Analysis
-
max time kernel
30s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/03/2025, 22:44
Behavioral task
behavioral1
Sample
JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe
-
Size
357KB
-
MD5
6d76e1ada029aace36df893fb5b2166f
-
SHA1
3a3efa4aa0bbc534213e459778ba54a578f6a916
-
SHA256
8977f8b2765877a23ff0be05b7d330d9276a18636757902fc567f37b0071b448
-
SHA512
4d5243deb6a62dccc4ed99debd0737db4418104e48b73d414f6b6ad8155d3532193a0a782b766b387cf78b9a08fe4842cb1bf8324b517dc3cff30318bd243493
-
SSDEEP
6144:ak4qmqA1qjjvT4ndWgC4+II4xOMjIv2sfv6Z3bPJAEo2zGyCt+y8/Bl4Ggr:F9k+TadWIDICcO8aDbyKpsr
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Extracted
cybergate
2.6
ÖÍíÉ
mstlj.no-ip.biz:288
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
Internet Explorer.exe
-
install_file
Win_Xp.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Please try again later.
-
message_box_title
Error
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Sality family
-
UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Win_Xp.exe" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Win_Xp.exe" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R5LF64B5-6E36-T41P-2533-7OPJA116Q133}\StubPath = "C:\\Windows\\system32\\Win_Xp.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R5LF64B5-6E36-T41P-2533-7OPJA116Q133} JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{R5LF64B5-6E36-T41P-2533-7OPJA116Q133}\StubPath = "C:\\Windows\\system32\\Win_Xp.exe Restart" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{R5LF64B5-6E36-T41P-2533-7OPJA116Q133} explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 3408 Win_Xp.exe -
Loads dropped DLL 2 IoCs
pid Process 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Win_Xp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Win_Xp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Win_Xp.exe" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Win_Xp.exe" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Win_Xp.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: explorer.exe File opened (read-only) \??\M: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\L: explorer.exe File opened (read-only) \??\N: explorer.exe File opened (read-only) \??\O: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\J: explorer.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Win_Xp.exe JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe File opened for modification C:\Windows\SysWOW64\Win_Xp.exe JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe File opened for modification C:\Windows\SysWOW64\Win_Xp.exe JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
resource yara_rule behavioral1/memory/2704-0-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2704-6-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-3-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-9-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-4-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-1-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-7-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-10-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-5-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-11-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-27-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/2704-336-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1808-591-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/2704-590-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/files/0x000e000000012275-589.dat upx behavioral1/memory/1692-616-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2704-615-0x00000000044F0000-0x000000000455B000-memory.dmp upx behavioral1/memory/2704-940-0x0000000001EF0000-0x0000000002F7E000-memory.dmp upx behavioral1/memory/2704-939-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/3408-3543-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/3408-3728-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 3408 Win_Xp.