Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 02:55
Static task
static1
Behavioral task
behavioral1
Sample
f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe
-
Size
816KB
-
MD5
f6f9c33064c496d8faacf49864d8d1e6
-
SHA1
61c0353c728115c06534efc2db99138a242b9fc8
-
SHA256
b4582b84ab4f35c9748a7eb46af56e284809d8d0471a5bdf7945b87f466d5794
-
SHA512
b2b4d2d4736ba73bedad6ae45d9d30065d6a013b85f6d86a91e5640f7b3333796d6f4aa10db9b283872c2de359fae62d84c3dc401b87dddeb775b82b8203c095
-
SSDEEP
12288:x5ngB47RTWRuBFmmSPhyUZGuBiRS0CvJ5tD5iX4RtZXChQU9L7n/Ni8+:T/9ycQP3ZBBiR1kntBZXCW63/y
Malware Config
Extracted
cybergate
v1.07.5
remote
hugo.no-ip.biz:82
D47P362W00EULC
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
cybergate
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1Q8JA741-CYQ0-XRC2-0KHD-3UA8O83W5X47} FIRSTO~1.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1Q8JA741-CYQ0-XRC2-0KHD-3UA8O83W5X47}\StubPath = "C:\\install\\server.exe Restart" FIRSTO~1.EXE Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1Q8JA741-CYQ0-XRC2-0KHD-3UA8O83W5X47} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1Q8JA741-CYQ0-XRC2-0KHD-3UA8O83W5X47}\StubPath = "C:\\install\\server.exe" explorer.exe -
Executes dropped EXE 6 IoCs
pid Process 2428 explore.exe 3060 FIRSTO~1.EXE 1540 FIRSTO~1.EXE 2240 server.exe 2100 calc.exe 1940 server.exe -
Loads dropped DLL 6 IoCs
pid Process 2580 f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe 3060 FIRSTO~1.EXE 3060 FIRSTO~1.EXE 3060 FIRSTO~1.EXE 1540 FIRSTO~1.EXE 1540 FIRSTO~1.EXE -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" explore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\install\\server.exe" FIRSTO~1.EXE Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\install\\server.exe" FIRSTO~1.EXE -
resource yara_rule behavioral1/memory/3060-18-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/files/0x00070000000190c6-17.dat upx behavioral1/memory/2500-575-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1540-602-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1940-943-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1940-945-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1540-939-0x0000000005E40000-0x0000000005E98000-memory.dmp upx behavioral1/memory/3060-924-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/3060-584-0x0000000001CE0000-0x0000000001D38000-memory.dmp upx behavioral1/memory/2500-946-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1540-947-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/2240-949-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIRSTO~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIRSTO~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3060 FIRSTO~1.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 FIRSTO~1.