Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe
-
Size
58KB
-
MD5
ddea291496e6fe6bb2739c666ea1876f
-
SHA1
47e323dd16280e1ade512094c82ef33210342475
-
SHA256
44244177bebc0306e23721806059a64989be421960744c800693c99cb02b82c5
-
SHA512
c4895a63a80f642a4cc6ca164ed755d6a77f55db29502959ff89a2170e36faafc12b2f8bef4516b9e16197aeea739dcb18ceca00a7a2d66383604dfb6e269338
-
SSDEEP
768:MdICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnj:MTYd5QJc/vaSybs4
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 1 IoCs
pid Process 4172 wmimgmt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: wmimgmt.exe -
pid Process 3428 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1104 tasklist.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chcp.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmimgmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARP.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUTE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 2824 NETSTAT.EXE -
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 2232 net.exe -
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
pid Process 2824 NETSTAT.EXE 3140 NETSTAT.EXE 4980 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1716 systeminfo.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeBackupPrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeBackupPrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeRestorePrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeBackupPrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeRestorePrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeBackupPrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeRestorePrivilege 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe Token: SeDebugPrivilege 1104 tasklist.exe Token: SeDebugPrivilege 2824 NETSTAT.EXE Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeRestorePrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe Token: SeBackupPrivilege 4172 wmimgmt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 4172 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe 83 PID 4036 wrote to memory of 4172 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe 83 PID 4036 wrote to memory of 4172 4036 ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe 83 PID 4172 wrote to memory of 3568 4172 wmimgmt.exe 90 PID 4172 wrote to memory of 3568 4172 wmimgmt.exe 90 PID 4172 wrote to memory of 3568 4172 wmimgmt.exe 90 PID 3568 wrote to memory of 1736 3568 cmd.exe 92 PID 3568 wrote to memory of 1736 3568 cmd.exe 92 PID 3568 wrote to memory of 1736 3568 cmd.exe 92 PID 3568 wrote to memory of 740 3568 cmd.exe 93 PID 3568 wrote to memory of 740 3568 cmd.exe 93 PID 3568 wrote to memory of 740 3568 cmd.exe 93 PID 3568 wrote to memory of 1408 3568 cmd.exe 94 PID 3568 wrote to memory of 1408 3568 cmd.exe 94 PID 3568 wrote to memory of 1408 3568 cmd.exe 94 PID 1408 wrote to memory of 876 1408 net.exe 95 PID 1408 wrote to memory of 876 1408 net.exe 95 PID 1408 wrote to memory of 876 1408 net.exe 95 PID 3568 wrote to memory of 4960 3568 cmd.exe 96 PID 3568 wrote to memory of 4960 3568 cmd.exe 96 PID 3568 wrote to memory of 4960 3568 cmd.exe 96 PID 4960 wrote to memory of 4760 4960 net.exe 97 PID 4960 wrote to memory of 4760 4960 net.exe 97 PID 4960 wrote to memory of 4760 4960 net.exe 97 PID 3568 wrote to memory of 1104 3568 cmd.exe 98 PID 3568 wrote to memory of 1104 3568 cmd.exe 98 PID 3568 wrote to memory of 1104 3568 cmd.exe 98 PID 3568 wrote to memory of 1716 3568 cmd.exe 101 PID 3568 wrote to memory of 1716 3568 cmd.exe 101 PID 3568 wrote to memory of 1716 3568 cmd.exe 101 PID 3568 wrote to memory of 2156 3568 cmd.exe 104 PID 3568 wrote to memory of 2156 3568 cmd.exe 104 PID 3568 wrote to memory of 2156 