Analysis
-
max time kernel
33s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-02-2025 08:48
Behavioral task
behavioral1
Sample
JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe
-
Size
1.4MB
-
MD5
0ad9244c6b575a50d0e4e12e73067488
-
SHA1
1c4298c694bca1453851dea87c35d47610b4406c
-
SHA256
f4b8f3486cd37574b15015cd2d41a8187656c2c182df806775a505395943ffe2
-
SHA512
3ee2c353e7f5620bcc413c2ed9b5f451273fcb9a6daf3b11defbead77d60fe4582d6adf84bb4a6dadee14f89815c2f8d884b4caf10a31ddf8c5e3818e65880c6
-
SSDEEP
6144:Wk4qmgjsYHAMXPnhay921QL0res29V+XU54vdya9gu0Kgww4ZwmkKzFxD0pR:p9fjTX/haYBR5DVugww4bz30pR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Extracted
cybergate
2.6
Batx Hackervvvvvvvvv
abade2009.no-ip.info:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" server.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" server.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" server.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe -
Sality family
-
UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" server.exe -
Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3T48UJF1-23E0-5451-I6U4-WY638275N00R} JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3T48UJF1-23E0-5451-I6U4-WY638275N00R}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3T48UJF1-23E0-5451-I6U4-WY638275N00R} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3T48UJF1-23E0-5451-I6U4-WY638275N00R}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
Disables RegEdit via registry modification 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" server.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" explorer.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2516 server.exe -
Loads dropped DLL 2 IoCs
pid Process 344 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 344 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" server.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" server.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\install\server.exe JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe File opened for modification C:\Windows\SysWOW64\install\server.exe JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
resource yara_rule behavioral1/memory/2380-0-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2380-3-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-7-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-24-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-4-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-25-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-23-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-6-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-5-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-21-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-30-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/2380-327-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2380-308-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/952-595-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x000800000001660e-599.dat upx behavioral1/memory/344-632-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2380-943-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/2380-944-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/952-1012-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/2516-1031-0x0000000000400000-0x000000000047B000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 2516 server.exe 952 explorer.exe 952 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 344 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 344 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 344 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Token: SeDebugPrivilege 2516 server.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe Token: SeDebugPrivilege 952 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1052 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 17 PID 2380 wrote to memory of 1104 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 19 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 884 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 25 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 PID 2380 wrote to memory of 1184 2380 JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" server.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1052
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1104
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2380 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0ad9244c6b575a50d0e4e12e73067488.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2516