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 1692 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Token: SeDebugPrivilege 3408 Win_Xp.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe Token: SeDebugPrivilege 1808 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 1104 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 19 PID 2704 wrote to memory of 1156 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 20 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 304 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 23 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 PID 2704 wrote to memory of 1196 2704 JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe 21 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Win_Xp.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:600
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:304
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1888
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:752
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1156
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:852
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1020
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1056
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1104
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2460
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:628
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2704 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2084
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6d76e1ada029aace36df893fb5b2166f.exe"3⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1692 -
C:\Windows\SysWOW64\Win_Xp.exe"C:\Windows\system32\Win_Xp.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3408
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5f6c212b89f8085003317f952fcc1c9a4
SHA10dadbd106a10570aff96630e074a0bad95da44bc
SHA2560d65bcf0bb574d56d7f07a4e972ddf7b335d4f70f7a41fcbff2ed502e9d2d135
SHA512e409a9d335e03eaa77aa3962ea9ad90614dcc816e389357744a03fc8b96a774e07e7b70987d76f63ba0f921c15ab7d5dcde350b543fb3f013e567c2737e50231
-
Filesize
8B
MD571918f88b115ac9bcb786b9654f02936
SHA1ce642f87038a3a9c9b4b20e88dfa2afa4606568d
SHA25614a00c16289f53fe4a727c47a1cab878e87fe98bf7712b91af420d036e15d577
SHA51273f0383168cebc57763b5265f71d91f2343b35c027451e399ab4f827afd8651eebadf4c47f05adef2317acd6da9f4341a637bacb5c1df0c15d1010f3038434f5
-
Filesize
8B
MD5da7d733f90d9c61ee98abc902fb8f773
SHA167d9d32830460877cd36e9385e785a46bf20f19e
SHA25632cf19d7df5f2f176a2839eb35f6cdbbd1cdb9fe85aafde768906d4974ac9c93
SHA512ad7ffb9e35e7b9cf738c8fe9ea256a519c2648f7c8b8166a4895dc9ea415218fa36a16896996827edf4dcc7a45cc5f8a09855a64bdd082455d189c17f66631e6
-
Filesize
8B
MD5068c5709a1959e49daaaf958f5de20f1
SHA14fccb5e2a5f7ecaecaa318b9f9a5d0d13e85bb21
SHA2567d9d5bd27138eb6666ab2ecebac6c102ea2cb53be88154311f20888e6a5865f3
SHA512bb0530d9460a2241b3d6eb49d7d66652d759199cd2bb8d7dee3324c1f6381d5e674945e00da10e3de1973988ba17271c4340f078729496ff79510561c1f26ff1
-
Filesize
8B
MD552b6686df1765e014a543793a57acbbf
SHA1fa4b13a922e6bab175ef5f57a1103efdd8b0957a
SHA256b48ca03a330c6ca59fc28f76101fdd70323ae0c496b03605219185a228b659b6
SHA512651103bf54c5cc550aaaac171c910248bfb946fb40c775d301f6b23ecc8fc7ba65f7fd4f73c01ae7c5372795c70a1bea045f281207bf7dd0f46300ef8fde9c27
-
Filesize
8B
MD50ade0cf03f72262bd0e6e4d1b29b474c
SHA1818f370568ecac332e5d0a57cdd250ae3364748f
SHA2564f4c3edb8c6c77e3f37d34efa42ad6b85e1c661dd7798d4e3ddf0498b5053293
SHA5121d713455fd959f73fa8a0834abc79f7b55307fc6071802260bebd53028f1581e6fc07eb4d44db6e253cbd9c4fd84de6af5d1b6e3a3b555c60e1e96958061767b
-
Filesize
8B
MD537fd421a109cf9c94e144bac7cd79c43
SHA1950e7866dda31e80a584c955bcc96e495b0beaed