3568 cmd.exe 104 PID 3568 wrote to memory of 1868 3568 cmd.exe 105 PID 3568 wrote to memory of 1868 3568 cmd.exe 105 PID 3568 wrote to memory of 1868 3568 cmd.exe 105 PID 3568 wrote to memory of 4280 3568 cmd.exe 106 PID 3568 wrote to memory of 4280 3568 cmd.exe 106 PID 3568 wrote to memory of 4280 3568 cmd.exe 106 PID 3568 wrote to memory of 3596 3568 cmd.exe 107 PID 3568 wrote to memory of 3596 3568 cmd.exe 107 PID 3568 wrote to memory of 3596 3568 cmd.exe 107 PID 3568 wrote to memory of 936 3568 cmd.exe 108 PID 3568 wrote to memory of 936 3568 cmd.exe 108 PID 3568 wrote to memory of 936 3568 cmd.exe 108 PID 3568 wrote to memory of 5036 3568 cmd.exe 109 PID 3568 wrote to memory of 5036 3568 cmd.exe 109 PID 3568 wrote to memory of 5036 3568 cmd.exe 109 PID 3568 wrote to memory of 4028 3568 cmd.exe 110 PID 3568 wrote to memory of 4028 3568 cmd.exe 110 PID 3568 wrote to memory of 4028 3568 cmd.exe 110 PID 3568 wrote to memory of 3556 3568 cmd.exe 111 PID 3568 wrote to memory of 3556 3568 cmd.exe 111 PID 3568 wrote to memory of 3556 3568 cmd.exe 111 PID 3568 wrote to memory of 1532 3568 cmd.exe 112 PID 3568 wrote to memory of 1532 3568 cmd.exe 112 PID 3568 wrote to memory of 1532 3568 cmd.exe 112 PID 3568 wrote to memory of 4980 3568 cmd.exe 113 PID 3568 wrote to memory of 4980 3568 cmd.exe 113 PID 3568 wrote to memory of 4980 3568 cmd.exe 113 PID 3568 wrote to memory of 2824 3568 cmd.exe 114 PID 3568 wrote to memory of 2824 3568 cmd.exe 114 PID 3568 wrote to memory of 2824 3568 cmd.exe 114 PID 3568 wrote to memory of 3428 3568 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ddea291496e6fe6bb2739c666ea1876f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\ProgramData\Application Data\wmimgmt.exe"C:\ProgramData\Application Data\wmimgmt.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\findstr.exefindstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt4⤵
- System Location Discovery: System Language Discovery
PID:1736
-
-
C:\Windows\SysWOW64\chcp.comchcp4⤵
- System Location Discovery: System Language Discovery
PID:740
-
-
C:\Windows\SysWOW64\net.exenet user4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user5⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup administrators4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators5⤵
- System Location Discovery: System Language Discovery
PID:4760
-
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:1716
-
-
C:\Windows\SysWOW64\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"4⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Windows\SysWOW64\find.exefind "REG_"4⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office4⤵
- System Location Discovery: System Language Discovery
PID:4280
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:3596
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:5036
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:3556
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo4⤵
- System Location Discovery: System Language Discovery
PID:1532
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:4980
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano4⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SysWOW64\ARP.EXEarp -a4⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:3428
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -r4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print5⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\ROUTE.EXEC:\Windows\system32\route.exe print6⤵
- System Location Discovery: System Language Discovery
PID:1268
-
-
-
-
C:\Windows\SysWOW64\net.exenet start4⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start5⤵
- System Location Discovery: System Language Discovery
PID:760
-
-
-