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5811470a00b8d6b4f2b9a95969189b067
SHA1fb34e5b3cfd391833b844ead146069089f1077bc
SHA256cc6c3bbea31a6d095762727d8328f736bfc21dd50aa21508d00603cc357fca8b
SHA512d724320f694c3bdf0a6ef03ca4cc5a5a96bb56e46a65048a5b3a59105d6c851334201ced0a5d351704a5e5e1da475fc93e4982701447a8197132efe1eb4b3c54
-
Filesize
229KB
MD5c2de08ec8de92b74aa75fe325e83ce9b
SHA149f8e2afdf55973b5b8ae82fd810bac9010d20df
SHA25664292b6e0f3ade1960c1acffba17ac3347877eacf742141109a7b9631a753476
SHA512e9d14d28a985feaf37f4a76746c6b85c275a34b079523b1ef2f2de1f8a644c5f9e22081c0a1a92eba6d44e45486d95661cdcb0d55108e8858ab01f4b69a48350
-
Filesize
8B
MD5721f7aa5c32380a7c985a9fed13696da
SHA1810de51d30f70bff1bde3323beb159370d6d2b15
SHA256570cdcb76101c00431c29de883b8ea2b4a74e8d7db358449ba9e30b406188660
SHA51235f1f819d4f17a656fcbef81b34660101339517cec93195e7afb5663aa15284919d81b35f8575da9539c5ff3bd2acd2f079e6f49ef03fd6d917879e62c84a9aa
-
Filesize
8B
MD5de4ba26b330de7dd36b6dbc0a8e39b16
SHA106c01cb15a5861b53836583480e68d16078181d0
SHA256ed88ac74bcdfdb2efa6ef1d5db7f7b6632ffeba6706eeaa850eafd8e8ca4d51a
SHA5128120e8a6b71052874c8c44a9f1b7ccf288413d5e0b7c2ea95c5ff8ad9f5714afd137aad4458ee01528029b32a499c069e31d33f9ed15dc4747af65e7a49ddcac
-
Filesize
8B
MD5c2690c1d27d05c58675c7c019659d176
SHA1f9ed65774bf7b4994eb6c99548bd935c4feca05b
SHA256a462bf435ae47c8a4621aa621252db66e65570ec56279db706898bf729fb2c91
SHA5124c1c568119be7efebfeb404be22d96b75c93649875661c0c08ef2dc423288c1bee2d98e45691f2c836d4f2264869612778c1a68e44b7238c4e3ded2297d26e05
-
Filesize
8B
MD5e0a104d567f6c092964109e25bc9d677
SHA15fc9b034858ecdbc654f1477ac2f0aa1a20918e2
SHA2567bb277a6187b33d7a102780a8196929b7f295e9948a480204aa92a4b78381e09
SHA5126415faae480f0c61802c088a38334a4c623cea9ff0851e64130df3421773f6fef78cf985bb34995151a3d0c7bc4f829134b7bfd703ad9939453c1816862cda32
-
Filesize
8B
MD536618a10f55f7a2c46f2853a51462045
SHA18eb174916a0f8408ca54984fecef0f982b56b53d
SHA25624de6b3354b1ffdcf0c4259b14e6d24f86aef0015e4f83198de591c7fb1bbc46
SHA5128e1b0fe4937003b225eb46d98fe78b7ad43968f971625926ddcaccbd0fe903d538fbbd9db453466562f1ae3c84ff2807017d86d2bb0e4080f901a2ab1ea3d63e
-
Filesize
8B
MD5fff9f5a14d4ba694496ce2aaf261c842
SHA1c872a9b4f7c0172dd72a26797f22d4513a7c62be
SHA256babd6c53cdadc7d014b7e20ce64d580b9c800f67b3a8fba66ed5021a7d1d6f16
SHA51298f28d46f194f93eb44592c675c576a52a3859d9ce76eca1575c21a9fcae3f3d2108367d4df0a4bd430779ea157631671a4846f4b0eea7b4df756303bb247696
-
Filesize
8B
MD58b1fee2185f2f485e03012a6e22e2c21
SHA16de6ac88cc6bfc540da3450ec362828d55a2777a
SHA256313c3c6f941437770c78e5ab3b63d2e37710f3d1788cd25daa7bc463b61d9cd6
SHA512ff75053d86c9a0641458223256163e94596c9a08422358abc2824e4ad6ab54539a329f806f1f4fb2b0929e66150d089edd411a803c3336130cb6cb3eeb6a5cac
-
Filesize
8B
MD53a2fd2c3e1df3b9dc0ced5329e741e10
SHA1c531731a67e970cb70c02772b1cf180b2b1d39c2
SHA25616e121d1cb502abfdd12a69270f009eabb6f61bb27bf032dc2034ab787fdc79f
SHA51262e7a7206864d9ccc4ff5ad7ed8f8d3bb2df9ff76e1c6a932ce83b640737ea7f5204b50c13400942b98b7e4c091a58108eebfdfa8b75b2c535214efa741bafab
-
Filesize
8B
MD5d80f8a19bb1a2568d87a2cc47681a824
SHA13fe420534f11bcfaa7c801a0170a32fc884d439d
SHA256a2f8cf3a3c244921e8fedea51d256a402272c78e5e9a13e4e5bad237aed92118
SHA512785748a6dceb5d512391c00fb535ca54995fb62a5dbf5ce6bb939dd04d52ac4e1af912c1a9530a5d88b24234058855b2bdc97ad1e82d65df5b34bf69c32e0867
-
Filesize
8B
MD578a305bdf1fc2a4453cc2f6e425ab5da
SHA156c5cc40406fbffea82bdd99b24be32b232a0608
SHA256d8675f87105fd5149bf2c21913179ed6a46d6f13034db1dc28981cf2bbc0cb3a
SHA51244a1a807623be0f9ba300335e071a52e47575ba6826c81f104e69e062ca17266c47741744106f7979b8a49ab4ab1b54b43bc7e3b4bea7b9c03df3eb13056c77e
-
Filesize
8B
MD5703883f6d9ec6341fcb3c505ab8e1bec
SHA1b33fdee41e5ca35c80f2ea7af07f0f6ca7b28a8f
SHA2561d81bb398b8652a0e9ef21789f1436fb4fc5b172e8650a0f56dee9a51ab44cff
SHA512cb0188c1f7eea2cbe3c83fbe40fb01f6434a05ee38d883b5e8f0e2831d1aefd71d0d9cbb7c406742998b0f649524b5b2eaa2e6965289f138c92f9810f34715b4
-
Filesize
8B
MD54173df7bd701899e170f6519ac08387b
SHA11bd33685053286c828db68f96072cbb93336969c
SHA256d6d4ae641c79eac8e46bd02bd2c1a5b45c5c9adbd7e526eb5ab8061847be8e18
SHA5127e6537653b0da0b4d8fc5cc8dd0884aadf76bd1f1befb6f3c0988ac2daaa34df33e79fc2cec672405fb943f9a41e1f887b59cbfa195ebdc1c493b0bfd7fcc699
-
Filesize
8B
MD5fa8b9729fbb1e2057217ff0645df5310
SHA17c80a7b561a448d09c20763f927a41e4913b30b4
SHA2560fb9e237f867239490782039d0da2385a0143039bd21776d8f08b8eae0b1dc1a
SHA512a801a2c277f230e5f70fea6d6102c376ce83d9e4245a3a7d040ff209ec512a1ded08e3a386a7bdf4a4f9b2214b79e2b01e8e55bb77725c0638e6aa7f3bb1e7a4