SHA256826955e99883e9deb1d9b913b7e9fde7e3ac8363ac2876965aad158263106c18
SHA512d448466ff5d9be1ac74d49703dc79b318b12277a7f94cadbb2e117fe5031ba8b609bc947955c4dddfa7b5723e98432ba01f516e6f5c8e7b805f7a605cf0a888d
-
Filesize
8B
MD5dbd8f00a91f52d6a7bcecaf139231eb9
SHA18beaf68b802f636663b679d48e13c4990e6f8de6
SHA2565d9c3ac13371523ea86a8f7363640419fd67883b7709ad5d17713d2319fe12f4
SHA51208ed4288167c0b40b3cb9e6b9e83def14b78aebc25c55f6aca4ce9c552e503a47d086fde104354981021d539fd9a27a0fd7b248bdec593a11c86d220baf8eeb2
-
Filesize
8B
MD58482ed1bdd47e1ac1e6407e4ed7bb49c
SHA1345040d1f094d3fad79297021c8b7d63679af595
SHA256c0a43ab0a06a173e93044ed7d16ec420106678ab9b1072687db68c8f091fc5f8
SHA51255fea03a3f841c30a508140291bc35ce7ef991c520928c9e903eb05e19cb161a819f3e8659d6e9e47037adfc8c214d65dedcb5d21d801e39a644b28b70f24a24
-
Filesize
8B
MD5c9a7cf493c848ef28ed9d848483a4068
SHA1ad5842502152d5f26a4824ee3405978c4cb974c8
SHA256a9d6683f2eb3f0ceed984a046c53b282c215fcd74a3fc1358ab941b7cd9a191e
SHA512fd177256405f793ca04faf14694fdc10fae1e697a9aabc50295e673471cd89b41571b3aa188b7b2f942531f02e7e13b58e1f8a094492944688572a2e19321eae
-
Filesize
8B
MD56f81648946f0191359b23cf2701efa86
SHA1dcf7e00d75cad13f87e5886289e0f357ef16beac
SHA256e5a1dad26b6d59d34c4544f788b0e0abc0393eacca22ad4e3342684b2a16fbfb
SHA5128d0a01a3bb9719eed7e30d4069531eede72590d27bf509419f2e1f7f0a495198de09a750739b2746fb1440c5a1b041ec3d37d7b49c6d1d95759e5c30e002356b
-
Filesize
8B
MD5bad790715b7a2b3cd823a055d05f5e05
SHA1b23765279ff2df7038f9fe8e42551af165815fc1
SHA256ee1507b198a70d97b06e06a7884c62cfc27d41110b62670c55591548a8020d3e
SHA5122f38315c7e2dd2ffb4a553c2a6dacbe937f409825b3936091d9fbdfc2ec9fa11b38fbd67d90e24d6d07def91ec8fc998e5614067416984ff734bc83f144827a4
-
Filesize
8B
MD5d1da5697ab2096ba2a0df16a6a68c067
SHA17cdd2f23166c3053035d9ec44f15e3cb83a3e6ab
SHA256e06d97f143ef26e3aa0c58894ceafb01eb81b7c97e20b4c11e6853e9f46736f5
SHA51287795dc3cfed97421db9f06fb7f01439cf51377f4c86e57dcf4482b34f3f05134e068daf0ed4eb1f7c7ede876d7d29c2613ea5d8a3637698a0b5eb28323ad249
-
Filesize
8B
MD571d69a0cb6a786937ade0add082524e5
SHA1ab8dffd0a166fdf4b34fd7675ef47f73fca83c63
SHA256e213df91403fd5e2fe674e375500cd3c8cce2f540c1fb0540ea2523088bcaac3
SHA51288b4a2f7b370f96f53dd2363f0bb96a91b0d7338ed64f4033d0b962c473433c289f3e1f00745a7e7acf9baa8d73e3c3a57a3ddd2816a11b581724af7d715cf93
-
Filesize
8B
MD5b7ec028d453b812151933a9181014550
SHA1b961761040a5aff2f4f9cb096afacc050c473476
SHA256fd7e3acb2af3496f09d4b427290c83f7411ec59a1e07a913fc064773b948875c
SHA512e8226f4244e930dd8b2e7ad492901e589a43fb43687abd85e2b97a4779ab317a75cadcc158460413b1bc5b69574304281b7e613339bcd78a8f00fb4f43c9d1b0
-
Filesize
8B
MD55f049b3d69123e53b486246937c2b1bd
SHA104c50feeb83a78f4bfeb71bedd6e883d21de9b7e
SHA25696cb4eb213ad6ca4574ef704033c4188db0eea5aecbd72fbaca78e2d8449590f
SHA512fdc73a8f52a10be1014ef1cd38500d11edf4a53e3125ec2422d07888bc7fe31a869a10fe8d4e251f2243d9349d2fa101950aa44af89385ed087811eb6b5fbd25
-
Filesize
8B
MD5d4139366e9d12fb03bbbc1f260edbf53
SHA1efb8b3952638665942af80eed5ae0e67d4daed16
SHA256481141dbeb1e881d97e0d9d5ecaa5076ef369517c37ac94131d6a3e805a9ee94
SHA512611049a496a98e95c4941a56a7a415ea3a7f7e1f51861497f487ba6ffce757ce6f8c812af478e32ac785bff4bc4e5068eb009a5ca4e56524523c5db898d1aba0
-
Filesize
8B
MD5a7409a45a0911691d11b1fd67b777d63
SHA1b9614d16a18e83295956567ca419633a6d4756d7
SHA256b1cb51d05b322bdb7ff55f32edde34f77465d00f67a9ef47f324ab76550a6902
SHA512ca8d312a749ae39f3492a63352ea012ec90ec847801eff2e0150ede12e4fecd0dd720b876940e326c3b208fe7f03c7c9963c664b13e909de88d13422e4a05bf5
-
Filesize
8B
MD57d6cf915acf9770235a56a1e3a72999c
SHA13d3ff6460a7c66363121a69084f9ac61fa305009
SHA2569af66a42e2976b949d3e3267b55759617b1ba74e497a6b996637417821b34f68
SHA5120cb974562122054adf78ddc8060937739b39b35afa4ca2d0efd492b26c08c87d5d91623d4f2f4ee361e9226f7d0e543807489a98757296a31326e659a3d40b95
-
Filesize
8B
MD5a5be8d51c688f506f0f9ec225c99bf2a
