Analysis
-
max time kernel
23s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05-02-2025 09:08
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
-
Size
1.4MB
-
MD5
9e039f37e7a4f467778a61f5c5b69a02
-
SHA1
35c0e2f20b2d3a9160a6a8adfc03c09e6ab62841
-
SHA256
5c633051f4d6ed2386c00e4a362f0cc422dac31cb1e96b90c9473405a347982a
-
SHA512
1f746bd1a84ccc8abb01f3297c154ca47186b69033b90fbaac0f68fa7b94be45a7b24cd1ae0606bfd1b7ce376d38ef24a95bc35bba5d67e897a8267b33e37b28
-
SSDEEP
12288:44tgpLXDc06thPVFL8JcMI1lP9ZaWYg3mDVSeV/CeIyY8eveyuoYYifjseL4a7Mj:4gKfjZoV0oTmZAe495
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
cybergate
2.6
DENEME
127.0.0.1:85
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
svchost.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
OLAY TAMAM :)
-
message_box_title
SERVER CALISTI
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Sality family
-
UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe" explorer.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0I8A32MA-1J05-7GY8-AKN0-Q1LU3Y4B31G4} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0I8A32MA-1J05-7GY8-AKN0-Q1LU3Y4B31G4}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe" explorer.exe -
Deletes itself 1 IoCs
pid Process 1164 explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 2740 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Loads dropped DLL 3 IoCs
pid Process 1064 explorer.exe 1064 explorer.exe 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe" explorer.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini explorer.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\J: explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2052 set thread context of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2040 set thread context of 2740 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 34 -
resource yara_rule behavioral1/memory/2052-5-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-1-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-8-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-11-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-10-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-7-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-6-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-4-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-3-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-9-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-19-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-18-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/2052-32-0x0000000002610000-0x000000000369E000-memory.dmp upx behavioral1/memory/3040-48-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/3040-47-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/3040-49-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/3040-45-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/3040-30-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1164-598-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/3040-597-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/3040-925-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2740-970-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1164-1003-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/2740-1006-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 1164 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1064 explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 1064 explorer.exe Token: SeDebugPrivilege 1064 explorer.exe Token: SeDebugPrivilege 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe Token: SeDebugPrivilege 1164 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 1064 explorer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1064 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 2040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1120 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 19 PID 2052 wrote to memory of 1180 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 20 PID 2052 wrote to memory of 1244 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 2052 wrote to memory of 1676 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 25 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 2052 wrote to memory of 3040 2052 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 30 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 PID 3040 wrote to memory of 1244 3040 JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e039f37e7a4f467778a61f5c5b69a02.exe
- Executes dropped EXE
PID:2740
-
-
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1676
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD59e039f37e7a4f467778a61f5c5b69a02
SHA135c0e2f20b2d3a9160a6a8adfc03c09e6ab62841
SHA2565c633051f4d6ed2386c00e4a362f0cc422dac31cb1e96b90c9473405a347982a
SHA5121f746bd1a84ccc8abb01f3297c154ca47186b69033b90fbaac0f68fa7b94be45a7b24cd1ae0606bfd1b7ce376d38ef24a95bc35bba5d67e897a8267b33e37b28
-
Filesize
229KB
MD5b8f74dcb541b1aaeeeac9cc283ef3f72
SHA1a05d31fddde76187c8efae2ff59a4e8475b1e0f7
SHA256c91a453e2051c25ee8b85ee6008e81ce6858e269449ab85f20fe2d9657443ac3
