Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe
-
Size
2.9MB
-
MD5
5ffe82159a6e2c099a8dfe5a37574c74
-
SHA1
02b1c743bd5e6f3412ff63eddfb79f0e4d4f6498
-
SHA256
d544bb4d411e66797f4e3764b62bb97bf79aee7c458c0da1c665a69d81802a5e
-
SHA512
6d65c3a2bdf76c9b8b18e5ecac36556823b918039728a2e7ed89779592bfeadeff3aa6469ac9714e7ae44be7b44f84f4bc1f4b721b428664f94f5cebdf19a441
-
SSDEEP
49152:5aUzZxhW8oPZdoaknsXph0Q66odrSEOnnwaJVAmKCY0NEsfi35krR42cm461Z9TW:QUzZ7cssXpW6ErtOnwaJVAjCY0WdpuNs
Malware Config
Signatures
-
Panda Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/1484-126-0x0000000000D30000-0x0000000000F8D000-memory.dmp family_pandastealer behavioral1/memory/1484-129-0x0000000000D30000-0x0000000000F8D000-memory.dmp family_pandastealer behavioral1/memory/1484-132-0x0000000000D30000-0x0000000000F8D000-memory.dmp family_pandastealer behavioral1/memory/1484-134-0x0000000000D30000-0x0000000000F8D000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Pandastealer family
-
Executes dropped EXE 4 IoCs
pid Process 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 904 NewTab-v9.exe 1484 v9ht.exe -
Loads dropped DLL 9 IoCs
pid Process 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 1252 regsvr32.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F386E548-C533-472E-8C61-C026FB14FEA9}\NoExplorer = "1" regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe File opened for modification \??\PhysicalDrive0 v9ht.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\is-N25D5.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File created C:\Windows\SysWOW64\Newtabs_v9.dll NewTab-v9.exe -
resource yara_rule behavioral1/files/0x000500000001a4b1-122.dat upx behavioral1/memory/1484-126-0x0000000000D30000-0x0000000000F8D000-memory.dmp upx behavioral1/memory/1484-129-0x0000000000D30000-0x0000000000F8D000-memory.dmp upx behavioral1/memory/1484-132-0x0000000000D30000-0x0000000000F8D000-memory.dmp upx behavioral1/memory/1484-134-0x0000000000D30000-0x0000000000F8D000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\3D Realistic Hourglass Screensaver\is-4AHOH.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File opened for modification C:\Program Files (x86)\3D Realistic Hourglass Screensaver\unins000.dat JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File created C:\Program Files\Google\Chrome\User Data\Default\Extensions\v9.crx NewTab-v9.exe File created C:\Program Files (x86)\3D Realistic Hourglass Screensaver\unins000.dat JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File created C:\Program Files (x86)\3D Realistic Hourglass Screensaver\is-K8ND7.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File created C:\Program Files (x86)\3D Realistic Hourglass Screensaver\is-IED7B.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\is-85PAJ.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp File created C:\Windows\is-G3775.tmp JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewTab-v9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language v9ht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 2 IoCs
pid Process 2076 taskkill.exe 1596 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.v9.com/newtab" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.v9.com/newtab" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.v9.com/newtab" regsvr32.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.v9.com/newtab" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.v9.com/newtab" regsvr32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F386E548-C533-472E-8C61-C026FB14FEA9}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F386E548-C533-472E-8C61-C026FB14FEA9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F386E548-C533-472E-8C61-C026FB14FEA9}\ = "Proxy Help" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F386E548-C533-472E-8C61-C026FB14FEA9}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F386E548-C533-472E-8C61-C026FB14FEA9}\InProcServer32\ = "C:\\Windows\\SysWow64\\Newtabs_v9.dll" regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2076 taskkill.exe Token: SeDebugPrivilege 1484 v9ht.exe Token: SeDebugPrivilege 1596 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1484 v9ht.