SHA1c0c6fd4f66b717b25e52010d79964c0631ed2ee3
SHA25643d1e8bc890868c126678ae495853323aa446fefa066e314257afe4041827923
SHA512b51b90d144d37d2d533bb1cca0375b13339ab65db77e1f54a2c6c416979bcb1b6c2ba7565c0fabc040b8a4cd0c3d2ff1c9a66a30facc49218667f7a755dc5680
-
Filesize
8B
MD51041fcf550957bdd22f0c04bfeed8b02
SHA13e76e81949151ae615e9c3483d63e336bb45dbde
SHA256194547fb16b7333b26ee1742f14de9d9047f5bf2d12ffc55235eae7e98555140
SHA5126950468e2357ea0a24ae4d3aa713b72d31944d3cd3aefdbf12f98cc581bbc0f0dac24a42ea45bb493c0908d97dd29264ffbfc10588d6a76c01865037c5b7cabc
-
Filesize
8B
MD522ef4f7b12e7166f4dc9eb92da8c119c
SHA163d46daa046a2e64b835c035c3e995fd1f1398b0
SHA25627269f97ed6828b8a52259529764bea7e86d833c838fb2b5cafd51fce2dd3644
SHA512767a419bdcce248168cdfb29650e0686057cc63ab325b5b3b84f63c1512bae197f63c373312297064e4d111c9e01259f9cd566fa596f12e38251dfe174762bbf
-
Filesize
8B
MD508fcf6c3254ad905bf93fdfc0ead8edd
SHA132192e764648237197a3779bfb0572e3873a2140
SHA256b73fb4546b80cdd326e4b9ac9d67470e0ece2e64ea17d8638a175106ae6d6bcf
SHA5129a2e7b6e717b26bc5016d18f4740b74cc1c55dbffefbb9f28851e7fe274fd6f88182492bcc11b4b27c5271d353fe6c516a6a1c9d7bead0b9c09974989de403fc
-
Filesize
8B
MD58a9fcf5b98506c08089fdad7d9ebf272
SHA1bf8eb27b8f9f5afbeac357f5e5da429749af32ba
SHA256850038cd0233abecf64dfd488d1cce1f2c9948733c75ad49c818f7835213099b
SHA512ec7d2cfb7b17c37c84e22e325766b5b507e3153ee0cadbcc0668a47381aa70097cccc785b41f564a8f2f2d8279946d14d5e1070d42f3273869f91a6a3499a351
-
Filesize
8B
MD5495609a4dbf5279dd9880d2aa652cf1b
SHA1620b67a4c380c7fc8b1f45b5f8ccc058cefc7317
SHA256a7aaf354d22624273b6635a8657eb571561dbcb7f50f303b697f3450d3c0aaf6
SHA5124d0ca995f6e07b6d67662dbd75a2c356af97bdc49e67d975234050ac7229ef6d443e11fdbe27532e150584f2e181464e386c084d83a0c651292aef7cfa2405c4
-
Filesize
8B
MD57e812cf37644c5cb98811406fc98b6fd
SHA19e66a582cde4b147f462e7d0b9db82a2a09861cf
SHA256716ee04bb8569b256eb5154a6f08a8eba8e82f7e2031d84a34fb03521fb01086
SHA512dfed3fe6ad74db5141f6ada640a0ebef7db05a6d2325b1d85a6acffd08b8d1e00a9f0d9ec2cf35c7d5138bc18752e20e260cffd558de956fa1303995aae39f80
-
Filesize
8B
MD58f7c9cfd2b1b58fef6bc95ff00866334
SHA1f38299ffd05a3831b2be401c64bf424395b70d9f
SHA2562d2f29cfcb71a337478d7564ebce0000304c2e0027af312a8890048bbb909442
SHA51241cf629be48a132ff2f23455ab26838abafdad937469a414b6f379684bd93243df100af5acf9cfeb4e1e527ea76ba1ea86cf738811cb175573bb7b8ea4e577b3
-
Filesize
8B
MD56651daf086a39b1af4803e7830b0eb9e
SHA180b3ceb63261b7ed0d65b669c1ad6252d8c6b500
SHA25650969370f702957aee32cc09efff677a2cb8fcf911d3390add5cafd0c0988b13
SHA5129757421ad718860a045256d7fada958ab3ad94a05a5f9e39623279990dfad1d940720684c018bd48edb0971b8e7728565b3c7912fcbfd75637e51729a71c9b9e
-
Filesize
8B
MD5693ac41b277738472425d79aef957b1a
SHA17ff4ddc3c1508a352f84cf9c13578835d720f559
SHA256b8c9c3ee258e3cc4b403c7036412f50c0fab89783ffeac1812f61b306b25dc04
SHA512d2d543daa316a3c8f7020af78defdac223d9dc24c803225211bc9ea571f1f15c41a26a3c9381f8c2f0cbba2eb9680d5e21c3c665a0cfd8829ada1557998c45a7
-
Filesize
8B
MD58f471756b7751635c6d81a00f40f2afe
SHA129dc6c5f4f9a505c5e969ec13c8c0efe995b91d8
SHA256ecf3d06e7425c1df53c7694344b1ac0455dd21ece7f103daa08c84511ec97754
SHA5124f1379de126e83698bcdb0deb5cad6a2694e070f9df79b50b905686d04482b54af56eac851abb287d4e4ab92acf6dbd7c66d3fc3ddde74f050d5444bfa8448e7
-
Filesize
8B
MD576f1ac0b1272a86ef23708640f6efd86
SHA1bfa7c7d68da42fe9bb2906b66e6b0d41b418504b
SHA2561a33262ebb76abbfd8dcad5b7050589d073e2ba2838cc2aae6e7cd1bf535d64b
SHA5123fc4716e2af318d5b51439c9cb9ee83d0941a23a6165b1eca78f4ea1b2694c6f1799a58967550ca00cce532927fb241aa8282fc1ecb88777701a614c098d784b
-
Filesize
8B
MD57acd2a97b30204c4b0f4fb9cf67498e8
SHA1cce051a03dcf41533b10e8a74d47bf26f7293cbb
SHA2563a9dd925a96ea48be557e8be05dc9ca4cd1d7cac9faac286a62a6a49c84e51aa
SHA512a2b7b1acb88f35a449909de145b9d1fd32805bb5bbf82fcfe07aef7766571a1149092699791699c0c7b294b527f4df5e8d08f62a0dfe0b8a0b8f24b6dfc25fb1