-
Filesize
8B
MD5343c37fa3c6dcba6d828ab22c205ce88
SHA188c65ceaf465ce22b40936c45d631132ffe770bd
SHA256580dbe5f5db50c45f158a1de5b559ed3544adc0ff1f2758de4f0ac67c379c981
SHA512c9b08ee358f0ac85991570c50bbb136d76f4c18571396bd9fe741c854cb949bfa3d1c5a45668a24ba5a854f99aa970214c1c9dddf9561f5b8e110599151040c1
-
Filesize
8B
MD5d4f5040e7a243d83ca78a4e9cf3a5906
SHA1d261f31273b396c2ffa81c6cf38e43752575eb2a
SHA256622f348504d3322b0fd3e871295cd03ebbe30e781c3ac0752f92a6df616151bb
SHA512144df8a69bb8f71a42e7e5db70d3b141e76cc13df2802f4561ea2377fc6e6751c7cace397922c7f579038ed0ddb99666d709b4ebf8cf344c9554893b9cc7fa55
-
Filesize
8B
MD55ce3e63762e6f63e65450a435f1370d9
SHA1f98ada7419b06193a99bcbb9cd036c2f928cf857
SHA2564e12241879b4f5e6743b4ae176d3c62a89945d469265071dd3f06822d7eec1a1
SHA512ea805802b3c8767562f3fa9a3f81ee7f8c66b96430ecf2e0abdfcb82bc9654e47cd862a35bf50bbe9fc20162590f96a7ac8e141296d1664d5f9bc67a5529645a
-
Filesize
8B
MD5104229e852c3c88931973f9514325520
SHA125f31abfb9bbf72c367c1951ad2b39a95d3d62d5
SHA256343b619f832f954790476bf0af39935d0218319f2839d92f850d57bad1de66b7
SHA51219c15b22c418da84a2f73089025c6001b898173d479d83cf426e4488841d4426d6af4c53c083b75101a332e0d10d44fd7af56d97a888f8735c07d01d59d6afba
-
Filesize
8B
MD5e93efb62ef73824d5b175a34c4ea44cd
SHA19316cd5cf2344f3af7e42565a397ced2c1e3be20
SHA256a93e2191c9d81f15202798bb7cadc917e1dcaacf42c6f6a42167af49ea4d177b
SHA5129d31d22fdb04a4e56b5a5fbffbe36041a0218c010d626cb044ab6b0706717230c28887cf0d25f1d7001af591875afdfdc68fa3ee765d6a028d72f3c4ba70046e
-
Filesize
8B
MD537a357a4756e0ac775ce693ce4909c6b
SHA1aecbfdbc05c524ea16de94dcfd558773a3baf464
SHA256107c2dbca24a73a081f17ad9429142b1cc3c24e086f627b301a0715a62087d6b
SHA5129a2d1d4f90db113f70f7614f821457bfb10f83cc8a9c29345ce82ba4b64b189704cecd0cee3dcfd92434dca7c1479564f3628257248a036c1be2a7275dbb8520
-
Filesize
8B
MD5f94761d09d2d9c28810e2a384fb04714
SHA13db2b98747a3bab76bbba718393237835ea5cd8d
SHA2568b572f0ec288b0683e3e8c63771ad96be5f4d6ddb4c313dc167c4034281b2688
SHA512d5a481c9cb102ad1c8cbb412e393804fa36bea465be6dbf6689b1f9fd664ebaf9cf562c8bf3eb6db2d58259ec516f9da75526c8fcaf14aa1328d02c3fe4f0eb4
-
Filesize
8B
MD5406dd7f15d2c5557cb3b1590d150568e
SHA1b96f26ae4c2744e42b7d5faff5d331248f9dd18a
SHA256c901fbbfab7623dc72585d0ce1ee3e0a18324fdc6e1432fe41bc5effc6135a6f
SHA512f89ee5baaacd57939a8414a01d73f1d55682f598ee6a9b74d078b889c62a052db4430868db733a4dce1441606352c8a5f697c981a2105205629c0f8520ceeb2f
-
Filesize
8B
MD5328fe14178a2f0b30d62bef77d1f5722
SHA19d311a02cde94ff4375fbdcfdbe0d8798ac4275f
SHA256591d7eab53406f7346ccca2e231063c324893d2e3f843218c444a8cd716ef774
SHA512498973a2a7cfca17bb370f1b2762e26adcbbd3ce5e4ced92d46846550ac2367361eeb745e0c8ed366e59f9df835b04249d408bd15964b1cacb12a5ad9e22d2f7
-
Filesize
8B
MD5de285deaa12cac39b70c69016f2f9a15
SHA1711692e1b28192cfd5fbf2559edcbb446916e406
SHA256d14f799b4d07a5d0f29510207d0049dfc2785069117f4c221cdc925fe6223aa9
SHA512970ea1cdf77a84f1c37f085219bf1da588b5e09a93f66bddd396c585e7130c1fcbc8bc1ed720e129bba25f6dc3a52c9140995c6e0e43d57f43a39d55c7f0ce5d
-
Filesize
8B
MD507c92637ce64c86cbae42a0d1bb8e0ae
SHA12cf77f0502c9276dc69bacfea9e16305786d700a
SHA25613b4ed317af7a7898b3c9e5f68032b289fc9ee255628ee47620635524df797c7
SHA51267d4327b42295a97256c64d1c0d269edad821da60f5f23897df7c33007053193f652846dc52c14c0257bb3f25e07318e002b576700619cac5884ba9c0f30ea37
-
Filesize
8B
MD531ff808e1dd7c41bcadc5f597aecbcff
SHA15d9cd0cb5477ebf77cf73a14300e7568fcad9992
SHA2569f6e02b471729d7f7afde7f540385b4d0f678384e69855603faefd8b896563e1
SHA512ac0933511f6db95fbd55dc2f5b601c2db1a6f1450a9fcfef01c1e3065031e14ae7cd2ea9a58648a4916f96965e4f17c71614a040e4651fe83c341d2a4aba894b
-
Filesize
8B
MD5c70255e29659921805d033157ce54278
SHA1812e583f1b681a4b71eea343182b3f710e106f1b
SHA256910bad5493ab129063e9678abd53c921acb335d226e6a169a87589f8069ae410
SHA512eae94fbda32d36c129b9f173aeadeeb4263444a940ae1e84eaed2e410ba6fd6998bd28489337e6368ea6a40013aeb93ee9a6dca1b957f6b905b770d9a1a80ac2
-
Filesize
8B
MD54d840acdb9a852b1ec17ede68a0303c1
SHA114111f7a94caecb43cae92611edf0a788a66d94d
SHA256b8621b17e2fd8309aa4b7fc2e7e04f49616c170a61fcdc5de167cd858ee215d7
SHA51293217b081621dbfc81162ac72e54f9ecb42b4c4f4ecd8cc77d913ee3dc6575186a8ff77efac97b4a03431653b2992b1e331f3c06b8f89bfeeca5b6dc16156441
-
Filesize
8B
MD5a67172d7632a6be7625f55f1e6ed3188
SHA1cf6966eac860b28534c6ddb661bb75d1a601c715
SHA2564a95a228fa1acb12737ea444d05dc52517c0a42d40e67f92b65da63d896b26b9
SHA5128112c7603019c57f8aac18eb80a8868368a5c2c4bed24a0823a864b42caab3443325f11c6efdb3777c247bf086b9ce2e4f73bcdd58dc268cfda46c55703a3bee
-
Filesize
8B
MD5608395f0163dff77c0ddd83337ef8e8a
