Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2025, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe
-
Size
3.8MB
-
MD5
c4d9612605cf4360dc97c6f317ddc1c5
-
SHA1
1c86b6bd379b4f52921600708ed2f42d3f914e0c
-
SHA256
16cac4973e4cd7c600369a024e3336f4eebc89a4174152ce61e6b95dbcc29931
-
SHA512
2a78efcef683b6fb13687a1db9dda6d29db80060c06f0fd88a9ec88e8021a5f83daf1bf637e336a07fef4916318864c024df83eea2431dfe9fd559d9e932aa93
-
SSDEEP
98304:U9jKMZDxwbCpx7e/Jn76OfEdSFFODy8m8qDDwG:GZ6bg7a7dsdS0y8m8oDwG
Malware Config
Signatures
-
Rms family
-
ACProtect 1.3x - 1.4x DLL software 8 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0007000000024270-20.dat acprotect behavioral1/files/0x000700000002427e-23.dat acprotect behavioral1/files/0x000700000002427d-26.dat acprotect behavioral1/files/0x000700000002427a-35.dat acprotect behavioral1/files/0x0007000000024276-44.dat acprotect behavioral1/files/0x0007000000024271-53.dat acprotect behavioral1/files/0x0007000000024272-50.dat acprotect behavioral1/files/0x0007000000024273-62.dat acprotect -
Executes dropped EXE 8 IoCs
pid Process 5496 rutserv.exe 5872 rutserv.exe 3852 rutserv.exe 4436 rutserv.exe 4884 rfusclient.exe 60 rfusclient.exe 4588 2.exe 1412 rfusclient.exe -
Loads dropped DLL 14 IoCs
pid Process 5496 rutserv.exe 5496 rutserv.exe 5872 rutserv.exe 5872 rutserv.exe 3852 rutserv.exe 3852 rutserv.exe 4436 rutserv.exe 4436 rutserv.exe 4884 rfusclient.exe 4884 rfusclient.exe 60 rfusclient.exe 60 rfusclient.exe 1412 rfusclient.exe 1412 rfusclient.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\RWLN.dll rutserv.exe File opened for modification C:\Windows\SysWOW64\RWLN.dll rutserv.exe -
resource yara_rule behavioral1/files/0x0007000000024270-20.dat upx behavioral1/files/0x000700000002427e-23.dat upx behavioral1/files/0x000700000002427d-26.dat upx behavioral1/files/0x000700000002427c-29.dat upx behavioral1/files/0x000700000002427a-35.dat upx behavioral1/files/0x0007000000024279-38.dat upx behavioral1/files/0x0007000000024276-44.dat upx behavioral1/files/0x0007000000024271-53.dat upx behavioral1/files/0x0007000000024272-50.dat upx behavioral1/files/0x000700000002426f-59.dat upx behavioral1/files/0x0007000000024273-62.dat upx behavioral1/memory/5496-73-0x0000000000E00000-0x0000000000E5F000-memory.dmp upx behavioral1/memory/5496-72-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/5496-79-0x0000000000E00000-0x0000000000E5F000-memory.dmp upx behavioral1/memory/5496-80-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/5872-85-0x0000000000B50000-0x0000000000BAF000-memory.dmp upx behavioral1/memory/5872-84-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/5872-87-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/5872-88-0x0000000000B50000-0x0000000000BAF000-memory.dmp upx behavioral1/memory/3852-93-0x0000000000B40000-0x0000000000B9F000-memory.dmp upx behavioral1/memory/3852-92-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/4436-97-0x00000000008F0000-0x000000000094F000-memory.dmp upx behavioral1/memory/60-115-0x00000000008B0000-0x000000000090F000-memory.dmp upx behavioral1/memory/3852-119-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/3852-118-0x0000000000B40000-0x0000000000B9F000-memory.dmp upx behavioral1/memory/60-114-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/4588-123-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4884-113-0x0000000000AA0000-0x0000000000AFF000-memory.dmp upx behavioral1/memory/4884-109-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/4436-127-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/4436-129-0x00000000008F0000-0x000000000094F000-memory.dmp upx behavioral1/memory/4884-132-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/4884-134-0x0000000000AA0000-0x0000000000AFF000-memory.dmp upx behavioral1/memory/60-136-0x00000000008B0000-0x000000000090F000-memory.dmp upx