C:\Windows\SysWOW64\net.exenet use4⤵
- System Location Discovery: System Language Discovery
PID:3264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo n"4⤵
- System Location Discovery: System Language Discovery
PID:4356
-
-
C:\Windows\SysWOW64\net.exenet share4⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share5⤵
- System Location Discovery: System Language Discovery
PID:452
-
-
-
C:\Windows\SysWOW64\net.exenet view /domain4⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
PID:2232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:1512
-
-
C:\Windows\SysWOW64\find.exefind /i /v "------"4⤵
- System Location Discovery: System Language Discovery
PID:4056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Windows\SysWOW64\find.exefind /i /v "domain"4⤵
- System Location Discovery: System Language Discovery
PID:2404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Windows\SysWOW64\find.exefind /i /v "¬A╛╣"4⤵
- System Location Discovery: System Language Discovery
PID:3680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:4004
-
-
C:\Windows\SysWOW64\find.exefind /i /v "░⌡ªµª¿"4⤵
- System Location Discovery: System Language Discovery
PID:1464
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "4⤵
- System Location Discovery: System Language Discovery
PID:3548
-
-
C:\Windows\SysWOW64\find.exefind /i /v "├ⁿ┴ε"4⤵
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "4⤵
- System Location Discovery: System Language Discovery
PID:5048
-
-
C:\Windows\SysWOW64\find.exefind /i /v "completed successfully"4⤵
- System Location Discovery: System Language Discovery
PID:3468
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5ddea291496e6fe6bb2739c666ea1876f
SHA147e323dd16280e1ade512094c82ef33210342475
SHA25644244177bebc0306e23721806059a64989be421960744c800693c99cb02b82c5
SHA512c4895a63a80f642a4cc6ca164ed755d6a77f55db29502959ff89a2170e36faafc12b2f8bef4516b9e16197aeea739dcb18ceca00a7a2d66383604dfb6e269338
-
Filesize
43B
MD59f6b9a6e9ceeb82c1b7f4542328d764a
SHA18f1b3a6cf28b9a8dc9eeff98e065b9b467d4d846
SHA2565d3ae9823ebee16a6508452c045dcfeda36bbdc17c52439ada72afb5396ff793
SHA512a0e6985b5e9fcad2197ffa232bc97ed4c00759793aa94490eb33ff68fba511d4e89e3e18bfc31604e5cd01cce1e71e806ae8ac34ce794d49727de551fa5180d7
-
Filesize
12KB
MD5c81c2ce00a81492acec3303258893c60
SHA1389dd2fedc2af6c70573e015f7cf539a137c95fe
SHA256ebeda5bd003643e00cbba317c4951b53525655b2f5fce10757791e6e4e6443a0
SHA512d210fd604647dc077765d913407799ecf6d2484b41a3a526fa5222e90d4ff81b94233aff765000ca2568bc74b7e91238555c70df52ea70d8cab1e809e9efd657
-
Filesize
21KB
MD59301cf23f61c4f945abb08858daa60e7
SHA11e81d87fca539edb9f9ce75a2c7436cfa9e34fb7
SHA2560a43e2af23753f99f7d006f15915109b8f3a03e6467b938c6fafb7155d3e2795
SHA51203ba617add76b9ff38290d04709132df64be07b53f4a99bf3063fd7564b039fd45e20cfe5edec47d5597021fd96f36333dd0ae51d38c208e46ccde85cf4de037
-
Filesize
37.5MB
MD587e45b6c0eb20e3f829df7a7fe0506db
SHA146d5f39f77872ecb944e90fd6706152d6b015c5d
SHA256af77fdf1d4e54f32d12e3f9e0902b6c0ef1f017a5ace713db090e32cc65b9f5a
SHA512f8fd42f6f0fe713cc6110bf463b3549be9440bb8478e1f60a211806250bc315f3904fee7cd5e778a1f85f4bd5c93b675260020cf1e3070567c70fde7eeb5804a
-
Filesize
15B
MD54ff8e80638f36abd8fb131c19425317b
SHA1358665afaf5f88dfebcdb7c56e963693c520c136
SHA2566b8ceb900443f4924efd3187693038965ad7edb488879305489aa72d78f69626
SHA512d4e6e3d789bc76102c500b46a5aa799c5ebfc432a44117aa0b7c7512439d33a423630b963fb04cda1da17a7f6517b276a3e9298c17cbf795964090f4b9e5d8f1
-
Filesize
3KB
MD5b98e8fcde49a1caee295a6bd3d264e56
SHA171c82391a8617212ad48c8d79755e71be2e20be9
SHA256e369c7e2e7ac0280882693038b213be0309c910df62f35a5159a125ecd18fb9a
SHA512fb5fa414449e7dd4ce1fedcb92487f59ed18d7fbd3146eb59ec8f7256d68551adebb7d35e859fe7b6bce5a0b042b0de1e9ee56369a8686976dd121b44ff46742