-
Filesize
8B
MD53cc7403ff53525375c729eb229a341e9
SHA190ad13d25943e519ea976e8009c668371652443f
SHA25600c01d5e1f9b79158cc01d77d8d3f2f83952d8336bc7ef79a56c124b1d3d9648
SHA5128e5377d5f131104b9a7f7576da651083fd41d9bafa95a2117a57441db54575b913d2f19c65e00ba784acf96ab7e93c539273c3d3560f0e423e0bc252e958927f
-
Filesize
8B
MD51b7ee7bd0ddf9ecfaa137bef4a032857
SHA1e21f9a08401653fe815b560cbfab42fc1c3c635b
SHA256164511062841da8972b018942fb290d3d67cc654752387911ad0daa6b5129f39
SHA5120cdb8ef8ce695b2807d030aceb488411ea3205e14555148898363fa8dfa0d1f85d62566a643274c35407f09d08656ba0f7a80631b1b488d8c2cdedf6c99155d3
-
Filesize
8B
MD575c65a59e239d688a2b6fe293ed5a8c0
SHA1f6d4c9b752f04061a308de871c74e6ad0b34891f
SHA256d078571aea847c83e7dea0cf20b45e57c47f5e6830dbfe1410b67e62c55da7bb
SHA5124b9462dbf661c162065b10647004f92634ada7151331e9982f0078e44cc53769936ac23f7a99214f2ea5005f984790f1e0ba033f6f6ac29e875eb6ac309bcb56
-
Filesize
8B
MD57a17e4cd707b189a4ec2218067576421
SHA1fc8fbe2e620336c2933c51061481778778ac9788
SHA256842d372eb036192d7de78bcb36e27f94f369e97dc0e46c96ce4b0a685a1575b1
SHA512c9c516d7da0870c207f2974dfcaba88eb3c4b04a96ef7122d8af3f5b87e0d0ddd6ab299cdaa9bf96a9f80dcbb88e06e2711fbdbb9bbbbc2bf029ef7c12962cdd
-
Filesize
8B
MD5903c3bf43c62e63f3996e53114e74188
SHA1f23ab77d4a1ef9816a5643d735ef41a0a570698d
SHA25613a96c1b75be05f0e6dae94946b5c63619e6b2b0d059cdc5a2db75046b5b06ed
SHA5121ec4a85161616c74e2f33c0f8056e838480f4a9ce58292f88ca49d92610af75223c9502732b851e85138a4f2b6f162154738999cfc8bc042220b97e7d9897c3d
-
Filesize
8B
MD586b07cba0a06b0b89852963287ed2333
SHA168bf067615a9775d7bc0ab4b082f850ec4fcdc53
SHA256f4ca43cb22266aa4db51525095af2787efd53b69e506a215edca72d8ee722624
SHA51203fbafe9d488ef21b65cf3553912deee2c280b7d450332fe1153f770db88949494e3be953c9c4da794cec6b613cd401f8b70e8039786341add6558f818803e05
-
Filesize
8B
MD517ac76b0f523af01d2beb07237c60a51
SHA14486f74ab9c0b890313ad0db147c373165e3d712
SHA25656f937f131ae2185a7e11aaf7ec313ef6c2e8b5e2b3357fcd20e0a45bcee8f84
SHA51208e74d12c12c19eeda8291d0dd4150c6eb69a8c0bc2f993e46c6688fc8e500d65a4ff62b45cfc6bee3706ec15dbf52b7a909e62aa1e4dea9f05ced37d883a303
-
Filesize
8B
MD53e8d3b1dc3287a65cef9ba010bd83b66
SHA117736d2d5cea4a08fc7c5e65713e9c89706dfc0d
SHA256e1b55dd29413fe4920bf324e4b40da7c3771aaebe23a2aa3a6b37e903fa07bf8
SHA5127af18298be9a1ac2e922d1eb35f7a7b9786199041a3794320efe9eb383706bff1f235f8a78787036b2c5aadfa206bf3732cd98bb68f7843e2f06df2529709d18
-
Filesize
8B
MD51233e4ca3e3b844a7a466e31aae6acc0
SHA1c8c7c8e0fe726be523434f73da44adde02950f70
SHA256818187dc48fa77aac68d74a0f26312ad24762115f8259f7d1fe86f5b7cdd5389
SHA512bca904ef1cc42488c6da1bc82e11f66be6fd1df23c77989503b55ae27a5b880fcf4b1a43467035eec4c8a804b60b0e20b17872b6335c4b7192c2eeb1ff6a5462
-
Filesize
8B
MD5d8ef4ebfed1866302c92a86f2b7c7b3d
SHA1fcc2e184cd3f0c20657ccba9e2a2b158f1e3baaf
SHA2568dca0ceb6448b7231db00dedd5ce678f948a74ae68f3a77d603abc73a80b34c0
SHA512bd723f9f66ff1217d82a113febf93ca7fdfe43325e2dff47fcb239f0bef873409c4625d1ede541e6178b3baab060bee8a07d5950e714f8ffd07f5d24c57fe196
-
Filesize
8B
MD5489777794cf7a917a29456968a2d8ca7
SHA15ab9cdb5ee9db00cb88bd95af294011e5ad7488b
SHA256056febcb053e7cb7b9fa4d87957c3ec122d9650166ab6f2ce7117d1621db87f6
SHA5123de3a7b2b0fb3ed7b03a82478057724c3fa0b887908019506afb82e7f89c40cf8cc7c54716f6ffaff0050da2fd31d162bd1e8c7d944257e68bb285902acaef00
-
Filesize
8B
MD5609598dedfe21eccd5f87c6f2eb0bf53
SHA1eebde03f745c68534ebf6694e66dd8b7dc6f830b
SHA256de2d3a2f8d0c84640b621783fa8d39a895dabb3c50245dec0d17a197ef674694
SHA512b30b3df816b70143270663c751a440fded2fd6d738e13ed06cc66fc3061be7312836e7f48ceeb804e290800277d504019e0fa61f774f2027ec521340acc83c2c
-
Filesize
8B
MD545de981818d76c38f0708a7578923302
SHA1c673595562fb1c533f4581faa6b4b34af4e30662
SHA256f2b3a2dadd6f3b631c327aa367839fd63b48090a4cafe77eb59e7ba19b2a9b3f
SHA512ca92e5161e9921daf8e7642a2264565fbc40b94b0be04b87a9e6a964a60a3efefb1f58952944919608fe6c445e1efd5b47a4b3cc8185f8f5664059a55687ce97