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 2500 explorer.exe Token: SeRestorePrivilege 2500 explorer.exe Token: SeBackupPrivilege 1540 FIRSTO~1.EXE Token: SeRestorePrivilege 1540 FIRSTO~1.EXE Token: SeDebugPrivilege 1540 FIRSTO~1.EXE Token: SeDebugPrivilege 1540 FIRSTO~1.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 FIRSTO~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2428 2580 f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2428 2580 f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe 30 PID 2580 wrote to memory of 2428 2580 f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe 30 PID 2428 wrote to memory of 3060 2428 explore.exe 31 PID 2428 wrote to memory of 3060 2428 explore.exe 31 PID 2428 wrote to memory of 3060 2428 explore.exe 31 PID 2428 wrote to memory of 3060 2428 explore.exe 31 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21 PID 3060 wrote to memory of 1272 3060 FIRSTO~1.EXE 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6f9c33064c496d8faacf49864d8d1e6_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\explore.exe"C:\Users\Admin\AppData\Local\Temp\explore.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FIRSTO~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FIRSTO~1.EXE4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FIRSTO~1.EXE"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FIRSTO~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\install\server.exe"C:\install\server.exe"6⤵
- Executes dropped EXE
PID:1940
-
-
-
C:\install\server.exe"C:\install\server.exe"5⤵
- Executes dropped EXE
PID:2240
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\calc.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\calc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5d7b2c5569977dcad665276010ba42961
SHA176d25a7be3c461f9c7ec90327c500756c402451a
SHA256f881c989565a5e053eee5b6ce9f3149a6c4d56aef35aacc290df6045fca866d8
SHA51211384302752c27e153e21f47dc83a988d0dfd7fabc3d8b22420e011cac7d9b629b54dd00db3f1faff4edffff7bc8cb7739546b5ffdbc09e73c546849d05aa9aa
-
Filesize
8B
MD5b5393ec38614944d3e78653495a4da96
SHA14820c92a29e670f91e836c5e7bdd3ada01f2b573
SHA2561b532bb915c5e8df880e0b5837f8625552f382c44350ec5b9f3af77d4e3b5ef5
SHA512ec0864b9fd8a69eeb097da6841960b5dec4799285c4e6052d4ac640d02942e9d12f5668d0db58f2f6d8a995c135f0851ba6fb496fb1fa68712ff7fda11705260
-
Filesize
8B
MD58ab2a8aecd9b6326d28fd8f32522b30a
SHA14bd7f0cf16bdf99fb31525d384c8bd1b552242b8
SHA2567896132003bf7685924e7222a039ab0d81218b8900083f67372dbcc1102dde0b
SHA51295c0cf76a518735bc1f18a539af6894998f74f1cb31e4fd28fb492446e96fbf3d89f2f04ebbf8a70e6628dacc07ff842f7afcd653a22d706c88ba8824da79931
-
Filesize
8B
MD5e21c38bedea8cde30b03a3ff77ffdff4
SHA1a5336bd38f2dc10cdd13f54cca1255ce5b1f2c08
SHA25666c8bcad5feea5c9d64a3ba52e6ae0124fce666d8ce4181482792b9a0ed6acd6
SHA512197218e3c95d3d5380b1f836628090cd9ecc1443f0efc31c19e1c91d86226efb7128849abfba91927b89083b85e7277bef4d67e95303b1dbbc18f244eede73c4
-
Filesize
8B
MD5058305c61413826f3446564b8d6400ef
SHA145523006d9565c11e241a1c2a39685e22c1ea9db
