9e6df47f
SHA151a225cbca836652dcef2ef06c2ffb2c44441b95
SHA256639f670d2efdef4d0e493581012ddb85e45dd76a77d4d81896d7efd611a308e1
SHA51246287c0cdac140dd8328b825b487d3d26311b2fc3324455c0fe37acee29f626195bb6acb6fa2e06e95dca12bdb3de87c1cdacc0175b582a80bcf90dd20988c75
-
Filesize
8B
MD5cc4cbe029b824069b7c7e6538e7caf79
SHA17175f5d69c87bdd80b6758bd5bce8c6c4f2efe98
SHA25691f54818aea503cb6ed0c1a13482f271696e4fb2a273034f5f1f06f458ef7a3a
SHA5123e6406cf787f18d13ae52f9635335a0b546a651b531ae1425009513ad58e479d9af047158cdb05258691f9d51909fd0c1e2c3aa43c9f8f2f26553edfda5ef406
-
Filesize
8B
MD51465e969d9062943aff31cd168bed46e
SHA15ad1fc11858174de8d7edfc3341bc8804fccc77c
SHA256c620c2105d2584ce898c6f31ce3846435199ac754f3e81085dbf4396231060c4
SHA5123fcc5c09791ce4bfeb63ef2b9f712306db05613cf82370df60c80b6c021941558178390ff384fafbdef793a8e8ee8159c602bec6fdbd2bfb30296405a27e1c3d
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
296KB
MD5f6a1ba8a27922e45ae19322f412f988b
SHA10cafb1b2e41245a0d5bfe21b47bc5274bb004df0
SHA25641ff787bbc5a98affbb97056f9b35a2ee29cb9c51ca7f6c30b30ecf5ecec2459
SHA51219061367e6dc542c6646d569a45d93852d45c6327dba35b7e24021e45e81d1517f7f3f9961abbd1fcc4ce4342acf73894b1851ea2ebe74b4fb03fc569c4954ab