Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 09:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe
-
Size
668KB
-
MD5
78eb8e5963914f564140c75bb030cdd0
-
SHA1
cd53c928dd332bb40fdef34287c4239eff468a4a
-
SHA256
0f1f093ac8ac55db7f3d28310ab2b9b92aed9431cfa09ab18d0b0e31f6505815
-
SHA512
c374efe1e2dc1350649e445fd335a667bf29ffe7a7ad2672eb04e995bee8c763dea81360113e1e55275f4c40a59d956d4677939161bc5c7cadb2a91cb152b2a9
-
SSDEEP
12288:POqBSJNJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYp0:2CScE7z193Rit8UJ62Bmhgo0
Malware Config
Extracted
xtremerat
gkl7.no-ip.biz
Signatures
-
Detect XtremeRAT payload 15 IoCs
resource yara_rule behavioral2/memory/4660-0-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-7-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-9-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-6-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-5-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-3-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-1-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-12-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-10-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/1676-19-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/4660-20-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/1676-23-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/1676-29-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/1676-34-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat behavioral2/memory/1144-46-0x0000000000C80000-0x0000000000CE9000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\system32\\InstallDir\\Sv.exe restart" JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Sv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe restart" Sv.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe restart" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 4912 Sv.exe 1144 Sv.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\InstallDir\\Sv.exe" JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe" Sv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe" Sv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Sv.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\InstallDir\\Sv.exe" JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\InstallDir\Sv.exe JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe File created C:\Windows\SysWOW64\InstallDir\Sv.exe JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe File opened for modification C:\Windows\SysWOW64\InstallDir\ JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe File opened for modification C:\Windows\SysWOW64\InstallDir\Sv.exe Sv.exe File created C:\Windows\SysWOW64\InstallDir\Sv.exe Sv.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3460 set thread context of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 4912 set thread context of 1144 4912 Sv.exe 94 PID 1144 set thread context of 3248 1144 Sv.exe 96 -
resource yara_rule behavioral2/memory/3248-55-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-57-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-56-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-59-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-60-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-61-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-64-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-65-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-62-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-66-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-67-0x0000000001610000-0x0000000001712000-memory.dmp upx behavioral2/memory/3248-70-0x0000000001610000-0x0000000001712000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sv.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe -
Modifies registry class 21 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000 svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff svchost.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3248 svchost.exe 3248 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1676 svchost.exe 3248 svchost.exe 3248 svchost.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 3460 wrote to memory of 4660 3460 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 86 PID 4660 wrote to memory of 1456 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 88 PID 4660 wrote to memory of 1456 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 88 PID 4660 wrote to memory of 1456 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 88 PID 4660 wrote to memory of 396 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 89 PID 4660 wrote to memory of 396 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 89 PID 4660 wrote to memory of 396 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 89 PID 4660 wrote to memory of 1676 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 90 PID 4660 wrote to memory of 1676 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 90 PID 4660 wrote to memory of 1676 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 90 PID 4660 wrote to memory of 1676 4660 JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe 90 PID 1676 wrote to memory of 4912 1676 svchost.exe 93 PID 1676 wrote to memory of 4912 1676 svchost.exe 93 PID 1676 wrote to memory of 4912 1676 svchost.exe 93 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 4912 wrote to memory of 1144 4912 Sv.exe 94 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96 PID 1144 wrote to memory of 3248 1144 Sv.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78eb8e5963914f564140c75bb030cdd0.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1456
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:396
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\InstallDir\Sv.exe"C:\Windows\system32\InstallDir\Sv.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\InstallDir\Sv.exeC:\Windows\SysWOW64\InstallDir\Sv.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\svchost.exesvchost.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3248
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f0430d974b0838d63599bf40647a7ae6
SHA168c7184c6f4ab0de36d249bd852ea59fd82a24e5
SHA256d88335f0154f4022260fb00795fc2b92ccab16c482b8b3dafe6e4ff563ad39b9
SHA512df17c4a0ab142315932d4da894ecdbb9423575bc7b6b5edf6880722787eb6d546ef0de1fd82576aa20be4edb8bfd0ff5b2c34dc0ce7d0e9f615976c6a981f5e1
-
Filesize
2B
MD584cad01fdb44ae58dbe6c3973dcd87f5
SHA14700b42849fb35be323774820bf1bc8019d26c80
SHA2568b1f194be530240c18bf0b1ee0d038e750fab8b24c6bd25c864297e5ebb41fa6
SHA5126e10d3ec4724c1aca9ff3f6a26292ba80065d18e8e9395f1474c0a298008f25e312e2f7024e7d10aab3264764e69a25553cc20afd23090f83921d20e42b989ab
-
Filesize
343KB
MD56426d400c96fb9ffef4eaa54f6647f4c
SHA170a37871aff432790b6adf7d3fc4eb929476e082
SHA25698bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c
SHA5122c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5
-
Filesize
668KB
MD578eb8e5963914f564140c75bb030cdd0
SHA1cd53c928dd332bb40fdef34287c4239eff468a4a
SHA2560f1f093ac8ac55db7f3d28310ab2b9b92aed9431cfa09ab18d0b0e31f6505815
SHA512c374efe1e2dc1350649e445fd335a667bf29ffe7a7ad2672eb04e995bee8c763dea81360113e1e55275f4c40a59d956d4677939161bc5c7cadb2a91cb152b2a9