-
Filesize
8B
MD52671d62d33e39ee2309a1df527a35f6e
SHA1a659d98cc7172d8bfe6666568cb06813aeb0406f
SHA25627ecbae11df2286f7eb6d70bd857443a0623976b65294b5ed3b00748cfb9ac3b
SHA5123392c7ea8bb5e6887110507cf1b9e6a8b2e3f0454e2a89f6c7a3074545396f795a97e4b891a25ce967d55bb66af97053ac95cf8361277e55f8a7dff6b6e27468
-
Filesize
8B
MD5c62184e6cd0ec7bb89cc4c99a081b387
SHA19be4d176c56171e2258d7166e3af63d82e6f556e
SHA256b51751de37fc67f2b777970495977b1a553462e26f7701d7b902f2ae544b12d1
SHA512425cda54c7837f1b97d5f7b7a0fb68870610e7b7b974e79e265b0ec87b068e77ecdee2bd7493a18779a739c96c7ba7eb0f2f81126e480b950e8b817c5bf4bf98
-
Filesize
8B
MD5b6b08e7e8a013e27526b1a641043f2bb
SHA1065ae9a41dfed00f91fe2c76820432a1bf340ddd
SHA256dcfc2680e7dba1de7b0211ac25600122507ff23f11c9b168e9673828f889d673
SHA512960893574a8fd17e5a3444c9012f12f6087465474fcf44ca12dcc03def997bd1876aac278f16c3f526c3fa1dbb134aa73e71c0e087f69ccecad45871dea0f02c
-
Filesize
8B
MD5db338b0bbefe1d5fe4d5a2cad33ad012
SHA1a7efc7cb8ccaacea51703dec96add3fdfe432867
SHA256e33066d34936fb4dc869bcac3f1403140bea39bc8e81804184017154ef4f8358
SHA512a58ae424b0de793b57bed3b2b250c2ce8d948182cd772fd0a685fc94a638b9f33986d29fefc05c5750cc23a705ee6a429a83c0ccaf6e04033d3d0250fef0f461
-
Filesize
8B
MD52a5d53cba47db543c2e362451d984169
SHA1a9f42a38d229ae74aa5db359032eb36c3fc6e92d
SHA256fb5b37bec89fe4c8bace047fbebd9b1b6396f6b01f1365e9d5f8e2156c13ff46
SHA51237562ef51d26fc8447993194e87e27eb3357003e90bb09916f490ca49dae61a5f3c7a6f0269cd0c74f44c820feb19ae4e26a9f7221bec4e9fbcd7812f63951d2
-
Filesize
8B
MD597bf95ad89e181f0acd2f6fd03acbcde
SHA115939388629a5aef920d3883ef3d9b4b8a9abafb
SHA256bfbe03347481c598c98bee35e011961fd0fdba6365e5814bc7bcea08e936ab29
SHA5120a6eeebe2b49634f0b01e9d81d68c4fc1eac5c83c2a27da224e0c4bebb750cc5d0e8b13f7bc979d21a5934792f3af4a766c32f2dcd70fd78585a4bb6de780d7f
-
Filesize
8B
MD518936d258057fe04fd9a65644c5a4ec1
SHA173e1eb2a303ebfb1d9ae8b51e242f08eafb2c6b2
SHA256a9efc7a43112148d3bfc8bc1aaaa11cfde7030fe5c5a8d1c69d13d2a83c1e98b
SHA512e6c18d1ee54a14635d2eb140ae51ab237b565d7b486685ca34bc884588bfcddb006bcf6e57bf2ce7f4b73662f5fc0c6f7ac78e8713aee957a8d1872c8982bb63
-
Filesize
8B
MD5cb59fd623e6446bec241d7d7e356064d
SHA1c7a0401a17ddf802da8ef1f3f899396ad62a0084
SHA25643544e18b96a3fa2e972c98c77eb411b09c08f034097bf12d67230948242e32f
SHA512631cbdd9418cf9a7ba94e106ca292d7620f803484ce033ae586cb2dc03e6e180ef2853661b32fd7ac97a2818c5b86c3648358aef6c1820e31e594e8f3a355f02
-
Filesize
8B
MD504d1865c972f06a5c5ffee8e70a6122d
SHA13a4e757490496a44c67aae64b4d1e35c326e26dd
SHA2560f5608a458cc2e1b936884d5f453543f4109275328e7beae2d37f9283e362b46
SHA512d63c3bfc599df9eadbc60c89438c1e1493253b20bdaf199513656f1d45cf85bdf5aeed27b743b02da8380e8c5f670a7a303dc148e5c6207c8c670ab1e3f2c573
-
Filesize
8B
MD5f85cd47ba2c27e244afd00f2ff823b8b
SHA17c25ab7356d889585403f63c0690fb393c55430b
SHA256f7396a393507c0c722a76094efd5acfb583311a64d61043323ba1dc13a6f0812
SHA5125383eeb5ba0dcf4dab067f67e00d33b43e8dd7b8f8cd53e74529471e9e590b1afa81e386e562fed1115fc40dd26d94f31f0f6a85865fea00391a97548b8e392c
-
Filesize
8B
MD581b166556224bdf2ba18d369983b1152
SHA147d94071354fb7664fe18433753ddb591718dd90
SHA256c6c8d0a1456055f3cdd6807fd015164be295a5599ddfb44e4ee50800b39d8935
SHA5120d67445e143493a9ef3670bfc9b12db19d289a6ca39bffdae787177a760983a334f4cf3dbe21b6e225273bda1b2852dbef0465422d59454e590733a0b6e339de
-
Filesize
8B
MD5626a50cf08c63db32152e147c5cf9fea
SHA1950ce18e11eb5987dfcc49313cc8bce28e67cc0e
SHA256dd86ae8f106cdec6393319b657e1794d5c54b8c8e234832b74dded11fa6024d6
SHA512c926bbe858cab5e4843a201c3ecf26fd88c5d281386f4ce2a90097affd54ff3ed9f8c3e92d28ed598ab4509c3c8729bb1624cc26e9cef04f9de9535422fa0bcd
-
Filesize
8B
MD549c353f2230479968fce7c115952559d
SHA15da98b215d3a8792af5a15b8273a1eba295ce61c
SHA2566ab5dc3032ad7905fe478ee774119d8401ee38989793f2d85a821c7280f7d132