SHA10fc8311ed000c4e007e5cad638db2c4eb958e02b
SHA256f4a8d04b4637f3a9ae237837ea2cfe12d256ebae1fa03ad10cb9494ebbef8297
SHA512f552decf6001974c15febda2b28632947ddb3670da85877557a939d2877102df15bcb77f5ec3c44bdb7148f141b90a95f6cd4a46a1cb61a54636cb3f28b43305
-
Filesize
8B
MD5a1b40c6164159b9696bfe93ea2b17065
SHA14c8092fef3ca2798042ed474e61711029e84c3c4
SHA256cc45d5a7c07ddf1158474e4b8d93d74b432b3c12db168742e180299dca8bd3c7
SHA512d1ebac93e31c2f0f077ddd9b50d2e1e174b706def4f2cccb493078f73d8e7a0556556c7d6384fda6062bd1bf9c8ab1075a95313982a674d3d35d363922ad0246
-
Filesize
8B
MD5468d936eea859897f1a6ee51b2f653e3
SHA16760264578b790efb0ad7918b2dec863fb3924ca
SHA256aca8834b3545a89f3f7b89e3f3112d4af798083f02f4be4f230b50a574a4b394
SHA512378ec0f36813123984da01d958a8c91754ae388210c084beb83c0eef3a3530c388671d704b6fb42640c84be8c80211a0c9f05f0ae111626fd1a5e7532ed55b9f
-
Filesize
8B
MD5a9c2b6441c43ff07749de3d458ff6fbb
SHA1620297a84fb625990209df5a1bfeca79510df630
SHA25626817017a6b407a88074d34c3642207e6dfae677e7158f9ac0842daba2a6131b
SHA512d76c1f6f14afbeeefbcd77bd6920f78e7bea29402cf2d96e4256c875333862ce645919fefccb28f44ff8802c88986aecb315df98fb34e6e9b97729633e20a09a
-
Filesize
8B
MD5ef54ad6ac5204b41199eb82256f5b7ba
SHA14a6610af759387ef82f8ee2e4ddd2aa268e7aae4
SHA256b94e1d6d16b6d4a120aee07d3159d728669f035c0f8d1d809776f4f1d03311b2
SHA512a55f940bdb469d589644b5fc551f0de2d90a9675a269bf7476268b68582c5f17f0eee94e9d8324882917c901598d3547fb19fd7beb3609d8e16bc32a58fa2537
-
Filesize
8B
MD53d855ac9bf953754ab8b6b0bed4a275a
SHA1ad9411afc3df887a7d25b08abd389c7252078e44
SHA25693b7c9da2f5f308df85f8318536a96c794da552c0381bfe467ae779817d4f629
SHA51247bfd7a51696649a4bc0a0102ed94f8a6bf866de8bd805d97c650df29a87869f1119bbc0cfb26a42ece424571008b02f7ca4cb825097f99839fd7f8545a1bcf9
-
Filesize
8B
MD515b1914c835e38ea8efe3f442888f977
SHA109d0417d729990d676c5adcf91f67d4c6d2c4276
SHA2569942b2dafee2a277628f5b15dbe3d83dca11f21f4a41e5b18c5431761ea35068
SHA512bfd30915c80d01ab53e5f7acd9cbaed38e3103e86ea303e7d637dad4168a074b66cd27b95439c7bd094fa93e70a4801074df8b990ca44d654354647300d425e0
-
Filesize
8B
MD5ad43c46aea450a4b7036ca89e1bf07b9
SHA1747da4fc3a2fc03526e755bb32aeced6f330e12f
SHA256bc2197181119e30651be352146c79de688f7b78f640ba7fdfee7fb020fd1625c
SHA5129427d6f8280fb2ff3dd7f762daabc1ff132d689015535285070dab4f6f2120e5fba357c446fe6c139c6fe6f973664b8484b95b3eb408048d693a134dabf6bcf5
-
Filesize
8B
MD523fee82ed5932c9176cf503ec2766ba0
SHA16167117348718595edd30aaf35cb88876f25686f
SHA256c76ef86c5baee2fc620d1ea1529e27ea76c487e0f86519e5d99b34fe6ab81a5c
SHA5121c8045cded78833980890155dbdd7fd49270dd299049f45a206f11206b9fdc18b101276c68cee61855822339aeeb66109a23728bfa7beb5e93d587c93baa8824
-
Filesize
8B
MD5660b4feeca91766dfc1d36052cab0631
SHA1fe5069588e992a0982f1a711f0bb22b99fe838f7
SHA25615aa1b7402d97f3b87712ef3b6ed6bf19cfca7abbaf9ee2feef707c08259e3c7
SHA5125e98abd97aa0a7f9965bd0a539ba087a50a4b3c2c58d2a9da2f85e5ac42099e2d3447178aff961e84d1ba267ee897c4da29cfc79b00d6b5496e722c6618cf7e9
-
Filesize
8B
MD593bc92ce7c2b608b9071ce14d9071fc9
SHA158283a9c78d70a4341ccb75499bd8b865ad8fd8c
SHA256c90b619a8564e379633efc82bc889b31aaaf575cda4726b60581f1f94aeaba6d
SHA512b9b977d310e10131aa8b0fb43da9026f87d34992284baff6572c6b0d8a4fade0f964eeba2fa11fb434dad9b24990040ad73fba28e3778a4ee1d42ac9258bc88b
-
Filesize
8B
MD5eb6d27471eacff6390cc0d139306ac18
SHA1a6cea97925633477c121cba89ca6c95080dc7ac2
SHA256e47c82e1a223678c2ba713186d947854a94ffd4a7acfc5b481c816f4edfbc977
SHA51213cb77da92939f38826e4a53d47726f3255a98bb160a629b447d943dfea10a79c4ed450381443bb874d472c0595556807acbadc38b0562dfc6d342add9728304
-
Filesize
8B
MD5a81a09f03894aeba7be6de0812269625
SHA1bdf3a8bdadc9ebeaa7cca31e61362a8e673e4cc4
SHA25665387ef672344711b9bb9d2a9507e86af6ce6fc6d90f4e6ddd4423749dbe4089
SHA51209f14169b0233164dab91e522cb098b0718b70ec678fbaf283b428a178eefc77dfd07068f4cc3cdd02122ecc4092e8d4498088952d4a2d028fbd9b60436489fb
-
Filesize
8B
MD52d40cd11bb2243e31b0b280d7848b196
SHA186346d1fb1bd7b933de1aa407c105916d947c2d6
SHA2561a2d2f5edc33c9008208e50f1220a5fccba0a48d8591de77b825cc66e918f358
SHA512ed8909db853d7cd72b2514ef7d77c5b5d610de44c290d5f8f917bed0c437d50cad48d8266de6db3aa8757384bb694c3a5ce982f11e72ff3d4fdfd55aef6051da
-
Filesize
8B
MD593cfd52f28c5ee0ae881086729fc58bd
SHA16285f46ae14927d430b451f3bff099b89cfa3d34
SHA256ee851ed2c7a5328260dbb02ebd2c745257ed685747f8f80d5157af327539ac8f
SHA5124c79c8aa83105a3a31312a10ee69373aa1f7b953dc0f74ab26b035a16b0dfdebb6055865993395451a08539176c47358c71c08e833eaf666b8b19b0ef78cde2f
-
Filesize
8B
MD55e9c87c4f7da5cac5d6a2c87a5a244ec
SHA16dc46805b8b132f421e4294d1993d3cf2fa690cf