SHA256925a4ffb8552fe0c5f20ee81f2daf0fa458d97a510f6d9069e3b668c7ebd9761
SHA512b6213ca45ef1f41d09c2c3ba26f2d0b1dd324cab5e269bb0a083855d739a5fe31cb957df411dd9ddc6a8881471ece63030df42f7e84827e278308c4863f75343
-
Filesize
8B
MD5fbf9a8dcab1269d58ff57460ab93a2e2
SHA1c9de0265cdc67315f40ad72ed15205cdff81641d
SHA256ffa5a42a2ccfbc27bcdbc15722ed8d2f4a62868837e9ea5a39b5623d3de59ccd
SHA5129a2281307803a1605ef3a055f02b77437a1ec6c7a40b8a49ac1f9f420b1e995ccca3471757199f18abc447fe23844882c75b06be549fc0e8560572116cad8ff5
-
Filesize
8B
MD5b79fe2366b1d21598f120853cccfd688
SHA1809a68242f4fe5655187665e6ccf55d96614c1f2
SHA25697692554e22bb6cfd70ee554ea5f7e24597e022f3af0d817c1c4bd4ae8e6b969
SHA5128df425f26556a2b5bd885a1c61c63f45d3914f45ff1b44d720a14aaef9405d1012c5b7c3ef30ce3d8db406a0ea25593b977d85ea6fadf3da15b8a03cbbd0887a
-
Filesize
8B
MD54f741e0368f26b10921f18bcbc1e0f65
SHA1df03c536c15147f878e08b8c114fd9c2534d7a0c
SHA256502af492b74bd890bf49b2be2642f64a1bfdf2dec6a1c61ed4a0a024e3ad295c
SHA512f1b7101a1ed5be4e0df4f320e62ae0158973ae2e63194337d0965df5bcc506f5fab34ed9af61b22a991ebc1bdccf46609752c7ec9815fb48c865f87cdbb17091
-
Filesize
8B
MD51f78f6bc5e7027d9bb89da4029477453
SHA1084b41d083fbb1d1ecccf1aa55ca01ff9bb1ec40
SHA2565ea1160521e0facf25a5deeee75cf50fcbccbdf27d5fa23a70f2b8291045ebce
SHA5126b522384224b91ef863729947dd123d277383d157c7046ac3e2c93f4a81145d7edff943cf6a90b6dd9c4688bec196205dc9b86c4b30b4db772b51116f3b26d47
-
Filesize
8B
MD5b7107633287471d51d685b69d2ffcd12
SHA1a8bc23f22e0fe571307fc65b5a3f20a11a12270c
SHA2567559d0764496966cc580d60dc1de84eba457b806ea4436a8d0113d7d57d0b9d3
SHA5129457011d710795e9e1a94fc237ed0443c8828771129208e5ff6e83fe8cbe74d967b9a321c441b9dde193b591fcd9c4c3e4a5af8bc1dfc160e7cb46410e7c168a
-
Filesize
8B
MD5f4320db7f09c51d066531f0257ed82a7
SHA177ee06471cf4c3d5a27d6f77069a9b559a35ad77
SHA2566911b49ee84d7cbeababf13d468da672d907084995309a34058d7a31f46fdd86
SHA512eb890e0134d24a8695caa8bbce47141aecf51f530434861d958b28cfd68cd19ecae107e4f240825d4ff65ad303ef1469a7dab5333e1a173a956fcd84a215f4c8
-
Filesize
8B
MD50d168062b68970010d1f19822256ff77
SHA1bc381aef04af743b95f077944f5666e2e9e06ae7
SHA2567d4c91b4e9d688d8a28d5a5771920df89410335f192847e56f9fde49f79378af
SHA51265f83495ff028b77d84c52c3583ebc783b2e7a9313d0ddd22350775ab3219f5fd1ae76d2101381eafe813990c9e1345922b40ad34aa3e2e3e26c606ba27ed7b9
-
Filesize
8B
MD5c6e19f3240772b6410ede0d4441826a5
SHA157ba227b9f8072a9ce9d76e4262e4e6807dcc018
SHA256ccfcd9c0077bfb07146dfcb43ee0358bef2be2366382e0687e46bd23e9fd737a
SHA512abb633cf665e1df77e5740e42abdd2d58ba2757ab56c7b620a86245e2b9d0f45ba940f6085fded3f95873e1aa2a15ce3f1cb20c8ba7d72dd7bf55613fd071747
-
Filesize
8B
MD56727b8014c9ddb717ba1f58c38f71a5d
SHA1464a4be1a59ee0302c29aa5f23d7849baf52c39b
SHA256510cafc6c6e9b4d59730f76ad1054549292fc2cde90168743faffb8b9e816d6a
SHA5120133aab9b35f00ce1f36bfc492ed3c2c64c845abff5ac4431631f2dac8b78c184eae6f3e20e5b4fa10a7bdf853c91e02690c965211bef00b03c6d89227ca803e
-
Filesize
8B