SHA5121d779d1e5808d4d9a9545035af52df838f6d646219305ab30828172c66cea3a9eb5d28dc7c152d3aee8fe0625465c889813a219d9cd7c19c618098a80139ae03
-
Filesize
8B
MD5c33704ebb59de5edc6af650ce6172e7d
SHA10dc9ac1cecbf882c315114c98747475cae11982c
SHA25655ecd9a0867b52c6bd9e1ad9ecdd1e7288b870f2a1b1f0ee25fa6ed5e2024e00
SHA512526c4a8499e7060e66f29c84b612cb9cd7c942a04c6c9841e3ce973795f5587e73ecbeaa38dc29911dcbefb4f376a81887d486ae92f74928b516736a5335d317
-
Filesize
8B
MD5624c782ff258f418f3190382b64be072
SHA166fd70532f817aaeb0e0d0c9d490be6148bf3118
SHA256fbc391f7b406b9780b954b53d41e68267bdd91d1ebcdc64ab2985072c2b01246
SHA512086356b3d71d3569b9f3b9bfc55d03570c1d9d302bceb5a70bdad4a7e980c564f7f0791ec4f49719fcb6305e2ed815e20b28147dbc52fb5fd97b91d02157cf82
-
Filesize
8B
MD5f33fdf65794f069268cc4fb6be4222a5
SHA10b60758ae8fd814f88cbf35e5578b17885014b6f
SHA256479c352bd7df9aef97faabf466993c0ec9b33b6f1a3afe8c6518c862eb38e37a
SHA512d455893f441b41c94607fde861be8d19c6b9b795bfa28b30ad175a4cb81307d2b27ba90a81618a4e239abc2f15ca783dcb7ad71546d51f62a28d9bd2cd981de5
-
Filesize
8B
MD5d47e9d5b3db50b4459f4ed3e1bd203cc
SHA1396d14f8f5f7e599c0fb276a21cff33e88603a47
SHA2569e84c977f4ecb875a876d284609b35ade2318b610ebd78df2d243d10d18be0cf
SHA5122659ed6ca195c1338d352f302dbb5ff934e0fb4501fdcfa58e4cd5f94a82bf7f8edd32301e426c436935045ebd34126549b6cfe830eb0d224ac8b3ad7b9bf45b
-
Filesize
8B
MD5766c9747ca517551c0234ea302924f13
SHA14c3bcb8e31a1313bdf24802bc57a2a9b6e573535
SHA256acd9d00737279c7e37becc2081bac9c82795128b5f9f823ad11ef0568701ed5e
SHA512ce53896c25f9781845efdc7a95449655e9284d6fb65821174f20273fab62a6400a2c6a407182767208a7ea6735567f19bc3cff987c6af5b1d8cd96bdbba06c63
-
Filesize
8B
MD5022ff479b220ed4e68a76ccfee24b3f2
SHA116ec5cad934abafc447c062fd903ef4c11ef4c1a
SHA256fa5e0a2909ac070628745cab6c779f1d8c95655efd8ba621feb1309c3a794566
SHA512acee37436274bb3ff2c0f658e6480e072542fb0e159dce12d6af562918a19e8ad6db03164eb3b39c112428b386a60267097f95c7737fe18d3a7c1f047858fc20
-
Filesize
8B
MD592f41536139ef6a6425aa0eeee0cc729
SHA1e5f320511285d04c6250bb192c46990055a1718b
SHA256a454f4aa1d228ae95bbca2245544b8f26f4aaab345ec062cca75cc63c41da85b
SHA51206e6987539cbc1cfc373f98d7ba7b6bd435b2a524ccd9a8f3416d9134c7180cbaed24bb74bed6717bb60d4a644f523cae7d90b26da23f1ea9f9ad59fcc7b10ea
-
Filesize
8B
MD5641b41c4ac4ff0ad6f01b64a1291a124
SHA17dd724fa60755ab8b1be3f910846f6fd01564b2e
SHA256896f034aa2f74ae0c1f775c03dce585bc7c33b63a84c7de34cf486e7acbc19fa
SHA5122c4d71bb409b1bff56233a2e49c4e2a4c470d18e930a277e93c4433aa2446b9b7c235abbf81350fe99537e557f59b3f25f7613d264bbaa5ce195668b5b466274
-
Filesize
8B
MD53051d6a7121d52c0191d190ba63a5118
SHA1c4773d494fbad507c98c5299aeb1f1b11f920dd4
SHA2565ced6fd71a35ea75ecb8757b88368705cec180607d46a0df8b890f585d7471e8
SHA512cd2e740409c665a53bfa9d5960bc1009acae06f066a6f16257d6d2cb3d08ceeaa0c36e533af99e1790b2f2d9c9a9929b8408b2e295ff97cedac1b5742c2b32d8
-
Filesize
8B
MD5b5a62f988eba02a4d7c965db76fd6d18
SHA1d979916a6f1c8dca93c5310e67a0dcec8c883e22
SHA256ef4bb8d109f28256eac602814ab23109d389caa9de4e01930e2ca5637ff77b2e
SHA51246da28c581b34682b53aaa6cfff7e15cf94eb6f88a906da345b6391a38115723d77794a52a739d1a920543317c065f8124bb43cd7f09967d261caf2e8f8c7e6e
-
Filesize
8B
MD594b4c59b677248a43873d9bfefdde012
SHA1804364df3f0b182a26dce6a24a3fe5470dd28380
SHA256fa6e19162f18ea29446183c6a27a9c721bde7247c86cf723a681a0e924225754
SHA512550605b049d1745860a9be32ee9c8453f6ddddfa216881871e55af73f05799536c79657a83e25df88c168875002afdf626e1484c644d4efedc08376f8355bc34
-
Filesize
8B
MD535d53614617ec23135cd0514bb0acff2
SHA1f7603666b4ba76ad7e8765c9803c2e1af188f620
SHA2568996a8325640c6baf149ef7a981e9a0edff4be141ea876752efb6ba15dce3e25
SHA512a115c907ca1a02630e1eb25c384683d1daea840164f4d4b3e628fc6596c49c47ebb58964b41df3dc06485f9818b4e6c6552bc74c8eb6ba435c55f23c111eee08
-
Filesize
8B
MD547cbe9ee05fc77443af074006444688d
SHA1ef03f0f1cb18a31a2d85034c83aadecf49f46c1a