SHA256d06b43d94b5fd3d83449f4d918a6c3268ec8d0dba9982f674b8c38e31dc0f094
SHA5126ed358bf89e1fbc10acad622646e4c128de1ed18e46e4e0f15196f1e39f054fcddd14ec53554f92437dc81eef0e5eb938c1b959217a050a0ac97cd49d1fc81d8
-
Filesize
8B
MD5d46fcffa7122361879aec810adef3e90
SHA1bc7af032ea1ce9a7d019e9f1321009413f1ed248
SHA256aa7347b2cee53e06ba04703fd020500d66569a395e8631638d27767edd2f0d56
SHA512ed0c1a8ba3c940ccbc30ce30064c1f2043da92ed03693766e1b783e56d5d1077f3cff7fcd7c89586f8ca7bbe1d41d9514e60efcfb854f8c8446fba6757a7e033
-
Filesize
8B
MD5d3b13753badd0d18e828d4b47fc78a5a
SHA163bed73e7786806e08a433387258289a85b1e97e
SHA256bf01f00062228a28f70384af043c180c460b0f7d504f4a8fca62605c63bc9b52
SHA512930aa86feeba45b5a955d8e4af535ddf6e548354e4e2e643704e9454b2c3e91942b424b7c04030fec73230871ab5bf712f59e111a83d12a5c3367a632b4d9160
-
Filesize
8B
MD54c23485bd0a45c13a0b900f338786e08
SHA13ebcf1947dd8a69f658e15e5ac13b61568125f0f
SHA256acd940046b2493e5543a19ec9d634e39c08264222fc357adf302954fdf7609a5
SHA512026a403e92fb50dfba1865c68289e190a3438cb7177fc5b673e61825b978e9982d93fd13527117497ab3825a565329d37b44350e3d3c4b5fa3aea86c11805bfb
-
Filesize
8B
MD51007784f8b6118d4c467440fbc370363
SHA1609c89a21456bb349796c9e85566bd6308864d48
SHA256b65798c5f94c4f0dcc9c7560017593887c2fb7ac9582ce3d9c11949f8965f954
SHA5124d4ba06f95c76b45a50ec9dca7acda79ca77a99554f4e1817e80ae0b87aa8dfe5c1a3b2c914667f1aa89a3a3cc5cd0020c771025a926d8db53f6868246241cd7
-
Filesize
8B
MD5e14955fabc062a88bc70ddcb56d387ea
SHA1de5dbf4432aba1532241dc5ed1a9e2d1e7397654
SHA25653ce77e8f25dc553dfe43727d6a352ecdfa45566a705d506bcd7d824c9a37add
SHA5124161a71f92a57d6a1355a0147a976152fa5edda17b2b2f08b3e69bbbe0f9244daa42a4f0f9a744532e7535681e112dd1678c6f5d104593570baf3c9ecbd92453
-
Filesize
8B
MD5f61ad6753ec9dcba16abc3ca89c7ce6f
SHA1121e6a867ddb3486ac85acb59e4064d9d930b308
SHA25684e681e95c12b30b41e27f0580eb558e85e26a4403ac871d278db36370b1318f
SHA512e0a5b3227f10cd1c5ddeb5cde9e7cfa155d23d8ce4b2763d184a236d442858299899c968803431c4fcd792456dddae2f0749b958abdd73efe4bf941c6c2db664
-
Filesize
8B
MD504a129d11a01f8790522cc44111c11db
SHA1a7269da9bba10c7641a5bf8d514968eda39c7ce0
SHA256aad1788b254cb758765361691818b173fb539ed7a043882a4466cf7a1ec59722
SHA51245ff66d85e1793e9745e9a818ab9447fd3b8cbf4a9b073f094820f86067971a7e4a6c163d314690006eae9124c7fdef2c8cd5bd2ff45c981d9bbd538971cba96
-
Filesize
8B
MD503f4157958cc7ffdd0ca88c0f74ac241
SHA146709757c414ebbf44f5a9d23f4e37450539662b
SHA25654c88fdeb4751feb9ef645b6020eb9f7025ac71b510e66a42422212cbc7032cc
SHA5125865a1975819d9c50cbf6051f5e9b2b5f55ca71fad15e90c432e101d45d02270f520892667d5233e7df31bf476c84a21e189f60a82f4b23a825da2006d1d000b
-
Filesize
8B
MD5fa5383bb451829ccc8bef32d776e8f9f
SHA1eb98fac521dfd7893eebebcea7ef38688eb620f7
SHA25642a8bf200fdfae5fb800279493bae4cbae9af9c523772039391fae1dae9a4ca7
SHA5125baa193e6516cc60eb9d746c999a49c45a50db3debbd8de677216938658893b2aa6ffd21a05cc7ce6e810f30fcb8e2c25769ec16eed65ede19ecb230e37ff84f
-
Filesize
8B
MD5eebf0936cce061f1d9c233851fd5ee67
SHA1401bb4e0011881a45754de5a81419dd089702be3
SHA256aa888124b47753cec45ec2704f0ce0a5785d21f9a7f8db7c0f330f9f612e252e
SHA512a07329936c7241b17d4f6656ff21db59e0abafa5714b3fa52b0b8c8617337eaa8f9c5041acbecf86c6b2740e514c073632eca0f84bc9eb6e29e47d9064016d6e
-
Filesize
8B
MD53799f247bbe920e16107fdcb0cad3437
SHA1637278ceb38d94b5d1737cf0be6ea2fcbf325ac8
SHA256af1a382b5a2bc1bd75bb4c2f89b8a03b1ffe61db87b6623edbd368c913e389fb
SHA512e166a10b802759bea7417d94b1717a41c067c00ae1b4d36305f6740c476b6f450c051f78923dd69b6d666b1cf48976d112c5916795249134b7cfe9b620cbfc54
-
Filesize
8B
MD5e41001629d7649bcb554e3a55c6c7db8
SHA13abc123d35369fd829901d53350da528d6739278
SHA25627cb61b79e094636de3dd542a6f4d32c7ca23baee173fe440c6dfe9b89495886
SHA512152af1ee8d287f0c3ce44d83d053d2287143b762ca7cabfa2e6749729521f50096b71d115834d12a9ae572f6eaac0cb495bba1233331e4179039b17d2b7fbd5f
-
Filesize
8B
MD56093cbb683b3594e418cc8302fa66956
SHA1aad1db973fccf1a825c0dc4440226c4e0f17aef8
SHA2563b6a26200a711067938c6ac3704499cf97c51cb66aecc35b7ee038906894d253
SHA512c22acfeec82762f43dac6dcdb4074ca943eaa1358f76279213460516592e74571b26f4e12655ed322dab4ca7b9228a9e7e23c495c05671c569ce300b3d5b9417
-
Filesize
8B
MD57e6e065617ca758dad30650be33d3406
SHA1678a265f11bb353fdb76508584dae07efa14586e
SHA256f7993fe2a17b3abf0aaf171a7b29271b4ce75366345c8df80600310b62e4655a
SHA512185469a257f59664de51f1732c16af4154d3de6005b47128a3e086ffdd41b3cb806c97c275aa148afde564dfee78d29dc1f015c92d385902e73b8b9f6623438b
-
Filesize
8B
MD5345bd707855c6a7eea014b78e0a3ae89
SHA108f6173a64c9e89feb1eb2607b28c4c3a812ce73
SHA256f1eee705f6ebf02c21f490f12ada20e7bbc69846bd951bf72665a29324b542fd
