Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe
-
Size
658KB
-
MD5
c0bfd5815314d93f01b02766f3aa6e78
-
SHA1
22eb36e422de7d29ca7e573400216395f5a17c5b
-
SHA256
7e92f6b7fc73b2cae02badc9be25643d0e4f2b1599d9b27d6af3cbabdfa70beb
-
SHA512
bd93548be44d75ee1ae5391d94619a7051ddcf17e00ccd96b72c5ca88e5988321f96320ad48b8d32bcd1718c140ce24e3854c673258c6a30b55ac21129b9b943
-
SSDEEP
12288:aalFG/FRwYkK19iOCr+TMoO30mYn0YaAsGpQ33M5DKTrH5fzQ2O:VFGQK19iOCr+TMoO30mYn0YaAsl33M5J
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Parameters\ServiceDll = "C:\\Windows\\system32\\e57950c.dll" c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe -
Loads dropped DLL 31 IoCs
pid Process 2044 c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe 1332 svchost.exe 2176 svchost.exe 1568 svchost.exe 3376 svchost.exe 2196 svchost.exe 4844 svchost.exe 2960 svchost.exe 2292 svchost.exe 4400 svchost.exe 1808 svchost.exe 4852 svchost.exe 2044 svchost.exe 1596 svchost.exe 3672 svchost.exe 5012 svchost.exe 628 svchost.exe 212 svchost.exe 2816 svchost.exe 3416 svchost.exe 876 svchost.exe 1408 svchost.exe 1032 svchost.exe 2880 svchost.exe 1828 svchost.exe 1836 svchost.exe 60 svchost.exe 3680 svchost.exe 4776 svchost.exe 4508 svchost.exe 3528 svchost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File created C:\Windows\SysWOW64\e57950c.dll c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe File opened for modification C:\Windows\SysWOW64\svchost.RPT svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2044 c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1032 2044 c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe 85 PID 2044 wrote to memory of 1032 2044 c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe 85 PID 2044 wrote to memory of 1032 2044 c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0bfd5815314d93f01b02766f3aa6e78_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\C0BFD5~1.EXE" > nul2⤵
- System Location Discovery: System Language Discovery
PID:1032
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1332
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2176
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1568
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3376
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2196
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4844
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2960
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2292
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4400
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1808
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4852
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2044
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1596
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3672
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5012
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:628
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:212
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2816
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3416
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:876
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1408
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1032