SHA256907313f21ec5540028bac7b241cdbf5eeee26d0fd1241ea777375be01a7d7f0b
SHA51284fd5394f3f9e56bd86bb69a9b8f2060b70ad2fd7bf233aa9befb4e9c7a9bec05ec5bf34637ef2aee1bfcb26b6af5afc08263b1d61eb2cac2fb304e1d64509f7
-
Filesize
8B
MD5cb815609b3b7c15bf3e0f8ff25bba056
SHA1ca310027a1078e571a5a7d9c20c35297c25bb2ec
SHA2565b7f0229eeba74fbf7e05ba20f6048ffcec2cbd5abf86f109a2dfacdbd4c2229
SHA51245c2a8583bbcc43d19637061dab6f029b85050c0a5bcdaf708f65496043273ee1b86b38a280b588186df7389647a981446758f8a35fd3b7c6b90da71e502eff7
-
Filesize
8B
MD51d3994f66e6bda013cdb1cd625edc917
SHA1f7bdb7849834cf67d759f5cf901743f6fde13343
SHA256f0006f699c79d70034fbf667b27e154892317d1eebfee4ad4595105eec08ddc8
SHA512095f98a2d235a59cd3c1c4eac86f4d62ffdc5b2f52aa8dfdc3d2f719c9cc4c8629c04d7818fd01f6671b6115479d2c59fb2f538a40369251f55eb2d2e65a4a58
-
Filesize
8B
MD531c2c6011da41f8ec24926d4396585c0
SHA16cbb0ffbb66da1f050373a11edff2abf96cf164d
SHA256fb4345146c93d4aaeb0776dc9e7e09501b7bb6f88b8cf7a15c0f9d0ffd7018a6
SHA5124140174cdec66da4251161ce691c3630ace50114045133e5ed24b5d3280b12315378d9cf308933b4b3bbcd96b6380e54bbe763a1cb7e2fda5412b2fef075f96b
-
Filesize
8B
MD595dca38f2912b63db6f44229e38ed593
SHA156e886216921ea6e732defce78ae077c31664bb7
SHA2566ddc7dfc24c1bbd68bdcb2c175626c0b9bcabb9bc0bf09d05a1d10b972260dcc
SHA512bab7cde488a0ec84b2e20560ccd45222a0e5b6d7d10c8c966d59490482be2717b5561f5dd7e7f736b60ca3fb31f4d4791dd1b661004601af956b0d00a53bcf6d
-
Filesize
8B
MD5ac5db5b73a43ede0283f4694fb067264
SHA13dec4647cacfc352b73d65364ae7477a2e05cf62
SHA256d220f22b47ebdaab86cdaae3bbec031e382c1de59bccad6029acbdab810097aa
SHA5129aacdd80cd2bfc3bdfead6431ef39ec25edd19059efeb8621facc4ab321f2f01ffb23872ce9f9a1bec165d3e0d09defc114d27efbd336b7d82775ba14711b788
-
Filesize
8B
MD5a3264bada36855929d175008da7344be
SHA178eaace0c4357c258ebb61bbee983b268781aea8
SHA256f7dd3f71020669a472b10e0deffa6c24120d1dd14036a7becf2a5a92c39435ef
SHA512ce4840994272d33d82a6b4cd2a9628ae2220d2f63432f90150d799beec92ee6c2c8d62b40e8448b94bbc99aa045ea1175538cc55136129a4a5d290cf175aece7
-
Filesize
8B
MD5604d0baf0a81844f3faa362672728273
SHA1cca89661ad813b6df50a2db8f9bcbbbbcdefc282
SHA256e93228e5ef8eb4467eb7e9ffbeace3418d860590e4fe0d083733f2e690a5cb73
SHA5128ee31b636c6838c7c01d5ba1303a61f0a362df6070bf6450a6d695a2e6491d63f1167e98aac78cc3cbe2d739ca67af0bc6e01e2589f7e9faef3665a3f29e1eb7
-
Filesize
8B
MD54819e82e40b131151e3762573b67850d
SHA16f5846e420a1070afe5808777370d44bfe100a3f
SHA25648f47901de1c668d8cf7942fbaf3eefdbfa4d92d464e0fbce680928bb8b3c76e
SHA51252b0ad0488d9297e8496ff2616dddef8ddb8ce3b8fc9138bb1051eac1d2bf62378d1f14e8a5666f9ce3952e0db359da8723ce4fe6dd1be3cf6e04376d2490c3e
-
Filesize
8B
MD5da904ff90c817d3fd2fe48c116b83b02
SHA1b4ebe06be3bf8a1b32333b36987169921b89d290
SHA256d4d3c5265cd378dc120fbfc38c450617ca36ef5e9db882b6caac0db8db24a6b4
SHA512854e7cc71f304d736157adce5692192d64ad38886489fd119dbad14b39949132b93559bd30d65c5218e05bdcbd68deb98678330867374ad97d70dfbc12ab5f19
-
Filesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
Filesize
257B
MD5e85dd6e6662e47a261700edbe814ae33
SHA191ad49fe616d6842d0d293c7015001de8c8c8df4
SHA256da66ff7393dd55c31bcb828e701c18e321b0052c94c73a0ce9db9ef80de042d8
SHA5121a5e224672e809b4714cad2ae94aca7faf6c4c3d5b38d043bfbc269ba9b8cc4248949c6e4a74b7cd14c21b0bd66813f66122e2e66db404b7c62dd06b8ccab528
-
Filesize
357KB
MD56d76e1ada029aace36df893fb5b2166f
SHA13a3efa4aa0bbc534213e459778ba54a578f6a916
SHA2568977f8b2765877a23ff0be05b7d330d9276a18636757902fc567f37b0071b448
SHA5124d5243deb6a62dccc4ed99debd0737db4418104e48b73d414f6b6ad8155d3532193a0a782b766b387cf78b9a08fe4842cb1bf8324b517dc3cff30318bd243493
-
Filesize
100KB
MD5112e0f6106b8137595f37a5d7a548fb1
SHA125df0ffe4cd1f37c350f510f5f7d701a19762ae8
SHA25626d3c39534aad4557773c92786815eb6fe603df7536d6d1e4c1021ee36a52d20
SHA512295d1357f27eb54e013b79ce9e543517f2fb04fcb227d0aa14b0b8b937732facc303f99bed2fee789714fe06d6ea31b5ead12ee2eeeeb6e70c5104824f41bdf3