SHA512bf96a586c39863bf58a5952166972ea81abd0adb45b04c7b6326946760f77db9e1cc282118e72859769f65b792b0cf9a62172e15ca9081097de04f0410932038
-
Filesize
8B
MD5b96e7c6c8b605a634c0a9ae90530964c
SHA11b9e72a56a9a8c53f4f1107042fc06fc02b10af1
SHA256bef97b2b3137aaf88353b0c099b7dd1324a1d6b70e7b034ee9f45671b1481eba
SHA512a1b8138611e080bdeff65fa70292b04ca3259ba994e05a03a455bb520767bd945425c913886337ba21c1183ddd93ac51541d407b7650e998ca9bce7b9c04586f
-
Filesize
8B
MD5b041e701a9ea07963ed6877ea677f28f
SHA10a9ca3612c0217d0fe462120a9c5ca7691052559
SHA2562654fbb9164c99789fc93baae0073198e8fb70e911e81a04ddce1df554365207
SHA512ff6f56615a9232629e1e3b817f32e88d0c6e3062552021abd3ef0a845279c8cbca51333309ce7eab05e5411ab52e4ea16d278335bc479a1d1afbaa85054508e4
-
Filesize
8B
MD5b8555e7697cdec81f4da5a49136efccf
SHA1bed72609b0bd9cd8d4c7ae82f2cf6ccdb65431d4
SHA256b57ff85f80b9b47e5e0de1922fb8795ac31028a4ba2fb5e5828e1f700dca0787
SHA512c4855a9e377fb9c95c858b1e0a00d09a333cb16391efd64e81a9a1f65afd01f3b295c39a821d3e222fb56f47fb442b8d0e1b730befe5eb52fe958f62a53ff16e
-
Filesize
8B
MD55919db08e50caa8dc4ced6a6a9b8673a
SHA175f948c4d741d85a6952b0647cae871c3d9a2de2
SHA25619f1bf1a09906f09deb63caaa32d505b9b7a2e948925e69f8690dd4a887757c1
SHA5123271855bcff14d3d67d841a4c4d24c271f247964161c73f4218aa5857e01fbd36b4dc78f871d52107c66b9cfe2e0013cb5d43df551dc7b01d10ccb2ae7d764d8
-
Filesize
8B
MD5a4f998e11a3aeecec34dfbf296d4120f
SHA14f60dd643cf625137f842d8833eb4bcb35cc1a75
SHA256736be151310176c6d68551e998b1af77af1d0213087bf5fb4a4e0ed383845e81
SHA5129f5a73b96c5fba16790f9db496f4c9b4831f2940bf3c1794255506456de4667b59ba9d314683ddf78d6df8358a4d10fc0256c233c132b842a8cd39b2a0ccada4
-
Filesize
8B
MD5d2e598d97004305aa1ad7aab881d4349
SHA1f2e7c2b3542407db9bd375fa64320804002fa88b
SHA2560324c598ce10a6d4bfe5252c9a07d1f5fb2dcb966c81506ac62c4f39372132a6
SHA512d42a63ce37f2774d8c29ff0ae45821d359809b88e93f1810e8dc0e422caef6ffb2158fbcb8e56c2d48c13421d97afa65c6e1d35df654b5a77cc639f0aa4b25ea
-
Filesize
8B
MD581a507d249bb91d3b3013c089d67aeff
SHA125ee32eea9c797d48fc9ca370e6dc85952942c3e
SHA2569c9f315169b4935217898ed381d79d1cac71df515ae10d66b16bff2332e35f14
SHA512bd6b93fb986dbb1d0c65649b4c63b4b6d07f7be7ff59205421e2724e9b1f203cd9f6a20b9abcc014768030c7e948f859078fffb5f8d446aa1766853174079150
-
Filesize
8B
MD590291963c73cb97818dfeae0275c33f8
SHA178c04cb4de13d1ace8406ea49e9a8b7d031c10ef
SHA2563af1dcbc5c6f7460cce8002bc6095c2a8c7f501f24cb6a0fdbcb24ce8d90f8cf
SHA5120fd37d17978be3bca83cd6f2bbc452b8bf324e2a0e940d72b6cbae670279c9352c3aeece80fcca6c3c62cef911dcc76fa0c2a0e623a8b7896d41068a8d35fea3
-
Filesize
8B
MD50de38c338cc85a1e0e6b392ef3918338
SHA1e41fded30d59bfcf731e09a462f8fb0909d1cad9
SHA2567582f2889a9a5e793082bda46ac94d240004bbd737d9c10d5ac0726f2d75635d
SHA512a475b6f1eb0ded0bfb90947b73ecb095a6aa0ac5181ea6673d61d119d6858f43f2399dd14d3cd475ed9dd58c87cc2d9e5c7841e4abb610309c2cf364e5306051
-
Filesize
8B
MD541766ace738aa803bb10b52cac20efad
SHA1b9cd8915b66c9457b7ee1c9f1ce1f84ce08f68e4
SHA256869685dcc0b884cbcfebd412812b2d1255eb56f4bf147f89888ab3efa54c3bbf
SHA51291c282d10aedd937a0ff54a5383a1089cb913f66c215c9226f1e75c674af239d7bedc111dd4452e60d13ccb44581db7cb0e1f98e4276a8b98a9bd10cffe899ff
-
Filesize
8B
MD5d64d9a7945e7860f100924006afcb9b6
SHA19efa35358d3c52119ed7dc91b49b5a1038849155
SHA25679d589dc2fb0209be4b63df297e23e731732965c20d2c843a699d3809d95b74f
SHA512f86284e98d8570d264dd05bd8b7e61fb55c532b14ce920b43b3ae870a21c330e6e74a50513bc68d75fd70074d4df6da1893a4a62b4f57108083b49e9d6808a39
-
Filesize
8B
MD5bfc531e9d68a5aa0de839b6ac05cc913
SHA1a728ad72d23cc13ad6534e8abc836d37cff2aa54
SHA256486b7d24ad0056f2fcdd1900d6ee6696e479843aad6a966190d9daaa624d6b6e
SHA51201a0fb1610e4febbbb416856e5cf6d0c4fb8737f5af117417f1024d3ecd97cdd826b2dbb7e1a3fd19c2a3058d3f71210e93c7cbdd1c955efe2d2c89c3d75da0b
-
Filesize
8B
MD599c7961c15478e0e9faf4f8189ab4632
SHA17b287c78eee255f1357e10712de03f61d45724c0
SHA256815b0fc4c845a989acdccf8335220deafe513b189f98e27cc607745bc1b117c9
SHA512fdae87b874b1546c721d0bf841a873e5029f2e7113923d0aa340c25494c1bfc9739ddad5ad70d824eb8679a9a45ada24c9e0547d3e05b4a65caab61a3ef17f91
-
Filesize
8B
MD5c27dbeae94b2eb23aea81c306566c0e8
SHA15365cd8ff79f84624b7944cce51a7b96978e2c0c
SHA2568d14377ddb063aa68919e5c0688087dd917da5821a8d92bf26c97311e7722017
SHA512d323dee0424141a7376371b875f02fe5fb6d8070dd970bf9404c11a583048a5d6b418cfd7018c57ddf17c6e17805705076d10e570b1782579fec5b82cc34b32c
-
Filesize
8B
MD54da6d2253954c4fd9236f2a93e8606c4
SHA12f8c8cd863032a94a7d88331cd34b89effd1b90f
SHA25684ec6b14348f58f7f451f4a734d5c800156f82245651cad4a452691c562a484c
SHA512f602e6dae03f825c96e5ee0542592c6cb6a8a07f1730b3263083ce162e5e7dd1fdcbfb7cbf0955c6acf442ce51470ceab3c72128a6d42db893b7cfe543f59480