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2880
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1828
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1836
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:60
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3680
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4776
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4508
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ".Net CLR"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610KB
MD50c7cfa4e36282038dda77ebe9271dd2a
SHA18f8b0b30c8e74bd2f3e9d1c557af71fb5d270ae6
SHA256a76d80d2f85f17ad9549f6a403a267f0d7f57682a13188b8ee3bc40d5b405540
SHA512bc9d49bebb17d9778c9cc507666d1dccc6c10ad8cafbfb88ce3ce32c689717d16d3cab5c115d8f46133869c7e4d6870274fbfcd385bad93f2884ca6b8ed834c9
-
Filesize
4KB
MD50ae5309f93da978093b0e98cd777cd20
SHA154256923111c734659bedcc8f9ef8be65f7d36c4
SHA25636c9e132d2435409bc5c231783c9ef9e952fd4ca0e815f38bd27fe927f785201
SHA5123fe7dadbe8a4fbdc99b3ff99cbe0a87f2186aae0be7f4dde3d58e654e85eb235d38077b23b7d1b661ab236120485970f685b27a345e49cdb507634ad7435db70
-
Filesize
6KB
MD54d08dfedfe3fd2b5cc56ec3fdbc3dcc0
SHA107a9a55b9c3814aa1de64921e484b0d89f3f63be
SHA2566ba51b341cba214b57cbd4722fff2a07b3282fc284d1a0dac6da8d63c7c8194c
SHA512d84c8faf4ac7038df68927826e7ebccfa8f2404c44386c415908fbc09d176c6dc7d0385b9ac68a41bc0c20d5443c4ba122b8e2078e9a0f301c0bede35c5ec967
-
Filesize
8KB
MD51ebf9a20d5c018ac230ac5641f5428b2
SHA15549ec8e7bacb8a8349b27160696f78e6b3602b1
SHA2566c8aff94123703f0152bc0d551af270353eb79961dd15c7a0246b49b36a0ecfc
SHA5123122a3707683acd5882c4011943788682d7175a0a572a276962c3f12fdb5d2e797ba0e794b2c402f0ccacc6320b21e22f265d822a0c449800a270803920abf0a
-
Filesize
10KB
MD5e290719a7879e4e894aedfa4adfd7a34
SHA1e2ff8aaa4d68eda8466a49b1aab69b151236da28
SHA2568bde2e5597d7af4bec078c4305a69366d104a6b29a2b7a9f65daec7f8ddf11b0
SHA51211652f00d14044c771f715fd86685f42353da95b89ae40a388270aa7d3c037c6202a3c2531a955dc6550a52fad0e90e5fd7e56f58ded727216a1bf9ba7caa94a
-
Filesize
12KB
MD583f25fa5808f1dca94d44c6345c10c3c
SHA18c1a8f0cbfe548a5a137bf73146768cee019c474
SHA256bebee5480fac424368c12e819f8ebd61a87814f32f6f47947c5db2acec782a14
SHA512af199552444e2190375f9220753d8cb4f458318f9424f34a18669061256c36e343be40823ea25a1dbd536e87e59eb583e529946d9c9dcdaa3ad5b367a942b011
-
Filesize
12KB
MD58c6766c3ef085360058756eaed41a357
SHA132b2c6eef46404f0f1203203c4f8f390d6459189
SHA2565d5147d25f0bb4bb132b2e93095a9be5dfc7b38e0b3b431bd26e21bfd204fed9
SHA5124be339fa3904d19ca90529b03f17b30158d8a995f44bebbd07d894bacae0f11b7ae0f3b7a838bb916585fe364d564a93e00fae1cf83d5b014e7d3b74f3e42bc2
-
Filesize
14KB
MD5d75c23735f6dbd424d8e873110037a22
SHA16f05ab59669f0cde6460ebd44593de6bd41ccb25
SHA25677fa0eb3e5c901bc116e23bb1559d1c946413068b75cbe3e6762a6a9f939e3f9
SHA51270b4a8abd7e338f556a87ef5cf6cc97a00269489bf60b3fc18c2d1e3fd2ff4bf68a2a5838741ae3899300ba3d7bd1f0533a92171cbe35b72841336d210e5171a
-
Filesize
16KB
MD5170009df6ae4844c08458d2ece8e3797
SHA1be498ecf1809c0a109bd897875d76956a07ebf60
SHA256561e25a99119e6a83e810d210456f4d0d14fbe364f8dd163b8bcc033b295e709
SHA51215011b2b511cec70c5db3cfd65738266fdea905aa725f587376abab6000f1ae8b544d8a491fc13cfe5f60a4ee939ce01b8f8b34e79b81dbdb35d61c72c34d452
-
Filesize
18KB
MD52ba8f28ddfae1869e6b5bbb620d272a0
SHA1afe7d1068113b4adabc46539ae74414373652ef5