MD5915323aeadb5a878f178939c642e22fa
SHA10a4f7a5757281273612ef4ea90bd52f4e7883919
SHA2560372bb15d48da49265b1466ae79bf377a16d043be51a694ecf00a66adfba786d
SHA51290df70e0cd0781df345915dad73790bbb23ab3abeea3c95e474eb14488386411fac887c3eb91a566c5db6703a547394e15da0dde4cdf16f3afffc06eefc0cae2
-
Filesize
8B
MD578e669b162d8e1f26e8f755954607a14
SHA18197a13cf822579c2a9637d7131d536d77215640
SHA2561f4ae54893bb745b72f85cb440d64eec1425697f775898647148c681573a14f8
SHA51241cb3e6ec0fe71359f720b4221e7f427533394611f48aadf7317c505759acc92041b0e8a00b8ea6480f7d8a0a37309544d3a611b9ca91c812d3d5b98fe117e0e
-
Filesize
8B
MD5696961da9430f41bb02cda4fa32e244d
SHA1ae1c0a3904e6b3a6a780d43992cb9ff2597f3b8d
SHA25611a0d8fe5f20057f1fb38aaaaff8d46ec99ea1097bc5d7b8ca3bc745702682f9
SHA512efbdecc2d004253cd422e642deba92818b4241ec9b5d8c6b6a8ca77d00db3f73b632643e3d0cfd1a5ad108d788603f8494ba9586fdc97de9d175230b69d9c65b
-
Filesize
8B
MD52ae300ce5310644323e7a7a97e65144c
SHA1158eb4202a6a68e74f18eb4cce59f685b532a431
SHA2565b84d4e5e7a997935edcb37a23b6afa9fa7538b217ef452ebb0926f5a2c68263
SHA512d2255d6eb1033a37325363c8252350d5ab67a5a8fae84c7cbc719d689e5fa2c187dd7285119467d0a132028dd3c3b98ad26ea20a9235abdd452aaa7f30dcb8af
-
Filesize
8B
MD51a93a9dad235e8a4e57e61f3ebd5b550
SHA1599057eb0d848784b626bf83d9e55c8ce4edf0b2
SHA256edf4eafa0827032d1519855688648c330f091f81516a077a2f562083db365c5c
SHA512b49b2c744ed40da63adfcbe0e7b0ddd4e9df5a3bdaa742d92eabffc9927f01dd647bec215a9086c6bf7819bb72ea3432a5d9ee11e7df700e0a81bcc08ff81619
-
Filesize
8B
MD573f7031dc9aa90fec3f87396f012efe4
SHA15c06ca6a1eb5fbf87f6a5c9d9d61e1beb2a83ba4
SHA2568b678003d9ffdf8736666fc546b5a228b099a4f3c5a56a69db37da2fddf65f15
SHA512a21bd933dd7db8c9b88040adb644f5418458281b0bd4e516ba036ff63cb0c3e7f4d5daf329cd7178a694f6034016ee3ed4564be05e9165cd7e90a71a4817ab9d
-
Filesize
8B
MD58ccffe8fe05aea0b6671373bdd4ab005
SHA11ab66f3c943e05b6ade8abdfb079374f4b927f18
SHA25615ea8cc78fd008bdf08089f86ee927cec9ae9207b438e9fd9e428c71e42589b0
SHA512ae0db949c6cc21105f150bf1fbaf48342873503d6e1ed0ee27c40f1530817fc2e6f4686a83e9d08fb0da4c7fb3dffe86779ecffbb6af3d49a97b621a52790290
-
Filesize
8B
MD5a8695d486be01145d735054535b15f19
SHA1ac0cec1aae687353b5abc490f56e4c620c8fbd8d
SHA25670e351284947b5a17ea0ea678a903d0749b169c090944aefe72aae246b301a14
SHA512bc6e02a40c90e86b53a815adcede1beae685bb61430c970e72d019a1b9f9d95c3b6ef72396bd857f0e94aa886c63fc2c36756e21e84f68dc8448ddc7823774d0
-
Filesize
8B
MD519c069ae614b5447ebfde39766f34b0c
SHA1d3b5b6cfb3be9aea7ee59259ae4e4958404079a5
SHA2561c974907f3ab7b4c3568d2c27cb8f82f5baa2d5b3a4293b1946e73cdca3ada26
SHA512b4a36d3460776a1fe4f0aef8fd751e48055f279df475e537b76011a2f3074116ad1ab560508ac4efafcac6162a3dd81930a6f0edabd16cfaaa52e22120d782bf
-
Filesize
8B
MD5b52be70d4ee3bbce731f80c0ade7f3a6
SHA1651450a015cbb2a0b7dba1fde34791e220ee86e5
SHA256c2a6e24bad5dd3170708f9cd72392816587f5f2c3a0fd9ab6fc0bb1b3e39035f