-
Filesize
8B
MD51cb70fed029d83e000161bc19c521dc1
SHA1b5d3c8023e2eaf66d944e72db01651157e69f150
SHA256ed9d7f2a1478e276b9a89d2b15af6bf6be349ec304fbb8bd18f87c0071758395
SHA51267bfdfe84e728336fe31efe5d5664d080b1d23ae903b2ca49c43730b8c3da54559ec073d3750805e80d3dafa0b5b9f10939c54fd4356af8c5beec42c755b7cfd
-
Filesize
8B
MD51cbebc82af66c0ac52b2b35b9c3e739e
SHA13e803f975cb42c486074f92dc1c6f08922f8250a
SHA256e0a2bfcf53f330fe009e258b6a212d89268dd072f97863ab143a0e3be138491e
SHA512a9fd844a6dccb8c65940355e15b26c4314f13341b3b285f416f31b7e7c978c12dfbf112a1d749965bffe57f9162ca9a449b27b5b322e3174509f0a010fe5003b
-
Filesize
8B
MD568e5a987b07b16c2fdb9403bca6c021a
SHA1f4b8823b6bd98c2cb05fe22cd745c2511355e5b1
SHA25683754bb739345e7ad54291942c59c6bd12360a7a2a67ee635bd1120effef56e3
SHA5123fd8c303da4f8295abd55957b119e8e001bb0f64c7844202969daf2bc0e2f9339453bfee0d01312864fa8c4fb6302aa7805e341ed8ec4b3e541456efb472c1b0
-
Filesize
8B
MD59879c391fe0811742bffd1f904e6e575
SHA18e1675a57afdfdd078b2eeeb5a082770fc21b25b
SHA2560572ae21534f1f6aaf789cc1b60b8bb932518642751016b8523f8aa10e7862a6
SHA512c3c048c3205b24da9cc55a7e73b048ec0b7091bd08fdf741680921de4faedb6186f9d1bafb1b96267ee0a19e4d94016adae37facaa37f80fd34304e25bd86a1b
-
Filesize
8B
MD5fb9ed9908ee9f8a4794b409b0c1a5fc8
SHA1ff207bb5c8a820de439fb140cb357abb8e809ea6
SHA256c49129e3a8eb3ef62e3fce550fffc87c6ca77970fb4e0ab2b33a43d10648d0db
SHA5122b09008c84536fe56ece291612eb4c22d61d7a83c5ee588cae31ee7441f1ae2bd0dbb96939c541852989948a44415b4e10f5e92854cccf3f4c96976da95b920a
-
Filesize
8B
MD50dab748f4569868ae89c1a6fb005e431
SHA1bfcba4743bf6f59e2108c12b610a398b15d42e66
SHA2562c846b48d1395daa9899123e5fe8b57841c83e5cf7cf7443b3be875412ddb023
SHA512aecb5c331b9baac99f3ffb0481f8b6e398a167e6f45b6b756ded30c9ce196c777b328709a34455b244e26284cc68431da8ae58e141fc0137f8ab7b4e81e7b9ca
-
Filesize
8B
MD5ad8f75c51695c200d4fc403c96abb314
SHA13b51aafe80d03c90d643bcc89efc36ea87728fb3
SHA2568d04eb9f4d73de92a985c10aaaf15ce926f5835e858a1654295cb3fb63e829da
SHA512b9d681a4d50754a9d7306c0b64f2729dc6f9f7cee66efba7c4fdfb06262f501a184878ceba491394c5fb6457d3e5fbd4ce6a0145036fe425fc9f0e3521cc74aa
-
Filesize
8B
MD564b80f64d33d72f051520bb2ca69bc1e
SHA13de89324080e4fd5f37d56567676e60929215816
SHA256c1349c000616da269daac88aa0cd5c7c168c90327d32954f9e1200bd7f5cec43
SHA5125f55002755be4833fcefbb5b96c23822387b50eaad9b18a743cd2124f11f55fdf2afe9936c66aefd159e7e6e0a4b70c41fd80f9f6bf3078c0c2c13759bbe6915
-
Filesize
8B
MD576cb652a33a4cafa6517195e50ff7f6d
SHA1ebbb08b0f1085f71a10f1a23d75b692e72198818
SHA256b047c49d6fd1f07a375660b2f8fcbd9e83962630a36aa7821a7f975a082a826c
SHA512c5382dd9df2b2865e0227aee38d0af75145fde69b29a28fad9307dbc166f3862f7b6524dda68dff6fe612d88f0b135b16739192617f557adb1fc0faa2146b507
-
Filesize
8B
MD53852059fccbea392421df6e061e894d5
SHA161116e0e25b2a8444bbec2353779856581186b63
SHA256aa1e0164d0b535d5bdca854b6c2ec7791b2141f30e1ba1b0ae6bf269855df6f6
SHA512a74808841f9315887a55858cd82fe2a33d7be66b07bd28167d2955e6129e411cc7186364deda29f980d67d179276e4d7ce3d6faee565a2a0e53aea9f7d5b4f57
-
Filesize
8B
MD5a96efb2701fd86ad75aa727372db9f5b
SHA135f9a987cbb00c23e7233f5caeb2c03c739c9969
SHA2569a48569896331f6cb26f909d1d322c18e7fcc92d80bc61d2282518d582f083f9
SHA5120ee68bb6edd3aef5e9fdcb3c1119c9f721f1582ba90ede892a91aac72cc520e68607e4b9a3f5663de8c6ed62f3548566e39f37ebb31d1abbefcf268b11725bba
-
Filesize
8B
MD57d1a90d86510000a2b08d0dfa45a4d30
SHA1d88fd5360493870e754955f2e8054aeb530e4817
SHA256c9b160e8d220ad10cf4866e5c760af88f01559bc224a8a2e1c226e4bc0968bdf
SHA512db65ee4356f77bd989a0a964e9a19be989986d9a3495d2eba6ea3efeeb6b63a1c4d42604ade7283cba9a82f560951059a4c9f553af6e1d086d7fde5c872e413e
-
Filesize
8B
MD5b54210e0a1740db119c496dd78964e9b
SHA151c080cbbeff238a22e340e6a07cfcd3b68e18cc
SHA25668355d1e3f33e55721a4c7ce44d5c0dd662c9422e35fa77263f75d77833e825c
SHA512325a540ca70085e5fbf2a34693b33e10414551ed1447f0ce3412c0f2fde6a077acd2e65aeb293b549eeee7a5d1ba95d5dc98eca085a5f2b2e9e1455355056aab
-
Filesize
8B
MD5cc1cca0d3f1e0c3464456377dcba3a45
SHA11cac6f6a150eded9e677034f2f419bd22c2c65b1
SHA256becf96604213deab3343e458ba86b10769b62b342e27064d838917d690ae4c5a
SHA5122008e9be6e7a785b21a799cf88ce54518c39bf2aa0e33343dab1e40b58f24cdde6abf387173ccde691198b313d8c156a5e728eafcc52bb640807449517f0482b
-
Filesize
8B
MD56414dbd1ff7057b3bfc473a491c8a0b5
SHA11997acde2fbfc2103e969f7bcb27c5ca9e0f2a1f
SHA25656290c81d81c6d2ed96b2e3e5ef4aa06b32bb653e5c17f1972dbe840fbb883ab
SHA51201545575b27188ad9f0df8c825f5bbf18ea01edd954d2dda95828a75f13162dc5c0ee6f2f5a918fa6d11b5568288fc5f48738e592a4e743882120386b05f6ce7