SHA25620b4b67f04c2014407fd7b24c77ac6439e594f14ee2b530343899e70de3db60d
SHA51260e375979c142c87eaa16b25501322ddb492309d1b5b6a3a6a72c232454bf3d115750e68e481d071a2bbd86b9d4f905db62acf9d08df265ddd7b4cd2c7e0fd20
-
Filesize
20KB
MD5fe77eff05a8d3a4643b391b07137967f
SHA179c64123331ed26194c1ded0722b3787de44f72c
SHA2561a6d4162594f3ffac5459a5018b614c80aa869d34dfaba7c67f1c58d68ca30a6
SHA512926b2bf0cf4efec22e1bda5f02633ce71d0201089a0a2ea9320115f58036ed2548c478502354bcf39d8e162671f5c4d0a75520c6748a2a9645636e0603930264
-
Filesize
22KB
MD590177bc3537b5c552dbf63b5f932200e
SHA1043d04289ca7f19bc13fd5a3f1f07cae0e81d35d
SHA256523f30c53c3544f4a3f89a0249af823d21252a1a837457dcc740100ed6c98287
SHA512cf0b7ebc8d1810f75e603ff6b6237210f98e1a2264dab21b82338c7e776a102bf9e6d8989853df240d09bf46c9281bd96cd00856477b7b9c49bd64486ab5a289
-
Filesize
24KB
MD57efe4a917efde02670473e1528af5bef
SHA117037c2f6037309c7004089193fece40ddf2c131
SHA256ef4079f8ceb26b8308fb8e8690d47803f875ceae900322024d502b7371b123b0
SHA5123732500efa1b315f6613cbb0887a6c31dd449da1d0fdcfafec41c0a0d29186fc5ac3906ec356b2f5d98437e306c425ee55e5a5f66a21251e6b0d618c9acababc
-
Filesize
26KB
MD57c0593b725996d76c5ac82460cbe028c
SHA1e304b6ea47a26bed23bdae83b892a24e9d055b17
SHA256457f06290f72265171d84a199e81689610dc603d01a5c7984194504aed3d1a63
SHA5123538d3720765f3320da2bac3ab3bbe971951b1698f80b38b893f1716c402bc408fa2c74be8a1cf14d68659b40803eb888de57c52f5f29221ee1f5aa18876b77b
-
Filesize
29KB
MD5d24133e71a17772414046dfd02191655
SHA1327fc5fcaeaf1c32b56ffa0ee362335dad25eab0
SHA2566549ebe1c8412362b1d0ab0bdd3e6e6bbf6d0279592dfc207b7facb7ef6c02ee
SHA5122580089fe6d684a8de3a5a5241fb7c4c5af6e3b42dbd01be83e578f215c21b6844c10505423e963ca8b98849dda6d297f0da27e24925a1edd5d6da8e2e64eeab
-
Filesize
31KB
MD5bc427700a84858aad46a804587f2445f
SHA1a2ed1180e340d4c25d01953631fe60857e73d363
SHA256e828e34ff94ea3d6098febfa6e5ac439f9dfc2fbc248b4b116053c4de1c888d7
SHA512d7a0749ab6891ed51c8dc78ac91e911f4b87fa79f07580c85c6f9a13d2cddc097a7718c85c952d017b70e35f8fa77e1b3bf17d2e8654bdecc829af28c39cd4ee
-
Filesize
33KB
MD596b0546c444ee861415503aa3dd127f1
SHA1bfe61651f53262779c6f25ce0b8d2939f07bf141
SHA2563ef85d7af89629f28390c2b65ebcee669ed10d036ed0fc89b9688e340f6a6239
SHA51223fd9a0d0b3541dded17a97279d8b1979dbce20ca598efb363b7511f596810ffa1ed600b8eea2dc314008450ad2b5c058d9016be150526ec16ad33765f7bfd08
-
Filesize
35KB
MD561d89626a5701d1837f631358b7c1b53
SHA148fe3815986fc6e196941628e97da4c9bf30008d
SHA2567ec8af74f2d59662e8144a580581967a1187768ed50764390107847a534b6fa6
SHA512eac79781386115caea3d1015f1d67cd14aa450036609e64a690dbf7518293b2257af511d2258d139dfbd4cc49605600a6a45e1725cbe9af9bb6bb7535a812a02
-
Filesize
37KB
MD5fb36ea9a8703968f78cff25050791960
SHA15fb392831affd06437ceaac86164fe62bf85e0ab
SHA256f9a4fe05e209cbb4d605ca2080e6247267d4dab6b5d04f58aff30381f0e4f30c
SHA512c8fbd0f1817474ecbb357170334c60e7d6a79bd7e40a3696a81385c955aa7467447664c43124c11fa91f1881aeef6f2fba4fb03dd6aabdf3f2249fc265a951f4
-
Filesize
39KB
MD52a4ca828b03e5bcc4cd8f05aedac9a45
SHA19856e6c120aa3d67d3d047105ca1b9bd47d884b1
SHA256cc3d46a234611ad8987c1ab2554c42bd98137c1eca34ade5bf13642238945c5a
SHA51252f140ad49a28f25a43d84cd07493d87d5e78e21b999819b5a92c3134917efc8e03ff85de432f0e179575b0c454232ca4d6df12305c23a0b802f569820fbec70
-
Filesize
41KB
MD5cfbf9be812e03499373da926ccc8124d