SHA51226025715ebd92172129a7a35024fe0a0e09336682a6acea42e4dac7684ca76479e7ac8add4bd5c83ce0afc6c32f20aa16a89ec0f0ec5dcb1943c7d7456a19e54
-
Filesize
8B
MD586739218bf6028978636a60eee5e8e9d
SHA13cca1896a2fba84e028f0171d8eeb79513a7d499
SHA2562e74edf16d664e825262504f09e17f8536e884c4774128e8cc9cfedc8a942a9c
SHA5126b211738dde159eaf965bbabd5a8353d316694ed3cc328d8bb0dba798fbe979741ce5b6485d76e21bd2d9eedac9551b0a958b2fd7320e9a9563b3974b2318d1f
-
Filesize
8B
MD5a153405beab74b66e11ff8fc9fcb5f7d
SHA1309f27b299a5cadd5a5cec573f1ea816409b8fd0
SHA256631f4e61bcdf5c2c018538cedcd8aacec8187049a469df939611a7904dcf6a8e
SHA5123d305918ff76a3ee9f1c97db13eec0b3954ea1c17e5859a3afa9889424456327bebe15ff90f689c3dbf960e552b18aea7943f8c75d7caee4458d57884f77075a
-
Filesize
8B
MD583cc5abee5aa8b9316fed90f59b3f477
SHA1e15c38dbdf31815c380aaed6b1c761b3b5afc614
SHA256b14e6920000f97367f72bd9ea722b2b547c6fc4e9ab4e52b6407cc11397b9229
SHA51224380f5134f53cce638c92f42502d56191f8e10a550aaaa0ba832f8b3bc5ab7725cd932bc039d2744e8a6c0ca6a084df58927b9a75dbcdef51abb073806b969b
-
Filesize
8B
MD5b094f988c7641027ea4e929d179a5440
SHA1f6d0679d26c42f0c8086d173c08e209a74ad65e9
SHA2563f798c67a44b8dbbde1591b96025692bd8969c983531ca37ed233ca03969b9ad
SHA512da9461a106fcaf13872a4ad1c9b1f999c281b89960897b1333995bfb892e736c1eb5196e2741db1e351b57750c49fe8adb1b5d8d4f7e6a3592d1410550e0a159
-
Filesize
8B
MD54a5d193f89ced5121df2eaf72af3025b
SHA18f5d100f3744c8c9efcc9189e78bbcc84d9593e5
SHA25655c2bc108c2f3ef0f89c4ea78e7c992ad57f9ed5f1a701ad9eae578b8b66ebed
SHA512ea5efa66b3788a8e8ed82043667f6cee533d344a2aa32dcca9070c49fe40c8d9bb68f200133b4a79419fe25f3d70c0ecc2a192c2f434bbd5d29c0023a805d765
-
Filesize
8B
MD510770b520242cf1b416d3d57cdcb154b
SHA17dd2d29991f7d0557f70ec76da150934f6e16c90
SHA2567d23907d657fd06f5c9332a26e19d3902444e6cc2daf5807c8de21d31579c244
SHA512caf98c66933d7f5edd607d07f4f438d3b65857e55f4cc2080ca428d7428485f90e2f75fcf2bf3ea96552cdf09f27ffe3ec58bda4612b5ba4065d19adbec6bf46
-
Filesize
8B
MD5e0dd6d34bae38e5f85ca2993ba055aee
SHA1a967be0e0b5238799c725061d1c624d064d083fd
SHA25675ce39a9a1caa476050ebea132540758a933b7b70ca2ef5120c772a57e01bd10
SHA51248120588682eb6474a07c455d8d4761471764978661c1d6a36c28ef3da4b26a5806985d958e0f06e4f4da9b103407e3028b6988972e3a4c15b87b20dbc232f4d
-
Filesize
8B
MD528285e8e24882684986083e61cecdaa7
SHA1c06584406dfe0ced2c2a99a5d60e7156f8cde840
SHA256f7ce39ccf5af9851329098ad44585332b4641fd3e8ebd24c0e40d6a301ab50a8
SHA51234b97bb8396d1aac0f13f91fc54570d4728c6746c8d1b4abb0d231ded0b7bbfde7e38e18832c3769112474fc52cba92a7f51d90ec8aec9bf6d49e3a66ccb1e6a
-
Filesize
8B
MD5102869eeed946ef7a6d5c34e8ba14ec1
SHA138eba1f6c6b8784a835022c2c63d6518786fdf8a
SHA25656f94c56c65661d7a09cc72247d5bea05678cf26bcb5e050ad1732c9a411ebe8
SHA512801eb24283e80cbe4d6edd920d7183f4019d0de916420c2177128f1302a64c2f8c0b6c26c9302d9cb59156920e384ba7df19e190febc36f13554781ae2b12bc0
-
Filesize
8B
MD539eb3f738e9145e215de419df520d273
SHA14f218a8c5827353d7f387803e792f25055a7536d
SHA2568f26fbd3f5ecb63aec73c7593847244781d780a8903198a3f9635718690016c0
SHA512742df7aa3cb98eb311ed2097e00e264f99c2e423d3287d6713e293a2f195150fd061daec6015b7769ebec78e373a162c2f2c6c192ec8953fdc5b5d2ff2f56e77
-
Filesize
8B
MD542b45ae3924b8bf7d9589881dae7f2da
SHA12e768e3fff9592003d60f5b9fdd67c4497d7ec00
SHA2565ad35d388728b65656046ef73d8215049bc70da9183b7621cc9a0e3e0f435c31
SHA5121e0b3fcf779f23fea7b77b1bd7b770c91a9bee2820917e006ea1851cfa4d412702588160370a6672f2a8cd6816b2afcd52bdd535ef08c54efacc2b1e5bbe2f28
-
Filesize
8B
MD5869d6ee3531814a1ff0c322dd16792af
SHA1035f5f7fa718ce8c4f612cb9e2e05a54038cc76a
SHA256d7879ab5db68ecdc608c20202e269b7507857b9fa3bfb47d846c2828a52545dc
SHA512a632f44bb3a7d15987e7e91459ec344504e02b0400d6a14f30d4ac40d661854ef5c82dc4a656c5b01ade0d63875c4dfdfc04eee63ae29b6abb77b83a23672ed9
-
Filesize
8B
MD5c6d2194f39186e9dcb09e2b89cb8225f
SHA1ac87a0de1ae14fb9fad86e2079f86e796da86248
SHA256d180b2e96a3ff5bff826a54ba6e80bf35b62fbb8884ed13bb7d4cd325454f306
SHA5128a3807ce0f51e6673d948568083789d695e7ca2062d736ebb97b4bcf9e50e2914a2a797158af9140ad2e56a4d6bfecad2c8f3c7296f66bb28efa7d390cd761bf
-
Filesize
8B
MD580347ff7007a0535aec1762aa7aa4432
SHA1d34a103ddebab2d538402e297714013cf7ae2d4b
SHA2562ff20b400f23e6cdbc930e3b533c30f7586f39d81aae3228a78f9fe02f2f2bc4
SHA5128b1527b8d05e2648742a6b4777d79d8b3cb19a483d17431e8c983f7192517a117e6abdd7ba3a8f0a027fe9b7000539cd33e3a1e58794806faa897a87b765e6d8
-
Filesize
8B
MD5226ee36996d89055a37454d2a9130d31
SHA1fc65608c3b0d7d5afce572aa6b7e330cabb27d11
SHA2563a612c9418c0545d90a1342b3d9cad89fb26394e36d89970da61dff30d8575bf
SHA51278222cb2ad554a409db9bd94623dfb755bd6d3d19175ebe7c58aa9312c9320072effe0c551994fbe832dc9a5822769bb177f6d3ca27f220a4d8e2e5e6e7c7f4e
-
Filesize
8B
MD557abb370b4dadc8cf891cbab44a4d7bc
SHA1af59d696585f30bc4197dbcc399eca4ad661c6c0
SHA256462a687e9205b2c6e576f42e74877c190fc5549b80b6b8e5cdd7b8859c8a893d
SHA51266ce3ed8de0f67bc52d8ef1f7cc4006e68585ef4b8fe3e8d779124b02d00d9e7cfe69bc6907c09702794a4706c572fb2b1eb743cb8e269583dedbcb44fa2c1ee
-
Filesize
8B
MD5abfb185c478eac832e0f6fdeb4b78242
SHA19d3b7338745b861b6ef2c8db29816f3b4d66009e
SHA2567c15697f0fe1e4483783c93df986ab07ceed5063f8d9cfecabfae6996a31495f