behavioral1/memory/60-135-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/1412-133-0x0000000000820000-0x000000000087F000-memory.dmp upx behavioral1/memory/1412-139-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/1412-140-0x0000000000820000-0x000000000087F000-memory.dmp upx behavioral1/memory/4588-142-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4588-149-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4436-144-0x00000000008F0000-0x000000000094F000-memory.dmp upx behavioral1/memory/4436-143-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/4588-157-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/60-155-0x0000000000400000-0x000000000076B000-memory.dmp upx behavioral1/memory/4588-165-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4588-173-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4588-181-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4588-189-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4436-191-0x0000000000400000-0x00000000007D2000-memory.dmp upx behavioral1/memory/4588-197-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Progra~1\Remote Manipulator System - Server\rversionlib.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\rutserv.exe cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\dsfVorbisEncoder.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\dsfTheoraEncoder.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\HookDrv.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\dsfOggMux.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\rversionlib.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\dsfTheoraEncoder.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\RWLN.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\Russian.lg cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\RIPCServer.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\RIPCServer.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\PushSource.ax cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\2.exe cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\dsfOggMux.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\RWLN.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\rutserv.exe cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\Russian.lg cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\msvcr80.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\Microsoft.VC80.CRT.manifest cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\dsfVorbisEncoder.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\HookDrv.dll cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\msvcr80.dll cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\Microsoft.VC80.CRT.manifest cmd.exe File created C:\Progra~1\Remote Manipulator System - Server\regt.reg cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\regt.reg cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\PushSource.ax cmd.exe File opened for modification C:\Progra~1\Remote Manipulator System - Server\2.exe cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfusclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rutserv.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2964 regedit.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4436 rutserv.exe 4436 rutserv.exe 4436 rutserv.exe 4436 rutserv.exe 4884 rfusclient.exe 4884 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5496 rutserv.exe Token: SeDebugPrivilege 3852 rutserv.exe Token: SeTakeOwnershipPrivilege 4436 rutserv.exe Token: SeTcbPrivilege 4436 rutserv.exe Token: 33 4588 2.exe Token: SeIncBasePriorityPrivilege 4588 2.