SHA13a0e3b4d18be64ffd198c8a577adf699f6ce4336
SHA25614b2c2b64352b68a1eb072b2fd493f864017352b8953eb58d4553d79771ab8fa
SHA512bfb88b54390fea2261dda7dd16ace97b57878ebce1cf4d24774477573a632024b47e62a38005a7da6196309143556bb99868691ce512eb4006d6eee028b15b0c
-
Filesize
43KB
MD503f36be659381512a5917acb6490d40e
SHA194709c5dbe338cd6a6b360af001080797d558bd3
SHA256c185b0120894d48037e9c9f8c5b98274aca1d80ce3765e5c726026346726cf73
SHA512ac3e9158b77fef6b6c9ccdad30f77f8984009e4fa1b5addb25f8cc4bbf39aa023e7ab9dee29edb8f32899434746657fb871523b4fac531ecf290a65255155441
-
Filesize
45KB
MD54aafc5d138c3d6b0bddd0b58cce4d3ad
SHA1f60533b0001f78664cfcf1ea824145ca189d39dc
SHA256180479fae6f89820726ad91758888a2fad860b930551297a548d7e0202b18704
SHA5126fe6e5600284fbf38caba2a1957d9db0ec55fb5c964b6c63f717c2c67a26c1ef79e5d69cd42fa4fe062e2939b1aa10d1f740fe228af1d33bfdefdd19ed7ccd18
-
Filesize
48KB
MD529cb24f834cb7e17450d78f3abe9fef3
SHA14db6b50dd20f33e4403d3d2e3f5b39a5f2541923
SHA2568f4f644077b8d70d48af3a4d4b63f0c568a426f4ac66350f0c11da7dc08d26bb
SHA512e56cb94776e2a035ac45c0367183d5123a80e25eca81e7eabe29ce426d00e956fad10e6ae143d8b42698dcfa939fdaca15b8acebf177972d872c2690efe73937
-
Filesize
49KB
MD52785be72ea4b40f58c2f97a72853656f
SHA18a1ec9d40e671f2cddec34582d2c14eabcead6cc
SHA256fb40eeeca16027ae74fdeca6316d729a6448aa173a3881e43db13c96e70db73c
SHA5124ab60bb33a7cf549b90f41c6a0ee06111585c741f727777a93d022615eba6941875f2cd65610bc77e2cd12527908ce46dc3ed8c89a1546aa4fbd74fe84dfda0b
-
Filesize
51KB
MD59e6fdcd106f7ffbcca14c4a7214c3c79
SHA1e47b230853b7b60a8e3ece19fa36f024cbd11bf1
SHA2568ef00658eece2280360ea775bce62714449fe46cdc69e4326b71d78f780c3ba5
SHA5129f0b3a029ce27eecec9f818033613d77278b52051373376fe167ad5b96812e03c60aa813975d2cb5d0e62a03aae0095506aeb73cb36d4603eb460613f55ed461
-
Filesize
53KB
MD5c38ae4171eec50f5769e86dd4f4d5613
SHA14ea90af1acdba0c18d6b4bde79abd336236bebce
SHA256fa14fe09d73dfc2130c471d0d9be1e529c3c292e611bdc9bfab68dfea156de28
SHA51258937bd665a7ce2cf2a10e845f33c5f1860159ad02cc00039584edd529ff91763ea8faa78a2cfd8237fb5644ed1fa8d8bda37be6535110a409792f37ca279c6d
-
Filesize
55KB
MD5bfc5cbd7a9b0fa47ed474ec47176aa6b
SHA103f032aa28109e31674c653b030ffafd78baf119
SHA2566847c8f9658d992587bcd2e187e5ac61309f6b6013e9968ed19f0e4a67022e62
SHA51277939fd4039226a8ad720d5ac77a3c2bcb7d80690b7b16fe7e52ac54c775305e5a5794d563b6f6d41313bf96d5ba3064bfc7e369ca7b6b843caed4c745a12a2a
-
Filesize
2KB
MD5b87463c85857b52cdf4a446302d92dbd
SHA1136dd985b8834b150535460464d1326acb8f67da
SHA2569217ece9875e278ae0051df324662231c344bdad2010abe4e0bc8cefe1831562
SHA512bc7e72b47f2a50d6e21075006df2433348b3f90d32be4079cc7746885d4d2b1cefc1b38074fd7d779414fef5337f4ab1f7299b7f6e611ea1aa247b14391da953
-
Filesize
57KB
MD5672a4a16db21a323ad27e19d1b87569c
SHA1925c5dfdcba47d2c20281a43e189cfbe231215d0
SHA2569acfb6d548c015d26201fba2b171ea93d2e8f29bf0d7d4943c476ad67ed2e59f
SHA51283c6e94258f0e6304a3c4b71f6fc929b340663dc5911c66702e12d63752f44d342876a9e056cf2cebce6895a6a30ac86577eec838cc9f3eb04412deccf39b900
-
Filesize
60KB
MD507917629182b74d86740472f0aff0148
SHA1ca1f4fc1e1abb4dfed52f4e0aeefcb22e35c9865
SHA256d6cca9f83effcba76472ec72b254682a963647b491090ff3951fb333a07af4c3
SHA5128761362e5e25fe57dc975d5c8aa047e30f8249d5013326f2bfc3deef4e0b52d23248d3a165b914097b33bab78c6d8747081295f7e60791b8a270e6ef712bf00d