SHA5129518efa1535076af2586e778344d3c2de063c3208ed301e09f0f0ef7b85b92dfa876aebc5080c8c9d620c397620f7a19bf7b8a5263cacf5959241c2cc4bee609
-
Filesize
8B
MD5c485206cc7a8591037b194e70b79d17a
SHA1b4280efef1d93a5164977cad1dd1fa04a27297a9
SHA2566f238164ff5ccacf3b1eebe22f4791c3554a209c967f616d112f39121f5cb441
SHA51244ed307950eae7e54559a2316dc6b3c5fb16c99ce92473335e8df770fdcebbc50605a72e2efca984dc4d0267687ce8357a2c9362f1daea0737186f3d578148a5
-
Filesize
8B
MD526abcdb271be8e269123cfeb9fd899e8
SHA1bf70e7dde5db8c5ae08696f6884acc8ecc5f7942
SHA25684b5a3c5cd5602ee9951a97cb7e2e831fd672faf1ed750c53aa512dc56d55e75
SHA5124b898f7d59b58433b117c5925129c57908eca9e7f38a2f6f9296a034b6bd30384c3997dff4a19003d49f487dcad80850686bbd26adcbad7ce11d039492d8c2c6
-
Filesize
8B
MD5c2fd31cd2648e605cb88253b910b1f17
SHA1ec6a5cbd930c0346c91111c6e64087f154e86d6b
SHA256ab69e49fb54f4dc90ee06d809693e1b8a31f17d857c4f51221cb5d6e9cea5e21
SHA5127c4bc9b494a1bfbbaa1b6ce424415116edaeb778a8eb7ae123e3334dc73bec6cbdb5a34735b08c1f8ed715b3b62cbd4f418844ec2a686e80b8786d044598139d
-
Filesize
8B
MD5a1acaaca0314da70c770c68784d702ce
SHA1dfd8d35a8226d6c0241d5cb1ad040a65b5f56bfd
SHA256ac889db141c734a9903910066896a97b219451ff88b3149d20837e7cc54c8085
SHA5129f3f762f32976a843b8e84849e17412a5bd7f2633a54162647cee534143e3c502eb710ae17bbdecf4e66160a4d2d739681cd4c2f0252d356533303d52d3c02bc
-
Filesize
8B
MD50f88aed44c1df4fb333e86eed80b8599
SHA1dd0e0a8894b0cea7b526ad6fd7d60deed18bb7bd
SHA2566436a6eb1eb8b27ea0bb43a811bc7ccfca6f3252b945e12f466cbdb8aedd251c
SHA512571bd77104796accbce5647cb20251355b798235658a43041a4fdc9799d5cf75107e4c693e0dbb8da0c1b17131695e71bce6c29b7ec1e2d55eb63d74418e686c
-
Filesize
8B
MD5345d37c353296f4f2d574a592a1562a9
SHA14f84dcadaf1caf64e55ccbb483135398b4cbdf8c
SHA2562418c89028acbd39bbfb5ebe31a27da83c782aa6df67412379de9b2655554132
SHA5127464d2606c05c088b51f935725c137876a512eb3b5cb8dc9db4a9330331bc5053b595c5bf15a6e77dc21b8b53bd8b2d198825f6bb8b7c8bf3211aebdd80da220
-
Filesize
8B
MD56e0f328aea908568ab632370683ff606
SHA17480bd112027aac7c6112eb92d898d2990fce8a6
SHA256aaf98dd91fe4654749b0b39bf9f075fb6f10a2cae408a9f02e704c1c4a9a964c
SHA5121dfa387a08bfb566f555c51d0f7506cd4acaef66c12c7daaf2783a73bcacac3568549b52d4ec95ecb7a93e2ccac352fe93a7a279c76927866f41537af473bc5c
-
Filesize
8B
MD514d5f2b4f28623791f1aefd42b9da838
SHA1918a931063395531f701e643e3d19a8889e5c12a
SHA256d392c55fa973d53de8b8655c6b4b14d4d6b19bf8295cef02c685b27345e9dc3c
SHA5124d5ba20f37842907ff9f442b2846d1625a91bfa676f56c8d4adeed1067b17348013508bb786c81071b46eafc5f360f94edba879910836712a14ea19c9862915d
-
Filesize
8B
MD5cd02f29d91a148530f16a2a15ea27896
SHA12562c84a442477374fecbd828b9555f12701feaf
SHA2560d9fc5550393f0c13171cad534435f10532927b2ed8e3bff9104a570474df086
SHA51297a8d61089300c61a51b3e2549c1807aa3b7377a4bc2839be13e46495e1bb69b2a0e2088e1d9ceecc99fe9121b56a3eebf62cbf525386fd5b2cf5f75e6da7dfc
-
Filesize
8B
MD54d557a1e96ebf7c168fcd5de317cb595
SHA1bd2579c628b3edbdb36d9a7a2372ca9773bd6e22
SHA256ef0b3f7defd048de355cee109d8e7b32e8abb8b20477e10aafaa836af4fa58be
SHA512c46f000aa505414bd5540bd71e8c45e7ee5c3033a7da6fef5391eb5d27b96fccb302e64097e5bd6f27d81a28950aa86b377c27755d94106dfce4d2fa88347034
-
Filesize
8B
MD5748ee21be56248416903c4931e1386e5
SHA18297d4c21cb48cc266177f2a3025cfaba634e327
SHA256e7a733034c2619b0f06f248acbe9e175f2344d03436d5a99dd9fe0896815baa6
SHA5127e06abce25a05c0e97b12af52bfd16ee50e687287cf55b342a7da0ac05a135c2dcf81764af8f942b45717a95ac68fc58e93214830cf02f8d792f8e9622fa8f57
-
Filesize
8B
MD5b9f3f9f7b6029fa7b615665552b9c577
SHA1ee4cc7588d3e5e094acc2d7d930e3f710b44e9fb
SHA25600cffbb582f5ae17820edec5b319bbc913fb51e599543a4239aead1c85b64f9a
SHA5124909e68d31bb1bfec4510c89c53afc7a90c712de35f7be0766d80df0258eb18ace47f871836abbfb514f245971ef6803c40a707e74417a1d47c072ed54ec4320
-
Filesize
8B
MD5fe23940a9777e16163d7b5dcd746e49c
SHA16078cfaf4a826ac575405350c2616e8c91277f0a
SHA256875eb69bf45994af80ba628321ba507b4b34c1d04151681e6e4978f54bf3f8bc
SHA5124c3ce3b7d82bd1b385a37e10e2f85f27393a91dbd11c6108ef3d334ffd9236b0ff4fcb0730c81f78be32f2ee034ae80e2e1e194e89f48f84ecd7c050170079e5
-
Filesize
8B
MD59aa448ee24385e56dac0bc3968acc957
SHA1b95959c0b67555fe15c62361b85211f11817dd8e
SHA256de1391a32a344da2b11a1b0a5dbb313fc0c87f0b396699b05f8ee90eeaba7bd6
SHA512ad7c21f0ff623b1790d8f3b3c343c6f7fd16b9c47ae96c6a9e731b190b62c89619f58056ebe543324e0e3f910fa112456c0b9ef59f051d7448a57b8ba07dbb89
-
Filesize
8B
MD5b7abd35b12c64078d1fb6726b503ace2
SHA1c8674a7596f797621c16d403d9a7aa5486707c42
SHA2565b6d5bade7e70544f80e44417b9779346a10161ca7ac3b54e137c27ecd146aa0
SHA512d4c26db84fea8664844c74fd6e922e049d04435dd16fd52d9f7e60f45c541b2e3a73ad2684d4f7438abd72befa45e3a2e8fef93799ef61d4c6338b1e5edb4263
-
Filesize
8B
MD5e96844b0dbfa7296410d5e9af7e09beb
SHA18e63aca9594416a8e77c23e46c5ab190e7cc7bd8
SHA2561c4d068175bd7585202030b2b5b6a244cbfe8a979aad8256c4765698b3c2d59c
SHA51205fee7bc580b6873f9062029ceb832a51af4581619090f22ac7efce596eb6c2fcd9fcc3581ecbe639c540f2f2e1b892abcf38e4a19fac1e3c8a6416678d13b76
-
Filesize
8B
MD51528e41fe6c2f2c9bc00eb98a82a82ca
SHA1fccabce2a97f34075a76382dbbccedd95860b5c4
SHA2566b6e7690dcb43ab4ef22bf265271d939ec386185c748796d5f600b36394f300d
SHA512ffb0a4e50d0bc03c145558996775bab00177d571b32669ade96f73be17d91859a169f2ac3533235b173ef769710083797479c8ac381b2119b0e2592a7fe0d3b5