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2000 wrote to memory of 2328 2000 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe 31 PID 2328 wrote to memory of 2612 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 33 PID 2328 wrote to memory of 2612 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 33 PID 2328 wrote to memory of 2612 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 33 PID 2328 wrote to memory of 2612 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 33 PID 2328 wrote to memory of 1468 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 34 PID 2328 wrote to memory of 1468 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 34 PID 2328 wrote to memory of 1468 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 34 PID 2328 wrote to memory of 1468 2328 JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp 34 PID 1468 wrote to memory of 2076 1468 cmd.exe 36 PID 1468 wrote to memory of 2076 1468 cmd.exe 36 PID 1468 wrote to memory of 2076 1468 cmd.exe 36 PID 1468 wrote to memory of 2076 1468 cmd.exe 36 PID 2612 wrote to memory of 904 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 39 PID 2612 wrote to memory of 904 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 39 PID 2612 wrote to memory of 904 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 39 PID 2612 wrote to memory of 904 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 39 PID 904 wrote to memory of 1976 904 NewTab-v9.exe 40 PID 904 wrote to memory of 1976 904 NewTab-v9.exe 40 PID 904 wrote to memory of 1976 904 NewTab-v9.exe 40 PID 904 wrote to memory of 1976 904 NewTab-v9.exe 40 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 904 wrote to memory of 1252 904 NewTab-v9.exe 42 PID 2612 wrote to memory of 1484 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 43 PID 2612 wrote to memory of 1484 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 43 PID 2612 wrote to memory of 1484 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 43 PID 2612 wrote to memory of 1484 2612 v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe 43 PID 1976 wrote to memory of 1596 1976 cmd.exe 44 PID 1976 wrote to memory of 1596 1976 cmd.exe 44 PID 1976 wrote to memory of 1596 1976 cmd.exe 44 PID 1976 wrote to memory of 1596 1976 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\is-0EPLS.tmp\JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp"C:\Users\Admin\AppData\Local\Temp\is-0EPLS.tmp\JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.tmp" /SL5="$50150,2801168,54272,C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ffe82159a6e2c099a8dfe5a37574c74.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\is-5S7N8.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe"C:\Users\Admin\AppData\Local\Temp\is-5S7N8.tmp\v9hp_v9nt_umz-2_br_20120907134317_rev.share.exe" -nation=<h3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\NewTab-v9.exe -h4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C taskkill /F /IM firefox.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Newtabs_v9.dll"5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:1252
-
-
-
C:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exeC:\Users\Admin\AppData\Local\Temp\V9Zip_000\v9ht.exe -oem=umz-2 -app=v9nt -flag=7 -nation=<h4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c taskkill /f /im rkverify.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rkverify.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
977B
MD5236dbcdd224d62a33bbb066b24989717
SHA1c9c5536a30e241b6b33181043a74e0e0c18dd610
SHA256808e0199396b1a02b8336e4a691dbbbd162c58f4d04c200a8a3817d200f55d8a
SHA5124ea70ae351a4bc54b4e2f4485bdbee45428e01a4a381645b34c85d96525338a60460b88d8052b57858d4baeb5f0feb6063d1eb63e8762a7982244b34d5754b90
-
Filesize
1KB
MD5376eeb20e30bfabd91d263c20db442fe
SHA151ad5fab224361cc92789920d3e87f80fa406281
SHA256fdccdf8a4d0b9265bf477ccac9a8b3cd376152cf479920f897471bfc60763740
SHA5123d382fbbac34ab826db9c7edacc43ec1573b33ae111bcf4e0fedaa21ec24e7b9b8c9755260f33b03c9e260a8d63f51d7982b30d800651a6a69680213de6d0776
-
Filesize
922KB
MD59a2f642a99c19b2d7ee60109c7de1b81
SHA18543ffe5e79516d110526fd305dbeacf04b041cb
SHA256c07330c686767287b1d490f5c44d2b0265790860b32f1889d16d60c06d15f111
SHA5121a0eeea8f17d19e81bd331ce324361520339fe75d6110e664fffe7fa654a4f091bb0377e9344f90310e4c85ca37c1dc01022e18d95aee72f60c204bb38099241
-
Filesize
2.0MB
MD545270cbdcc4fd94c03fef3c682cf58c4
SHA1951572c1bc0fcc68fae1f83929809da3ec8627e8
SHA256beb85cba6a6096feae6e859df1d4158a1f6b094b2aaa7b2f1df5595db02d7540
SHA5129019e247efc49dec550f961589ca178c961e88a03c14397f26009ab83f2d6c0e7ce40e65dbf7e02cc21b5376dd2f0dc922263afc9e47e86baa527f7bbcaec9a8
-
Filesize
698KB
MD572038e1576bf508f0daede3b050b2bd3
SHA1ce7823f5eb77a7d102255ca50a8328a282c23aab
SHA2560edeff8d6ba85e9af55304c5a6cac2c3f958f2e0bfa5a7ceea78025e175af921
SHA51244b3413fb2ac839121f5780cd49c34729592c1547e5d30bc60033a5d1b22ec61311c877630e1b48d532a5cbaf483e3d36306cb6a5c2ab7e9a1641565d6bbf528
-
Filesize
551KB
MD5a376fa73657ea9ef1e6acddb94e31c33
SHA1b48ad618e8f6660e24e148a045dc99deb0b9c559
SHA2565bf5bbe24cd97e271ddcb537299c7a6868ad3f6e23752f295cc478586778c871
SHA5123acd2fe9c922a736472bb7bdf61f5595797fcb410de8520ae2d1c118fa1b13e148d2dd0e5986b77af821c5bd17cbc52ae49466deab5288f9d30c02740b6dd8e0
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
59KB
MD52b7598adf8886d5988d39874acce8884
SHA144aeadae9e448d23793ec6a54f7813a374e1612b
SHA256a17ee83c7919b18758bfc90c6385c5f126f3d27bd286d37af4d44fbd0e388c71
SHA512cad011f7aebb83ab4c16854de7a98a74777b64dbcd075720598e1a0d3537ff6e299ac0410834d3ebe44dbb10969f485037bb420441ad6dc30cfdd7eea55ecdf8