-
Filesize
8B
MD5b783126bd808d5fd20dfb8742235323e
SHA175db36e5cbab40cadaab43c36f59b4f6330ee2cd
SHA2568bbb7be4b2e093a4c88bf902d823b86645ae8fa0c27b5d8accc4648d7ad1a093
SHA5127569db3a630b9771826928491d33c892b45422e291ebcc7a5359c79a675fbce8adc2df96443e0fd36f67ee32e71cf28195332ba67cf635843c2ed8a3a80f7099
-
Filesize
8B
MD5da4dc19233712b706bbedcc3e7ee4b9e
SHA1512333aeece20a1866491ce61a82e1f674a4e44b
SHA256532bd83d493e2de2f174c5426a22b49431d83189ec890b5164a06cf59f14c69b
SHA5124ba7eaaaeda44836a0d907a34e5a16f125787651b11b54518d696e8a33406bb118e1b24b32843cdf04850aef478e1f80fe3a670f1ba7981ee8ea386090e5252a
-
Filesize
8B
MD53b9da32aba63c2c768fb7743631ef364
SHA1158461051bf40821fe5500635dc7ea82e1834855
SHA256d49ad6e316dbd365af758653509d9089e908da39f8998050b3981188cf86896f
SHA512f05cd8bac91487a50e24634547b37ba9d861829131102673e65f89857c30a0fa0c66eb8922a2ffec773a7b49cc028f707811f679fafae6ed2cfeca296005cd99
-
Filesize
8B
MD510ac327db35b33fbca090c0a87fcb1eb
SHA11e9602a21861fdacbf625e0ea777cc393fbcfcfc
SHA2565366616e750f4095bcbb8feaa7ad8b5ee576a392b3a6a40b80a5fec12b4fa645
SHA512f03e7ca46c03f3cfaec86e4f7c3b0751cdec7b99d0ca13b4789cc6919fdf1df2ca8f4b1078014de8f826cd856e3d79190a4a0798816e8f5a2537789bd373bdaa
-
Filesize
8B
MD55fd7f7743d6247b73c6fa905f3cb2b57
SHA19c09ba307db31222175eb507b0cd7d39d1275dad
SHA2564a129b1021595184180645f11f0dcdbad94fbd30b1eeafc1eae16f8cd75bf0d0
SHA5126622009775e6ca28020759fca1f4cec36cc879fc20b206b3e3338ce8d55a27ec2dcf1347be00a544dae20bc62e1952ebdf1727c9852018f6e1764eb1294464a3
-
Filesize
8B
MD548b193a354538d0f2159004717f712d6
SHA1fe35f6f21c844c2b9067115c2a375023505a5a50
SHA256193fe48a5f954eb66529d96c92d9d98af38afd7283cd7065d7e27aff63a9d86e
SHA5126869960e87c6c81fd80ff23eace59a8df203c03d50afabc1d9981002e1fd1079ab578e0ca029ba60bb12d32ea7ff990d022008b76534b53e6a14e4d371ba4d80
-
Filesize
8B
MD5caeabce5a238f0ac01f00164866cfe83
SHA1573010282b6feaf473e3e4f7795b3aa93e516294
SHA2567d411c73edddf9ce504af75ad8f6a28d365fe18b0f30be4490d906171d035b25
SHA512460add305575235c1cce5ab5e01e16fd12bdf86d96c226a7ebb30230fa6b6e17c2417ad1303798de212fffd8095e5da4d571fb02a387d1b8cede740bdd3dfcb5
-
Filesize
8B
MD5539b1221c0badd85db18734b9744dd70
SHA109dc8ebea4b04743606198e36e03ad4cd00f1c82
SHA256e22ca4c2c13f0f869ab78dd86662dc405b08bee18c35c7c484df21640e26e31d
SHA5123dd7a790c412b6185d2e67e3ac89c3eba272a5d01793a53d03af50018c29507f3dfa0078c0271ce151ec6931fe5c4907abde6aa872d1ed6b651c7fcc78ba4473
-
Filesize
8B
MD5c94a8bb1b4a90139976c80afded38464
SHA1b14447124da657f1fb9d865f6358f75e53f880e1
SHA256d61163f9458c15ba1a7397679913cf2e5a2c7f78e2f21544b76b52671fa9818e
SHA512a1f2fc880c922e38932fccb0cb4d096d17b035a20681fafb2a575e26f31bc068305114488866877d62b7685bb4e3f1ed04fa65e63087e10cea20c1bca43969b5
-
Filesize
8B
MD5966cf1a01f78dda3d90cc3227882d6a9
SHA141692060a226b380cc11935fdc4f0c8fa5820fc3
SHA2560b1267d9f6c434a67b50f12f2ed2f065d763a8afaabb33cc6473591c29100f7e
SHA5127896e48d41c4c1d4eebd5ea4b0d878762906e270b2cb85ab68313646bb2a28cffc117a2c44b385e7677f65b6e56d49891664b4a2a57d991e5313fb64e5999231
-
Filesize
8B
MD5d82ed582aaf5798f4c2cc173fcae8b95
SHA179bf7e37edcc0dc123d6d60cff96d6fcdaec9ddd
SHA2563dc574656e75a1a549427896015662cea543badd99e902c1cf93d0b1d02c8f1d
SHA5123c0dbada06a097bf59bb046fb526d00932093308913a282a4d39c5b8edac3b4e2f9d15ae1c9b3dd8a2572cceb95410934b4b1bcc6ad6e942a4c03b597695397e
-
Filesize
8B
MD5ec6dac7da2b5dee8a9379859e649c561
SHA1db7c8ffb88a03824509208f6c283a0a766325e5f
SHA25622920a5bea4a1371f6fe3387316aa90ace558e84d21980f91bdfd65254d8a52b
SHA512772d585877d6672a483fd5849465421d0ef12bdd0acfd83ed5d37a076bd06268001df4aebe112d8a620a165a08f401fdf2f15735798b49687aa59b4ca00a6a2e
-
Filesize
8B
MD5c4fe997ab8df80ad1715fea7db8af0b8
SHA1aaa689eaa952a70e454112669ac0886529800391
SHA256d8089745de89473c8e323baf75d70e15f24101bcc8ec689574d41373f4339477
SHA51204808f2dc6adb8d68f202133b90e37adf3fbe88f005c978ca9d6292a05abdfe4e09e1c0fd96a5b98c2b18f6b146183e0b2341a8244cfbcca4f74eb1fb4c3f0ab
-
Filesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
Filesize
257B
MD53610ceee9ecc59588f267da16159df33
SHA1e711ffa4968219cebb05ef385585d8107a8f77c9
SHA2562eaff17784d29aa72affc68e3d23ad058a8a69f87434e78b65b0d1546308787e
SHA512adc670d8efe63ecf7fae57095d9e6afdef9efd34084093dd98adb02f06b9acf5220bf91ba3fe494abda9d16d5d0e35c841b1691c47bf4680510c39ab8fc4292c
-
Filesize
1.4MB
MD50ad9244c6b575a50d0e4e12e73067488
SHA11c4298c694bca1453851dea87c35d47610b4406c
SHA256f4b8f3486cd37574b15015cd2d41a8187656c2c182df806775a505395943ffe2
SHA5123ee2c353e7f5620bcc413c2ed9b5f451273fcb9a6daf3b11defbead77d60fe4582d6adf84bb4a6dadee14f89815c2f8d884b4caf10a31ddf8c5e3818e65880c6