-
Filesize
8B
MD5052088cda004ab80beb9f2694dc5722a
SHA1a6a93819d0884940dc6cc480d14df536555594f4
SHA256a3c43321b13fe5232c3c82b50c2493dde77edb41cc108811e1adf607f794001d
SHA5125cd7ba37ed7e72761ded4cd9c21c28b938d0eb02bf72f78c9debc97666bed2a4f7ea724fad0ae7e0c2ae4baaaecd1f4c92e5d424aac8baa040905183712f08bc
-
Filesize
8B
MD5e8fe3f60847022651defc44a1c1fe5da
SHA1f4ed1aa275f2fe7b70405d9c22d00a505804fffe
SHA2560c69ca84a1e354ad0c561dfe19ee3e44b55990593db334d276b5ca54324bdc5e
SHA512728529ba486cb65c37923bfc57af2a15171b404a58f50be8848e0b5210c86d0c4e227141d8337a033d7f97e890a74a6794b5c0656d3f73f748b836c55080628a
-
Filesize
8B
MD56cb5f240b8ca5e035f739b28ed7dbd0f
SHA1d27fbcc3825e8772114a1c435b2e3f1529f4c54b
SHA2562bc2a65c2530a49173cd0e9181af764a41762abeb5cfd3b011f6e095ac26e715
SHA512ec1bcddd7870647c35293e557de8a40e8d1c4421b76004cec3e2f12e32f89532c880fa1135f7e1b4c4115dd0a52729f79d59bddd4b732b4e9067f038cda519d3
-
Filesize
8B
MD52f9bb50927e5c2b9d60862fb5aca77ff
SHA11a1308603c68bec5f97d93b11efaf67532259132
SHA2564fa5ee474f1fd98c1e51aa44a38bd87889609011e45e20b649ab48c54d4fa40b
SHA51297faf150966493c5aaf3a8f9d2ebb58bc957d0e3eeda1b0c25bbcde90dccc0c555fad3a45d6e03bab2e542bb8284a78bb7ea3759902748c3db7452866d8cded0
-
Filesize
8B
MD559d043b1a5bdf980ecf7ff9f9e3ec90e
SHA17397300dd9ce02697b1e838325f0fd2e57be3f65
SHA25634b657be4ad0aa482800df97c21210cf3f5a43e7db1abab69a1b3642edaa8f31
SHA5122d9dcc5dae75d9e277c258df257aa719b8aa7c5fc1e0ca7161410f6e25c396c26589402270995b456d0951a3496a3c8d718c46137407101aecfaaee7f7083d59
-
Filesize
8B
MD5f386e298141799fd5ababe10721bd937
SHA1e6a63e2f0df2e66c17f0f3611b445355102ece98
SHA25655106ac1e9a722ff04c365a2672aa698380c317ee22054bbaa91cc486c99201b
SHA512ebb6028d500f4e22fb62e1ae8a70ee7747cf42c5bd48a1af85b834aaf9f8153c5f9b8f365e72753def4f3665ac6e2e272eeec71f01cc78eb96d6e1987b1960b6
-
Filesize
8B
MD504d5e2d1f5a4a7b5a8b79349e297fbf9
SHA16b159e25cac51a0d1cb5cf1d07c555970fb61be5
SHA256b7fc59db49f7e9ab63ff3d1e2e678abdc8bf3177b3f2569894065001e23d767a
SHA512d3f9d9aa60eafe8ccd04584cc55c65b93aeac12250af50139a8cdaecf2554b62ecd60ee0db5fdc1a654e34c9832d43d58be3a8ae3019120a7fe4e89cd90f0980
-
Filesize
8B
MD53e4ec82fb1f69100019c4042b13c7fe9
SHA117c48b5c8de42e230a7bbf891e60e89ab2556e17
SHA256ba995c12047896431c8703910d933e6885e16467ecfea831f76aaa723eb9c055
SHA51218e5ebd7461590d4eee19756e98d80572edcb1e4d485fcc12a30133a88ea56d1e6819f8ef267b1b4512353a21e6c5a9b9e4937a06c2ad4fd55f120d1807869ca
-
Filesize
8B
MD501252de8b14f62a234a4680827cf1609
SHA1790242bf9d1f14b69ccedafd5cd7054b5a63a4c5
SHA25639252a8b6fc8a087dc5772a8863d62be51d3a3e2efec76e4df447e2ffb3444ec
SHA512dfce622e3f92aaaaa8535f25610d62a7348c65b651b7e5741b94885a055268470eceff189b60cb96273efb91d8e971af481298e4305bb211fe1bae705568049b
-
Filesize
8B
MD5606941e62dfeaf743b0cb8697f27ffa7
SHA15a375fe3efd94ca713954b0f76b95f6d2ec7a00c
SHA256e0dc2936707f8633f4f6cdf1330a42b65c039fe1937281ed107976612b218996
SHA5120ec227876a078911fdfb1ad7fa4c8b80c59d189759261e1714937084c2fee14a5bb38ea7094664861709c62889f70c84429a8374f4a03739a13bbfdc63059733
-
Filesize
8B
MD51c088f0ea2e8839aaf01efef2ce21f8a
SHA1a87a79a04d2d8fba7fc6e2c46f49d92c1c9c0117
SHA256f92ba72e654f2a48860c4080b4a3d135e4ad45b91164c4bdc25a7d230df7112f
SHA5126cc74e3128c636b50179579aa0c27f68e361f2ce3054f00b911a337cb243c71cb5e0360928f79333f85ffe0aaff77fa923789f75daaa649ae7a2d9e7b1489ab6
-
Filesize
8B
MD52f87377977781755832181d83d8275a9
SHA10583b2988c7a35e644d6fcc79460c70dd213354d
SHA2562728153e9a4f1e0bbbcf8592c77cbdfe03475c044e1d630832f14ba1a6b91527
SHA512fc0519b592a8c5c556ceb894524e7532b3237b62c433d72d44fbc39bf3b9cc541de93581dfb231065feb1f6552483d2a4e9f40a1d3e65fc9c824654ebd5e14e9
-
Filesize
8B
MD56cef7dfc3d6de0f0054375ac880939df
SHA1070f1ca23bb5bdd153724ec4f81b89d46cc34256
SHA256bb321d37fdb65aa1a6d02b66c67259f1fa7b590132c979c9f607dd279c51a12e
SHA512e41122cc5df2fc31b0b44153381767080367f32367d83054fa83cd4d89d112bf05175a80b5c9d398344b7b6b0d1d1f12e41ab86c97e806c36e2598bdebe2649f
-
Filesize
8B
MD52bdb0af2c809cfea23786c961b0b329c
SHA1cc383d05929f3651685344db9d1e3d2336cfa6a2
SHA2569a84ff30fe26efa9d04f6c8c5f9c93c73c4f4d1dd1089cb0051d08b189140e08
SHA512d46f11de764ec989b6b487c302cfe8f8630547c25de71da0482615f92c63f107ed7b4653f713d83007fb68e3b04ab5579e15a8bf18d27ecd823ea7030a1112a3
-
Filesize
8B
MD582287f0b45a98c6ba87ffc97f4bfed4e
SHA1e3c138ed4f5ceb91c47b255232a602a94a0cf781
SHA256227566626144ef9c4c6ce68d43c1d54bc867e7d028c6824925b9878de5bc7ba8
SHA512ef52b9e64874e0154dec49068aceb96f0fb29a924c59f1d21cf60f66c3057f63892f3857a6f6b427e369092f9aecd47846a24ef1a0fa7a37032db6e232083f30
-
Filesize
8B
MD551626a768195b41b05a72ff300df7070
SHA18c9e83d7716a6b0ca49b28f5b3941e94c1a41855
SHA256fb21fd18bf2b7ff287379eb99ebf92bd6e23faac2b05387d129b556a586ace15
SHA512c17751dc6cafc2f88696dc05efae1929063b2049aad2129f22ca1755e6d5d36e3f466eea639cfd19aef476d9766d7cf8b442836d9f0cd98b89b3d08e6f8bdc6c
-
Filesize
8B
MD508ea1e135cd3c50996d62ffeff605781
SHA12943305d41cb1bfd7b5f5e3451bbe952a04204ea
SHA25681567fd111c7a5339b6f03e3b2525b27535c8d4308d8fb51309b300d4125706c
SHA512ce4f5a46a31ba6a1c883b8078d2daeba4fd6bdc8e755210fd1499d1411c99c2f64e43f0712a3ead4a27017d50e3869cd970c147ad83447c5afa3d0ed83edb32e