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3340 wrote to memory of 3492 3340 JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe 86 PID 3340 wrote to memory of 3492 3340 JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe 86 PID 3340 wrote to memory of 3492 3340 JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe 86 PID 3492 wrote to memory of 2964 3492 cmd.exe 89 PID 3492 wrote to memory of 2964 3492 cmd.exe 89 PID 3492 wrote to memory of 2964 3492 cmd.exe 89 PID 3492 wrote to memory of 5496 3492 cmd.exe 90 PID 3492 wrote to memory of 5496 3492 cmd.exe 90 PID 3492 wrote to memory of 5496 3492 cmd.exe 90 PID 3492 wrote to memory of 5872 3492 cmd.exe 91 PID 3492 wrote to memory of 5872 3492 cmd.exe 91 PID 3492 wrote to memory of 5872 3492 cmd.exe 91 PID 3492 wrote to memory of 3852 3492 cmd.exe 92 PID 3492 wrote to memory of 3852 3492 cmd.exe 92 PID 3492 wrote to memory of 3852 3492 cmd.exe 92 PID 4436 wrote to memory of 4884 4436 rutserv.exe 94 PID 4436 wrote to memory of 4884 4436 rutserv.exe 94 PID 4436 wrote to memory of 4884 4436 rutserv.exe 94 PID 4436 wrote to memory of 60 4436 rutserv.exe 95 PID 4436 wrote to memory of 60 4436 rutserv.exe 95 PID 4436 wrote to memory of 60 4436 rutserv.exe 95 PID 3492 wrote to memory of 4588 3492 cmd.exe 96 PID 3492 wrote to memory of 4588 3492 cmd.exe 96 PID 3492 wrote to memory of 4588 3492 cmd.exe 96 PID 4884 wrote to memory of 1412 4884 rfusclient.exe 101 PID 4884 wrote to memory of 1412 4884 rfusclient.exe 101 PID 4884 wrote to memory of 1412 4884 rfusclient.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~7CC1.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c4d9612605cf4360dc97c6f317ddc1c5.exe""2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Progra~1\Remote Manipulator System - Server/regt.reg"3⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:2964
-
-
C:\Progra~1\Remote Manipulator System - Server\rutserv.exe"C:\Progra~1\Remote Manipulator System - Server/rutserv.exe" /silentinstall3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5496
-
-
C:\Progra~1\Remote Manipulator System - Server\rutserv.exe"C:\Progra~1\Remote Manipulator System - Server/rutserv.exe" /firewall3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5872
-
-
C:\Progra~1\Remote Manipulator System - Server\rutserv.exe"C:\Progra~1\Remote Manipulator System - Server/rutserv.exe" /start3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
-
C:\Progra~1\Remote Manipulator System - Server\2.exe"C:\Progra~1\Remote Manipulator System - Server\2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
-
C:\Progra~1\Remote Manipulator System - Server\rutserv.exe"C:\Progra~1\Remote Manipulator System - Server\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe"C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe"C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1412
-
-
-
C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe"C:\Progra~1\Remote Manipulator System - Server\rfusclient.exe" /tray2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:60
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5df191b0814c46f087f0c4c46a669d454
SHA13b89c9f51fa7696e2fcb2704b1277397d321dd1f
SHA256064fba37b36fbe717607b5bfa7745c32a57fd71683e617480de8b5d2aa858717
SHA512c1b468174b388d1585b98c38c207f57da31668e63192bd57828b97ba8e62b76a6444e5e190d59c12f15761228e947bf065d3bab91fc03d672cfc4f7938090959
-
Filesize
56KB
MD5bbd924baef9f49abd2abc06bff2df57a
SHA1bac86077e9da898034af04a444de677c27248fcd
SHA25602003c252982a21d3480a9d0b0f6eda5c70abed13147d960bad480df57edb981
SHA51214de50ff848604602bd25d441dd308ffb9fafbf2fa87aeafc94e92dd563dad2ff4470654e5cf0e01e143b52fc92488d1e7ab4a803435c778cce1b054f43d3ca2
-
Filesize
1KB
MD5d34b3da03c59f38a510eaa8ccc151ec7
SHA141b978588a9902f5e14b2b693973cb210ed900b2
SHA256a50941352cb9d8f7ba6fbf7db5c8af95fb5ab76fc5d60cfd0984e558678908cc
SHA512231a97761d652a0fc133b930abba07d456ba6cd70703a632fd7292f6ee00e50ef28562159e54acc3fc6cc118f766ea3f2f8392579ae31cc9c0c1c0dd761d36f7
-
Filesize
448KB
MD5d7eb741be9c97a6d1063102f0e4ca44d
SHA1bf8bdca7f56ed39fb96141ae9593dec497f4e2c8