SHA512af1e3d89cba32be8f44e9b0988421404cbb3a8a09fcbc151f2b70dbcf4460607c49160adeb2bc576bd7128240b5517380289916206d6ece7d29669b1ab613ae4
-
Filesize
8B
MD5504fcfdd68bf4edfdce35f1d251f9570
SHA19f444af05f17f03df9dc2a1edf371ce7831f70ce
SHA2563ebee6d242f6e25773ffb203b053e366017ab34d4e2060ed4ef28576d21d66f7
SHA512bcc4cfac2fb83c63f847dfaa59ee77db7f159996f19bf0938ee9daaddd3ce001d2229a456b0180a7dcdd8c1d9a969ec565d78fd571263601f0278dcee21c2c99
-
Filesize
8B
MD55f7e61a2829a3e1ed038d7b916adf2ab
SHA18c0f30d02ac9148ed6e4205b898fb1d03dc9cbf9
SHA256e963939ec0b2368b2287cb0e4ddc4ea00fe7e34680caa88db4a90b50db9847a8
SHA512ec2a12564706234fe485681d9f7b1c0c91d3062cd273efaa85a71d62cf4884884bde5a92074add934d73e69206db71cc7cbb179f49b71930320c7e3cb812a9ec
-
Filesize
8B
MD5f67b762cb789db99c2010a669b4f09f1
SHA1255247a8f9ed1ecbe86de8b3951d4fdd488afef3
SHA256ee79024c9847396d225c6c494e52b08d7c9c4e0c87f0cd48b430576e0bfbc0e5
SHA512f8ca87e4f0c4c4f209972881709f3e2872a256d9164d49a7d0f74eb9aa32713523cec044d29cc1a2dd6ed593da157e63adc04279fc84ba92d8bb7baeb4b84bc9
-
Filesize
8B
MD59f1849b31f78030ddb9c735813aec2a4
SHA1f611fe7cf6621d0cd7d9075471542c9500d33e19
SHA2565fc0e4e5b0c2b8487698348f93579f5a44db0a1ecfae138938f94dfdc5f4f107
SHA5126df3f2a5dd1730690d5c9dc93d3c95620ef38f527f0e24fbb8560693fa2ace2c3e5876be9acd4c3c811368234f88a8f7647594e15a8a464ada7ae39a0c0bd213
-
Filesize
8B
MD593998c47f33ebe9217d4b056e0e9b074
SHA17218c26b5a93d37d516594f515b6ea791fd4e582
SHA25624d2e071fcedeb60fa309749343d19c552a76bff5a251ff555e7e8f74ce3997d
SHA512e0ec001bca36ee32b30916b724a6dc4d5f67f52407a8965f8b126c727a723f13441173239ee4c52155aeec9b1dab1c74e99ab0ad7cd02a0ff07f3720683fad70
-
Filesize
8B
MD5d012d019b15e4706c8de241712d3464f
SHA1a14ca6e19092f2f50e98fd1757b30d07b77398f2
SHA2564652fb34faadfa2c39005fb303bbf7aa8896bf74ef961674cf93485b31806fe0
SHA512f062816860223aae08561a3e30adec6bd912a21eb8d4ce4d1fe9785bef589dd30bcaccd27cefdce44a7136aa268c3f45242b14c0c5bd98286a9e72ca6275bc5e
-
Filesize
8B
MD5f799c35aa047ab42c011ced959d93832
SHA12bab7c6b2169eeacf17e977586c99af2b5374145
SHA256accec71efd2be1b700e239dae56ddd5109628eeba6a09dd54a394a679d622f1a
SHA51290fe82128862e2d11c36b54281e4c810e46ab250d125a9c30de2d994d851c725eee7f30ed4d5a039d9eeea5238956ee850bde2683c24f5ccc3a7174b33468c4e
-
Filesize
8B
MD5db0bd89ca9ea39e0e4e13592efe269d7
SHA1a05fa29605bbd719f7d99c305d366d9072b6e122
SHA256c03229ed78c860c94059dbe14d6d8db9638fdc5dcaf64384effac9c87871fce8
SHA5126f200746114dd0496ad523dd14a8b30806a941b8cb6b87657c69d68c71586762a998c56a256eb02f2a8954fb1cee5a22ac49407c1861304e308903946c64755a
-
Filesize
8B
MD5dfbdfd193551db697499ac776ddc89b4
SHA1fbb55c69618fb2ed6106037988c918136f025197
SHA2569dfc5c66f2f3202e42e9f02536c51c7283f3d1c99ed274ffbae867cd48220e98
SHA5124c2ded5fe9560ba7be82435d851f0384571bcc812ab7408661cd061dc06ce0957f8f2546eac87a2d5158893f7651a4aac3171a2497c86a573672ecde291f6678
-
Filesize
8B
MD5fb5cbbba5bbf94885a44432c2a779d15
SHA175faa0d840235173b4c3f86036ca952b259b8a18
SHA256c2e746f41f254c259dd0731d9f3eacfde379c13c11fa29e101d099d57a8e99c2