-
Filesize
8B
MD5ac3b9f4e7ef86cf3f6bb56c658bbaf6c
SHA1a2e00b89e7fc42fecfdaad7d790fc1226600ce8e
SHA256c9bbc843f462dc8a12373a02a172d639d38b1b04fb014c0f023e4a3782570c1c
SHA512675de732f8220b45f551fb6fe679eaeb817d09949e1d2941506d2928e80730ef07f02c6800bd7131e529e802d2ba84393692ed4e3715e9e55450476c67a8b52f
-
Filesize
8B
MD5946587b2f6557473b25740bc51f5a650
SHA11ef6b10b7acc200a5337051458477964fef8b074
SHA256e9ea793fc4ecf65da90fc09911d7954ce1c17289cb965e3f2f391cf08f218389
SHA512c5be771167469c257a6bec5b3336a8de923a172a3164fb2357e1eb1ba4a641906dfa2eef23960ee7e2c10c72a9bfe54857f7b0e74a8e6fdf65c4bb83ae996e71
-
Filesize
8B
MD511055950c29a560a388c9bf31251f578
SHA14b61bd9d290be12b5ea9d1e6145edf59ef38dd16
SHA256d94a38d1b95731fc9356827c688e8d9644fbcb7c8a885318e423d9c9e42fcf5a
SHA512f6ed24b66f0fc908cc960d94a6a66f215649e82d6844889c4920221a47e5809c3e5e7ad3e6f3e5a7386f9f0b6615a7f33bb129db32f0b524f84c73718ac715f3
-
Filesize
8B
MD5fa16b0c20246eb9f8af39d23b842168b
SHA1ae70c593c21e2cfe9493d5e0069638135630934f
SHA256450101f596f79860387051119e4e1bb635f1b9e1167197635771bfc73f4436e7
SHA5124c5f20de4d58a4f6cdd88d5f369268dd3ef1c05395a1e2451f98306ed5e50ee8fff11c00ee7951bca835098de399a151e37d9811cda0e23e4516ec052f8b2461
-
Filesize
8B
MD5a46032e8936164843f7cd814e23d0d98
SHA102eea53ce08b71b64a3c1de586a6f27c8d76507d
SHA2569762010c0d7c9c9a1cb46f15c8715c821de735805bed20c1344c19eaadbf56d0
SHA5120c756d83889e3bb55abaa3fc62daafd885f2b8843d7f3bda981a701dfb5dd6b1f7e931fa1274f41bb86698f12271858a78b03b323d5e3aed2d69f8704bac2e0b
-
Filesize
8B
MD505e0e8ce346e24018a0d9d70f6993a9e
SHA1b910440db74b1242b785a76146a94a2d3d90bb44
SHA2560c668a9ab97c07e55ff9c5bdb4b9fdf43192b89db8c8bc75b2224cfa26438e20
SHA512733e6fa85049093fa405c0e026f0ee56e5cd5be06d4694b282568da6e4dfdcf4e58f65a2405c3a999b5b6c16ba29da081d5fb4ab150d8a843fb93217363ca17a
-
Filesize
8B
MD548889c7f2e3e8204a51c8146da45728e
SHA1334258a87c1ae188258843a7f1c932a255875b93
SHA256d45cba49824516c11865f16ddb0ab954d0f424c536bc00054ddf52c00d92f396
SHA512244a8e321ddbec82209ad5455def39a20fc0273acbd714e949249bada9930f932b8ac0236d00506dae1c177f4b0b347c63de0c04e6bed7db696305be23c51350
-
Filesize
8B
MD505d4dbf40d962727c6890c5864ad840c
SHA1d5f59f2018763a19b9f2f4df28488ab7f19cd560
SHA256c79363ec7a256b6ba00fcdebf7ab0d464afa9ad6f95158b224d5e07a117be61e
SHA5128d6b2d9c706058dce8eedc77d1dbaf00a627ffe784116aafc3e6e7b22e64f65c1d94e1f8d66ad9d0f95a36e5c7a20825cf1ef14a95e55cde82b60c74997bf739
-
Filesize
8B
MD5d1881b2e0b57676e8693078cd720d074
SHA1e80a2f5bf165a5fef0da9fa031b78f93952a5705
SHA25662b676fb2f733dd14f9dadf0898df1afe67ee291db3cea35d9928dd5141ea6a8
SHA512b4f112c38d3c09a8a2e3c074cd84885fc33ed67c1b08cde53c7095f925fab50c5aaa9a581afa648fbdc794a3f19c28d74f3b31218d3a1c1393a9a7a8d792e187
-
Filesize
8B
MD583892de7a12222ed9333abfa4852f4d2
SHA1a1667aec19537bbecb42bc6b442dd502463de882
SHA256f77f887ecfcfe1d78ebada7dc77af94f1c3284e9eba807cdb953a21c2df0a5a4
SHA512c18fba65d4b0d9e66831484bd8cda29cc92392a66c77d31ccc4db9fc23734ff124448e26e1f942ba13dd5075f8361e57ef797e2a1e4560375ab08ff92795f156
-
Filesize
8B
MD5c10a13dd5b1e58ee6369d8366dc68417
SHA1be2d84c7887e8b2e0979edaea3601af83d18e8a6
SHA2566de8ddab6dc7a2b4a258d857802384b9947b7131e1985ba1d489b093241a0c26
SHA5126f99fb82f2c6d5d480de80ff80ce3c6ddab1fcb928bad6ecaedd4a4fee13141c68559bacda4003ceec12afba80455e5ceb32190dba3b818a6a8cc316e23a7452
-
Filesize
8B
MD5c4352022c3e2330ec30d4c607388d0b4
SHA1a60a99d8397c249cd77f8ce4d3c3e8714c01db62
SHA2565769eb5d5bd3978fa8d0544a9ab2b8ec5188f0616de9351f6e88f08e48554492
SHA512d86a7777fbf4622c505af478393f1ed0d64cedfc46e91b6697897ea1606b9870820c093351c49be461f7ff461acf1f9ad40d520097d197f6ca245be43fbfc478
-
Filesize
8B
MD524b6ecd553ef328cab484f5511adf61f
SHA17f97f72096199479f3ff31715e411bd5c4a92e20
SHA2564c96fc3bb73bec980931b699cc3fd2b0df36da5ad0a082ee649004ad4f1b45e6
SHA512a277fdbebd170004dc243d5e96557ac441389367188efc5bf8608aef9497d54f58e63bf0af347f6f550979c7b55b60c33dd91955a447f8538bdeec5a93a2924b
-
Filesize
8B
MD5ae7d1aaffe6a1c544d161e0b0f9ad194
SHA1343413aa5493f6325959ad03f19610b792716091
SHA256b88fafc27e9ed794bf4ea9a88e5976d6e982a90022e201ae90e8aebe1f3833ff
SHA512254d3616f2589f48f2e70e875f79521022cddb08b4947cd431bc86321c93b2d1cc75fbd159deaf8bb0d3c1fabc0b852d9c3155c79b498671a5fe78c8adb3f92b
-
Filesize
8B
MD5ece9002eb0cc5b8a4022f912c3c478f6
SHA1ca063bb66113185d3a2b2c7aa979fbce2472a8e6
SHA2560be342807bd6789fa402de0b6b547f2cc25c254a77907f0aaf0b85fb196af6a9
SHA51242d88a2bea25b07269c5cc5ef142ab9c922912810b1629b10a785c6292a1a1941e98d25ff67e49832e0361d48305fc1a6c24141830b42aa5ef4f377acef579d0
-
Filesize
8B
MD5bac24badcbf38d65f374d597f29b9d03
SHA1eaf113fe174a383128d49be75ffadd86f9b9efc1
SHA25639737899f615f012c1a48498c210a20e8325d64aff81d2a7a02a23c83e6eed3e
SHA512d3b3f5e3e2ccb67f55fd5d63294120c4b242ca7971aca0df444075417962a88b7a450d60ab74e67b3d7fec305c02ef9daf7560436c8f7e7ccc38864510f96702
-
Filesize
8B
MD5d4d2edfabadce83b6bb534db7d3f9afd
SHA174451c1fc26a827eff5eb92834e92b8a7f5be190
SHA2564bd88ade1327eb14924f9090d98ed122b89f11b2ffce0bd32917e0a43f204dae
SHA512bd9d9583ceafc988444cd90b17cb435faf15ac8138b656293ef56286b4d406cfa51f34a57ebb1e6b7c7d218b54ff9d0719026d3682460fde10a4ad0e56a100c2