SHA2560914ab04bfd258008fec4605c3fa0e23c0d5111b9cfc374cfa4eaa1b4208dff7
SHA512cbcaedf5aca641313ba2708e4be3ea0d18dd63e4543f2c2fdcbd31964a2c01ff42724ec666da24bf7bf7b8faaa5eceae761edf82c71919753d42695c9588e65e
-
Filesize
43KB
MD52bfd175807671afefef2e01783fe23c1
SHA114ef7158aace0ff7680af001ea9e1f237e5c5759
SHA2561f8477f058596a56c86a3427c4351bc03aff0ccea415b8a9f7d568add3ebc138
SHA512d93ade22bd6e0ab9c9e682a2a91957b22e6b61fcef835136b88209da1c1d661befa7fbbaa420efd1e6a10efab7dd2d36235daa60efbc702992a2147329a4854d
-
Filesize
115KB
MD5bef74ba9847cb190d4a3d04867776ccb
SHA143c5af859bfe1433be301f617dc5358d829a5a6e
SHA2562fc28c943aa12fdf2414c3b094990bea80b9c6c8f3ab0bd4ea7bf5f128f10ff7
SHA512f27351ffe6d80d4903d787ee6f737d83896b8089b82c40cb533a266178d26d736d084dca64fa13dff36be72c8b6eb255762eb88f0c00d2d3c2edea4670b57210
-
Filesize
32KB
MD5449b3a734459150913b7b2eb59f51316
SHA148985f309b36af45473b5f381c8d91ee8a28290b
SHA2561d5990207f504d183356913aceccbd1e3f8b55c4918a4ca19ab6e920a721ed5f
SHA512f6745acf57235456604b5d05920f0db69898242626a2629dbcda7061eed6f94441d87a567fde25bdd89abf20c1dcf5cc34a222fbf1771aa1716722de264776ab
-
Filesize
1KB
MD5b52667d499d9dbed23dac069304b6840
SHA16dad39062092c7a0848461bd58705e78e1278523
SHA25689c6308579a63fcbd5251295dd66aa04e5244f307e84baaff3442efab4dd9af0
SHA512e7c4ecbe03b977052045c3974291390c1a66bf1b41e84418fea834d57bc4383575c449ddda3d6e207e6d1a3bfef285a3ffb8040a4a8dccd61f2315161e913bc4
-
Filesize
32KB
MD57a41cd795b23af76c8b0bd308ba5e05d
SHA10d2d0446f1f8f805bf3582d48a1af52611511323
SHA2562219a7fd3f0f476cab1ddfdbe1910f174611a77eda3a577d716466b8dc567227
SHA51282d6b9419e66a8e2095e0e60603f0cd3948b752fc37ade8ff58d2483f164f3ade1463df1780d6fca98089d09c48e05e4dbdb4548d048e4f19f781b84d5ba42d1
-
Filesize
121KB
MD56e8e3aea0d24d51dfa0d31194ed63129
SHA1bf1f37a18ce7c050b528ea5eb3f913de8f85600f
SHA25694871b30d2eac92d01d7823f6b5fae749115394f79bf8e2e7abd489dc13a42f7
SHA512147adaa6716cc0ca17d91675cd73d1e4c299282aefac4095536bb7fd2211004bafd6e398e04c933d266683b1e578d0e1f50143615ac9953eba99a3d55ab03a38
-
Filesize
211KB
MD57432f13b92a542f16b0d08ea192ee1e6
SHA197d21b1c68ec3ad0ca6c567224df74eb63b6f72f
SHA256b7a12d16fe97e8605b7a39336bbb8bf63465cb54107ad4a38996769c209434f7
SHA5121b2d339f6df5fbfaf3e55656400598f6221cdaadfd5705536f8b447f4f68ab70ede3530e0791452487ed37aeb44a7a2799227cc398d71b539948724ba4a4e6d2
-
Filesize
264KB
MD5548e8dc4550f0102dc844269897e08a8
SHA1071fde0b108957cc05c357e68e420fbb6bb14099
SHA25685b49c630b6d57bda300e10e9f99b39f7a8e94d85abe648a257a56e888b9f7d1
SHA5127dbbfc3ebae13791ef88d157d9219d46bd5144689d2279c4d2bc5df8904de1bda32eac917b4dca2b9da1765b903949708edc7e538c950a264bee084a4f7862af
-
Filesize
12KB
MD5880a4eeaec310d7d36e5f2a24eecfdd8
SHA124757146f770bf953063c76f1ea9127d1c321169
SHA2563e0dba04f69ef2043a74b6dd8dfbc465025fdeb210782fa35dac523ffc84f025
SHA51246403dc791352c32a0fabf7c52c879ae87e6a196e158d691d8e93d478403bf3aa4c25f6db491d6a94fc4359ab993c1b6a96989472731ee84598a640c3405a586
-
Filesize
932KB
MD5bcb751e5c84a5a523d2de04764e237da
SHA1d9dfd3b5f4f7231aa189686a05e538ba86d51855
SHA256ac65d29206b2524f9a1cc618ccfc2a6749d5883001ca1d5023f46488b256195f
SHA51271d9eccd6b1d7e2ea7676fd42a8748908c6239e16b7ab3f63b3c516f8e8d2be8eee90cb4b0dfb966b5edf179b14b033e85287bba0a2e4f66cb06a7d1c3e30854
-
Filesize
1.0MB
MD5b27e7b4ec2e399afa25f00991947e0ff
SHA16a9426584a5aca376875f1dedc42ea1e711a3dec
SHA256fd761d45d630b3ddb2e9b287485466afbb4774036d745918eee3bec063028eeb
SHA512a578fe91e57216a276b32d56b0bd619e06e2c6671f71c092cc8904b1c6caadb97577a9ada0624c903dabd6fb444533b9f7c1adb9427df33ce638aacfad29cd05
-
Filesize
113KB
MD5c666557b54f67145124ede6ac593cf6a
SHA167fcdb013314075fe26e2c9eaa23190a9590720f
SHA256e02d4a45dd90b783501f6cb4ac279f8cece0048b7dcf58127e6bfc9c7297051f
SHA5125c37ced671fb3516eb968573090d06a7c3ff687451e99bd624647e6c595656698ec64be47244bf5f31748129e437d20034632c6792827c1d9782a66567d20f37