SHA51235d79b2bda88bcf22f5a27589ea7ac1412ea37e672cb6914f1c30acb7127271dec192b9f5af98d265d3b2cf55c39aa473c09c59b5151e5f2647539de0284a2bb
-
Filesize
8B
MD5c1d164f5670e433487ccc722a17f9100
SHA14f7bb4b29ab62fccf9cea372659d9f6caa8b64ce
SHA25646de5ae4e0856d7bdb56b1beb7944855ede65da6eb69cc3168098237954c8f97
SHA5129a67e0286897135f36a93c8de5b4cb239fdce8f97227bceda81df5d59c855b272f76deb465b5d66d544221756d2ffef1e8191a5ca6566eb2a07c5e38d5a4b6ac
-
Filesize
8B
MD5b72e2ee1c232d0e1d9bc5a7aeb6a42d7
SHA1bc59e5b6dce51552361339969f7d322a75b34539
SHA25608f859133cd3c6ecb4e35e0639ebb98024c6c06dd7cd42cc2ba19f2398561b81
SHA5128c2c6080c09543440fb950a45542dad9e707a1c36417ca7279cefb12289ab55ecba420efd7a6a37a8606eedfd991d17946e5a8743d7f2427f4259c937e7bdd42
-
Filesize
8B
MD5ff9c10b73c539ab98e826cf3797698d8
SHA1716a905abf68f296fab101788f3f033a563699f2
SHA256ceb8976f2104f26def33867aba5b1e12e4d163f3f19fbff6527b0186bab114b8
SHA512e0d7e32e480546049fc6ace5e62572ae0f5fa6819abd616e9317c1346bffee9d8567fa0e9f205e9901dd5a57a01df90eedad5082bd514e2e43941928fd5e9f69
-
Filesize
8B
MD52d48658ca223a43b3cec62db49697229
SHA12be33d19bce18b25d6e65157d13645916313eaf2
SHA2560c04e76a498f414ec0082b61b45a5dc00da554644863ef5c7586f4acbc6ea60f
SHA512d4187c8612ad63ec10a87a03b78a37a8d7d99869522e537dd60212dde0f9234f2871680b7b190f17c9a70d10a98b9ea865970e9dfa3e7b75a798d73fa73a98dd
-
Filesize
8B
MD560f402c903bb561458726e054c5e73df
SHA119dc8cf1402fd7495b812ad088315a2b214b6e35
SHA25644cd8a5bb18feb89c744bac42eeb303264075e304985c201541fd61dbcc6c37b
SHA5127c3ee4a87c3b3d6b01cad3e470803972387fe6654d46fa0ca7c85accddb96f9d4189ec6335cab3f0d7276933e973901af6ded1024d6ad4f22a94a28596f6142f
-
Filesize
8B
MD585aa47bf0cbb4235295b5ba7dfb1dfb2
SHA1c6a04f5c41da517c397ce39431cd532bce7bff39
SHA2563fe07787bc77d666ce1b33ed79a91a695ab68e0d955438aac65b267eba3c3786
SHA51244ad60d0671d9da89d5b955d68eab24ae19d576a6c80026d80b3ca5d93be5289cff15c8b065da260757bb89736519b4a6d4225a4863b8bbb1a1d582684d64791
-
Filesize
274KB
MD5d08092214354716a6020e381e768c03a
SHA1ced54694ff54e1d07d38334e65bd4713b2d0c661
SHA2562019fbaf3d55510d9bd6ff95ad063265d409c668b7549c736571e5391103156c
SHA5129aab71b19c6191ddcc33ab10b5daf5e075d797e47ef06729c65948693f12a6d3a4886fa30b3beae5ea8e8147845f186b71e94d15e36b4e1bbf1fd354482f4c37
-
Filesize
758KB
MD54884da7754823b44ccc2b2106f21146e
SHA17bf8f58d8d8d5dedcee34185622a4b64702efb8e
SHA25620f7530727ff461de43af16a42d60f12cd5c79a808e8dbeb8ab98159bd325ece
SHA5129a2a800ba6bcdf4432dac53b92428b16391c58384746c6534d4e646a68a3d0f6849f2d378fb3cb9d34cae2780c038f016f5b967b774180f5610d52b35e847885
-
Filesize
739KB
MD576057551cf55e5e919c6017e49564631
SHA11dbde3a2608e132dae5740acb8644b694e17c9a3
SHA256111c5b47472cb3a17168667fb9a8da146706687ca1bace312f972be7b60f736a
SHA512d8442d720f04952247cd6faaa69c5513d5df12f9afdc6de49bd426182b6835163340f8f30804f0d0b37f58acc0fb3321bcd9bc14358ea52b54cfde9b6a41d302
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314