-
Filesize
8B
MD5da21d9330090781c6aaa3b7f9091035a
SHA1effe4afc3af150df76b8ca60e63a7f20f1f22264
SHA2566183a35adf18a576648c7b13d00864e7fa62603933f9900d3f69ad6c69006d85
SHA51279058d53aad25c0bf89a38cc5bc0bb01cc6fb7d9a8d4824f6af266a0a4f9e139895a5a510f840cc753ce6802520fdbc09c6da8e83fde40b026a7392b2f0463f0
-
Filesize
8B
MD5a9da0afc5c930f02ec2d1061f8b02989
SHA19e8d5b899e9530b4948a82fee60404a2969cef75
SHA2568460078b6871820d7ee06525e809c2d5cc8f9d70c125cbf8b1b4e228a26f0084
SHA51216e8befd4af0a8d98aeff688d3ede4890693aa1ba4a596bc7ed62537bc3fd310411a4c54083649391bde165311eb32a6c83e3127d0abc5893060df5222cef7e6
-
Filesize
8B
MD586e1e8cd46b72d5bd77757ace8a2e8ee
SHA17b5197b0314500a9addf4b608cdf7d5991f02eac
SHA256689083a6cb7193e5d42cdef54723f73dca98220053e211de308e82b554a281bf
SHA512754e66399a58a8174adb467e488cf9011fb58cc944b7befdf090cc8de8b7e1996de42fa0e9f5a4484f1b3e76e9bd0614cb14140a223dc71b3b8393fdd6ff4aa4
-
Filesize
8B
MD57d2ac1e5ecb2dcf1d227da393e927130
SHA111427645a23005eb752531d27909b46dbd48e0bd
SHA2564300c70c4728d4eb20030834d1f89d16546b542a9d2ca1e92be26bfe4edfd594
SHA51252133ed13bf096dd1147bd0a094905328c4bb45684e0be9b961abe78a7c57ce0f6d7c6e714de307920322dfc7a87e41e2dea2244dcaba167ec3361ff69bd8f8e
-
Filesize
8B
MD583b5bbaee722fd4c18ae2763aae27650
SHA1f223c0e89aea42d147e9485a954a75567f771baa
SHA256b992bca82b440c17ff2ea4c48fd662297e591ebed2e2fe0255244d87a27463e7
SHA512b7d8f72429eebadcdd2f5ca5b99795d0e55cd385d2f3dab0e857b8a26acaf52a630c8ae466dee8eeb68e4fad172aee2f8e5a0bf7666997e771d2a644ffaf1f38
-
Filesize
8B
MD54a4215200dd69f61c5b3e5b011af87f7
SHA13b5a14eb3e2c03073b17c7ca06eebefc4622cd71
SHA25615b9f40eb506c5afee3c86e6311aeb6db94ef4c87895acd9bade977db8ddd940
SHA51226df0ef2dca8f93dc7d5cfe5fd6e72b14a482cdfbe905735fb9d14c8998007b3a4658d47d0c83dbdf0475a24fe4ba27bf90ad01be73005d4732afb6c57a03702
-
Filesize
8B
MD5c4ec26b5120672e663297413d5d10c3d
SHA12927d7019e2bc7d2e1eeb471a8b1c6233dd152d2
SHA2568080fa67fd6267cedd8b7e92650784704203b591f7eb676f2f4b53469f750d8b
SHA5121b7efbe7b0ab4cd0f950bb14ff2a3cdf2c3146795b7859284677ffa5e544c16ffc9280d0dbe75515aa50c7b49734af543991c9e46fc8c9f0f595da1ee25bdfd3
-
Filesize
8B
MD540aef6ccef9cac363cd5213a25d5e10c
SHA1b723af7db773e451a2c7d289038cd4a2209ea22c
SHA256f6a5a8e4b90af414a5ff77e9dfd6506150d39ef9acaa6501eb2bd898892872e6
SHA5125bb7691ed2ab7697885df61a8c13cb1d6261fbe0bd094b471a891f39b0736511dcadaec173cb5cd27aa1231e720d30af43a4e2caec219120e5ce25d75c55b671
-
Filesize
8B
MD517c99c07d8e80262a77a88def5467e4b
SHA10e9efa92496aa763b5eebbdc3f419e56c11c953a
SHA256894a99d58a0e30bc75337e78cfe88e78121a357ef1b0b78ace994f101299eb92
SHA5123619665f80aedade5cfc637580ae737a1b86cdf2814d75a095e7d31310160a857afb02d3ec3fe7300b88e799643d81ec394f7d0be7e060b0c8b0a7672625327a
-
Filesize
8B
MD5458f8916baa4c9b6968d90de437e7f6c
SHA1da47b10113bd620796b8ce0e5640b8b1c4c9f560
SHA256dc21ed5c230136615b241663465792ebb50f6e8e23a24a5aad1cbc1104749243
SHA512624dbd754a3d5bb7c0ef1afb65c04b6e1966c4fdd223c8551d668db03124c3b50e6c3bf710f8d695a1daa93cc08179e00bbf755fb768ef9c0bc0f33b91b4c142
-
Filesize
8B
MD54dedbc84aab4746fad84181b90455746
SHA1a386ade953b8f2297ba0ee3b7195036395c60ebc
SHA256b215292e74759e30d3c4b645e1a2efab2a4cd6fc3b5655c22b4bc3e3014f52a1
SHA5121bb69614c4a755cdd740392e6b08b7d5c74ef7d3595013922eb5086dfd44ea2236118ca928dd972979007b4b16a1783df3fb10b265f03e4c2bd4d4428601706e
-
Filesize
8B
MD5e461829645468f6ae27d74b6f666730b
SHA1eece0e238f9308784eaef6138b00e324658aa75b
SHA2566472e2f18de2e6540ac8b4bda755670e388edd3ae373662c4bcf583091bf0788
SHA5129a51e6d9c6ab87efbd482ed3c46b8cd4b51985452d52ed1f456a0b4741e656d85cf17e2450c16b5532a4185040f3ba4d804d392a1128b97b5ab27a6d5f6b1220
-
Filesize
8B
MD58fae28525f1fb10d0eecc69eb059d219
SHA1fbada13cc197e33ec967d267f48aad0b8f03f408
SHA2562e45c6fe253b9311c72843b3401fe67eceef50234918c2053a711ba68285b4dc
SHA5125c1ac5c0c607603b4dcc53316b6c32cb16ccce1cc52fe9fd5b18f8a228004645ad37689b9eda5ec95a7e08cf8a94d5c75a758368ac3f2ade94b3a64be828a3f0
-
Filesize
8B
MD5dbc48558c7691c37e38ef4a5ddb288b3
SHA1d7692e92ad3407c44dc98569cf9d1310bf1135ab
SHA256b87617a4f29d62fe86951878b9ce3232d02c2fd2379d2274ec7c345ab42371ec
SHA51247ce02aab0f41946d92a9aeb4172a6e9acf43e7117032b0f5287fa9d10a65efd1fcd19cb661c9ed4a7b3fa5dc0a49057303942ee6dc1d753c13bd919dab21801
-
Filesize
8B
MD58ec47e8ef2e1de71325700211f89b1e8
SHA11002631d9f9131b3219bc7268812dba0cb9fe1b7
SHA2565bdd33659ca354d1355ecde3b79668aabb2823d66da4a4fe3f6c3752a989ff13
SHA512e6f7f7d0858ae8743fac79913fd59d7be8efd0bb71398cea9eafcced4489e8b79e0b2a8e179761bcf66a0624d0fdcb42ab4306098a805980faec432a63f4a117
-
Filesize
8B
MD52ad9d991501adc5b4f89c2c43482fa00
SHA13d0e7d1006d4e0c28fb3ac7d50d2353119c66432
SHA256161e3d46eb99e1ead68113d94175ea185c59da6018f19b950e5ecf5330d0290b
SHA512b691b704a25797066faf3fb51945a7eea9ad24d6f9783496da2d20d1f240a73b5c9ccf44f574d8ca771886e5d3492000f7b65abbc39c014cf25edb6303e0630b
-
Filesize
8B
MD5c8039a5c77e7fb3c1520ce0b6a77ca18
SHA1de15ac20364813d2afdb3501ba97118aa7c04641
SHA256db0b626ff48fa1c26b89fb04d28680901ca5501211353f7532a7c3555ddb8660
SHA512e4f51cf60bbf06f8620c119f75aba832da6ee5116a9173cb1903b1348d84721a69e7dab10a39e486dc52ff46a624ffd9375de58d4e9c7551fce3cfc9ec74193c
-
Filesize
8B
MD5134fca77ec77dbcfa54fb3c21a3a5958
SHA199c8ae6c6ea759e2965a1ee2eeea760f3238d634
SHA256217f5172ac9f01daf1e62effa520d4bcb582c61265e4ae7b50899cfbf9ec2293
SHA5120ede8582ec3584a7a7fe02919bf8dfff5757d51f632748b4e77c8230a68379efa1a48c5e3110296dd3685d0cf8134798b5ee03af39b29e88aa61a1ce09990ea6
-
Filesize
8B
MD5fc6a8faf46397c6a0478bd4832b2ae7f
SHA182f8f7afc160679ec61f6edd7ce03c7e4b62082c
SHA256ea51a73d48951f4eb265b9de0859e2bfa8d1cde3a3fcd16f27722e6dd66fca07
SHA512c86abcd50e898b88a23947f30b58f9d812999660a7e809d059a28c069853150178eaea5531f37b9e5083b101d8df2c1631e953bdf4ec855434385f2b811ac3fd
-
Filesize
8B
MD5b33e389086a4e0d822ba32f30a065216
SHA14ea92ff9c959d94f24fb50bd6d55a918bf0ff45c
SHA25627b5840f5b613654eab3c2b392423982434fafabafdf62084c863e4a3743fd1b
SHA51260e013ba20b5bb3205438f13269c0163e8b157cb33c58b794061ee1c5d3c07c738f38a3ac2986b0bf187fa8aedf86576b3a8020b648b141e62725afaaf309197
-
Filesize
8B
MD5c35be045fe04a8c7dd874e0001a6a3b1
SHA1b197e1c783f1ce05ce055f1ffa505edf3e1842c0
SHA25627bb0bbe1c5a1ee9feac4d7c45130024f83e718a5487ebc83995f98890b20304
SHA51239e8fa69ea9c807b03f08b7f8a4d3ea951e874b617bd3c31ee36a0de42aadcfe784488f63971a7c5ddf797ff10dd1db6981ea3cc7fd54155acf6742f0709fc4f
-
Filesize
8B
MD547d0384e7b79e5e186ea1fc930c22b00
SHA111f696b73badbc4829c65f2e7e1d27c2430f58a2
SHA2563fa7c86a16a4ab3358adceb3e04d905c538ea29eebd05b8fab43e58f8eca1630
SHA512aff0825399d25e200a545547327d0795ee86d2dced3278b2fd568573a7c821b4d21322a012bb6f52743297fdd2e862cb6327174b14463fe0587a929f40727d2e
-
Filesize
8B
MD5b61615ba49aa4db8f5d8a39c1f967804
SHA1492a09aa3d171ea016f09983126af1d315fbaff5
SHA2567cf7216e2afebc5325d32a0a5c8214ddc9f05eb0c4dd1581c7dc4f31de122b92
SHA512aea3870571d55eafe3c9ed78e01ee2d88cecea3d558b5de2464992afada3d3ea0e442952ce391e6ef59e25c418d4ed6e50be72bec5b815a3cc7593c0b9ccd43a
-
Filesize
8B
MD54142738f3ab99b3cf813c3766c025d75
SHA1d0465633709fda8217a6b1dde2d5671f74a54649
SHA256aa0afb644f0c61a49665a4cc8ce82d61fd52d69d6294c02386970a3e61fb2264
SHA512e219c2de1d25b1350a24f69328ca1238ae67879db503a14cc57f681c9acea4571dfeb03ab4fb88674e59f825166642585a2414f4b0a63cd84b0b683e19347b6e
-
Filesize
8B
MD5b40b995bb1bea29dfe6117bf1d99e5fe
SHA14c62e283a2eb52ab466d1273575e1cc11a67be9f
SHA256d1c2b6baa730d8063de682f459689832208c18c68ad3e6226634a893f6566bf0
SHA512e974839d106b248fd77ef4ff759342612d4a72966b0126ca1af286012aae07bc97ced5686d8af1c933b382e41c0dafc23a2cd7aab71f45adf794839ea990fd08
-
Filesize
8B
MD53aa91c013ea2040d9f06b9c78a9759ac
SHA1c3573d6df4805b7ab3909c9b991ddfd70807f8d2
SHA256d96c721d2453b263e3852adf21b0a455e5f459a56c5315f0f981cc59e6737e71
SHA5126f4cc497c99647fb710344a167552dd8c786511614bc80fbbf496eae5a726274310dc270149edfa4a9a760a724df8323eec4e6400b088927dd0ff873a087111c
-
Filesize
8B
MD5963fb9f3bd15a64e03bc9239b6ebcc2d
SHA13b42e1a8f8ca4a820cd44a247741fdc543194e35
SHA256e5851b66bcd28f951ee9097c09c6cc7e07595ce3d9587e14ca8722e15b11aefd
SHA512a721a00d0eda6fd3e4870a9679e43a0f57038be7b0a36f33766d1be891e571b677a6da14a7d353c9c22b2e912bc55bcd01e4af66c5a791cd01ba4af0243e0dc8
-
Filesize
8B
MD53654a4c5a1b73a48c9a471522926411a
SHA193254f948287ba57fdf9ae680121241de81abd2c
SHA256b8443d7953e6b3fb1b7b82154e5e289703c093aa6c6ade6ddd9c1897e182adbe
SHA5128514a683a69c9a6f41427988c8ce3d4ca3e2abb91ff50518d28191305cab1a2e488a184ba7f4ca50e479e7d83554102dc9720a9527766c4736007c4223b67842
-
Filesize
8B
MD5d712b639fed801c92ee24cb9e1fefa73
SHA1d5f7077ae0e1554fabcfb4cabee4b5ec0d2f0752
SHA25656c50a2cf1208298202fab5e0b49d11ea3a0d2ce2123b2de7ce274194bde171b
SHA512d61717abfcd57ee81365b7d9f8bb1877b0fea6b3a376b14a21e1447532c54720cc4df9ec4451e693a3e55f4cd1a4154658769bc6ac59209432e29009c05265ce
-
Filesize
8B
MD58ce16883ffd41f4c7acd5168b863df47
SHA1a6c0d2acd4a6f67b874bd1816c48c3623cf807bc
SHA256ecb6c8164cbdec468b3a428ab59d1da0a17dd50761165de900af9f9988db3847
SHA5120b5864a03a04d7ac005c926400225c51f05dddca6b5924c678b543fe624b2a02a147a9e5cbff6768a93f9d93dd98fe1c9cc57592a508f76f428a9a32cd6b91bf
-
Filesize
8B
MD5b70b36835d42fce3e520149a9023deeb
SHA1a2cecdcbd8e4eda89517e96cd3ecbb639fc6d068
SHA2565d2afec8dd885e97c55c8de74fb856ce2b760d66286c66600af03c2d794f0eca
SHA5125f8758be1ae74e8af21ef5ed88a26698e93a5cf12a932d80dc88c3d7e393ac2446caa91159ff782e50ed872b169786d878e5186c0da0974e372ce40ade192826
-
Filesize
8B
MD58d4665a08a672aa71d25c59248cd195b
SHA1a535f73177dcbb9441b39ba54b77d0458556d1c3
SHA256da139e060f701612ff8fc120271b481e16044c1aa266c2393c6efae5591d1942
SHA5128c995a6c483f5148cbb23562e0c412e8156162765e6dd147232814df36425e953f46f1e9c2b0d5fef514cd7a09a804dc3b046e47c625f2c36af43f8b84c59990
-
Filesize
8B
MD5966a7b7d44ca499cbde4bd7f13dc61fc
SHA13b4181d326fc3600093b446f4354a40c385870f3
SHA256842d2b64acf49eeb5856d2b004017b01265d8966a67f8a5fec899bb1dfa129e1
SHA512475880809c369b8aa52f3b8532d0c8a40459ae23d2e71e0a2a72d3d7e4e2a4607d459f65831e6ad2bea4a78ca6803fbecd268c5702b58b9b36c1d12517cf4d60
-
Filesize
8B
MD55f9433969e0d1c1d08b22a4b08863aa9
SHA1b640b39874346ccbc9fc8ac49b2a9bea80a16604
SHA256f8687301717788fa9bcc1a9a87ca748f575bd5d6c4c575a843ff6315514bc5ec
SHA512c69ac6bc078073d2628240a0122776eb972afce82b8cfcc8a892fe4222ba228b3811cc0084e40e5c6aa58bd64afe1716278d2ebb08ab2025d4e07b27f4985527
-
Filesize
8B
MD5684015b8d3b5ae515e984fb028134b62
SHA1737434aa02e975e4e7b94b3e322198c8a0edcb88
SHA2560d085761c404e82faddbb154dacfd9206c91a615e82a7f25e8f81eb76526a7e3
SHA5120ef86be64d26c6898901cded6647ef2cc004e26a331bdd9f628d42308c25695f982082d4b4fcc814cd4fa3fa0912e2ddae648d6868976a1e650f5b7680344781
-
Filesize
8B
MD57ec4d5f29b7dae03cd04d7bbfc1d7251
SHA1c0a776a248d43c98eec6a1f80fc3c690329d1742
SHA256139ceb41c7e2049757ab8635a93e3b1b83069ae8a6718eaf281a11f338ae52e8
SHA512b849c01a143aebccbe521fa2b5e3b101ef86b222e98672cd98ed1135a8cc82f7559205ef0832f311703e3746432d4d339f5eeff238b43f744766ff70c880f1e6
-
Filesize
8B
MD55718c17b1edff4d6374f76bb8ba959b5
SHA12dbec836b01287f300d7bed3a3dcbfcd903a6f85
SHA2565e6f5c26eef62d744319259761dc8236a5b4cae09c5b0432c119d38780f94d70
SHA51218d208e35989a091a058cad4d7c70f6845b1c2fe9dc33c6df4bfc66976274d1c4c24c00085645af56d75913beb8254e31b9025f84e1ca0d1674939a267cf783f
-
Filesize
8B
MD524862e1df9231e3a5117794f24a6f6e3
SHA1233a253e1d7c1dee73ac814f4a8018cdadba1a40
SHA2564c581cd9660252cd314b2403a7abc8c72f9d6bab21d78b0e960f7974d662d4d1
SHA512c24dda67b2b3b94e300c83bf3f89f51bf3f3c3f86269feca3d9493df8a0517ff9c774d7c49d4dbbaf7ed0b331b69b2263aa3a667aca4246cfa23ed48af5bc878
-
Filesize
8B
MD566283efa8892c6727f2a8195b406df30
SHA182fb17b251271e36e9eafbe2feaf7f01f7260bde
SHA25630c9f68b56a27fd053a9bdc760853d7edebd63604eda0605e0bba7474f631e26
SHA5123957d3ba8fd70d3723f270167704cbe8ae847e9a49ccaaee41d11925cb87f9ae948698e2af1b5278449020961341db88a5142deeff6fb5b28c7cb41210684e26
-
Filesize
8B
MD5415cd6ec4b35c61b2c637592e8a262e9
SHA1fc3b2202d6d2a572c92f397874f57fae8d674c5b
SHA25612974c9bc55120850284f369d200aaedcc9401e033cb70ceb141e6cf611f2929
SHA5122093c50ae53b7c0723d1701272278a88cc85f5b2c0e53bb7baa929b832349d11d716ddb43404d56bc703d46ad98ab9741c49316beed886bd16ae199bd9b31577
-
Filesize
8B
MD5172e37deaf9a989d48b651f87546c987
SHA13998accfc6115f7f4c01fa797849a582e89a11db
SHA256bd03430c8fe88f6f9682c631642dda4a1b9e73435e709860543e61c1b02ed403
SHA51225b7e5eb5fc5937490df7af109ca718cbffc03bb46dd8f3db35efb1271b0bdead5d7d62facbd09b089c68ea89431c88b3e1dc6f2d30b0209204de2766bcc0300
-
Filesize
8B
MD5486e3326769a8fbad0f435301c50f722
SHA1cda33ecbf0c057f80ee8d49391a725a833234dee
SHA256f2207149e59f2f903c9bc273dc808f7fdf791d31c53435e7e92bb2c435cec8b0
SHA5126840075191806343a37dbe3ebf25055dc939dcc8a6cf37147145c3e45eba83673617ee3bc6db873b7815588d7aed6d7188dd48514e1df8db494aa4bdae2f4ea0
-
Filesize
8B
MD5f670187bf0b09df61aa621ca149a3dd2
SHA188595e1a9c5e04265884e4d5f4ca39e8530cbbdc
SHA256fa65cdbbe8f10d8ea3a1669f957e6ce626d6b4cd6dc532e3223cd7bc6cbf8506
SHA512abfb98bf9228b6a7bec792e76ac1a7c57fded4049c59a8d87e5d2d7b39ef019434d18771916903d01e9f71b763634b2df33446b026c0e03a03ad87b14afcffed
-
Filesize
8B
MD544220428f64bd16105b814a5e666cff6
SHA11d4fb607aa07d66eff41005553066e19e6628de0
SHA256b99498777c53f7778f16a7bcb608643d421882af4ccf50e1b7e8e26ed3a71001
SHA5127164320dfc6f0c6196e76682b74d48448c5e3256803aaa74bb95398d9690645389649d38c9d6c42f6b20d6328242ec054b268e9e09eff77ea7fda84a88acf150
-
Filesize
8B
MD507b5eec2d3263f32fd2d3feb2b30de34
SHA11414ebda63da6d69700e51f1df7245eea93c2b6d
SHA256eb7b466568ded512d1c3b89442dac8316f9fd6e7b2668e165c2243f041d793d3
SHA51214257f05d6bade5b6d9a12ff35f1d57bf15c197e7cdc607e3f388a5724eb5cc04eb36b9ea4280b345ec1092b6cd974fdf126d30fc9329be61b410c9480a8fb25
-
Filesize
8B
MD5eaabbbdda8e10389dff4c272b0d0bc61
SHA1b3cc979a1f81fbb590a3ebead50ed6d940a510b2
SHA2565c808c02ad36bf034175665fdbb4b36410788d5b469a3ade8961ba44eb8a3497
SHA5123adf9c7f2c5edfee2ebfe4204931d92104de55a08ba6023978e4d1cbb0f4f2e1aa72c4ff937bea87cfcb6c0324c651646b6d5116d4a7228a044f6839c61d63e0
-
Filesize
8B
MD58b87e44a0658bb12277f9ec48736192f
SHA1d261403e3eb7b5a1beb4614fa9f67a6eea1f49f9
SHA256c4b56a192f248ca0e0da9708793c47119bc9222bccaa398f4bfc6caf1685e501
SHA512da8e153681bbf110d27f38003127429afbdf68cdf1ed31956a615d832a8124c860696269e21d63c7d8cc0c2425a3988b5c3ba90374b70a0f8187b16cd5dd3a15
-
Filesize
8B
MD53693643d65505119ad30fbfe747f20ab
SHA13c2c9ed5fc920ef2fd2fa914d3d371d97e49a3bd
SHA256c2ab5abbecdeac260dea7dd159d0eaaae0dd998c5bc6c7f9e897663d48dfa8b6
SHA512bb518ca23d7fcb6126d8acf364ce230265a9705d319811774c5c417b9e00c55730b6eb70fa550e22c0741e4cf5318500840e6669db773c86105f9642286d9a02
-
Filesize
8B
MD5b8df7ebba608560ebb325ded6b29c93a
SHA1b6f224b2d2af89fc9943941f0984206d14066392
SHA2562f3b15be9fa97de9305dddfd2f9f5a15b65c4e885413d3efc46d2c6e31283488
SHA5121b70c1fa3bf7db4e389a27d13b89e08c03dbba59177b48c895711d9a4b7c92a04e56949606b754b3962650e218ff7d96a40c834e0cf48beb383023c588eeb34d
-
Filesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
Filesize
257B
MD55801779818010df53523775a04e72b24
SHA1c383eb8e642d78830c2f289d4673234e39899e49
SHA2566d15e037881533bdd4e29c5bbc54692743520fc7c254fa1ae7d4cb5491642ded
SHA5127b59fab59715eea50fde887a70a56fdd443c8f7ff7bbbc3e35d5b7462d3c12d5aa3f5e5e657dd8fcd0f39aae4a09ef4cc47aeb3d8452a55355aeccadc4112d6b
-
Filesize
100KB
MD57a632f8489894dc3ee1f0b29900beb71
SHA15bec1c9c15c59698354128a54b7809a297bc0983
SHA256d42eb286b2152b98ea7a230fa174f34fa898b445b7476aba9cf7b01a4fb90ed2
SHA512b808c700763753927427be323ab225371a0e513c8c0e9228e4ed53e73c79701df66179f12f089febdbcfce2de666daa929acbb6bf556825977badaced604084d