Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
-
Size
881KB
-
MD5
dc7995dba8cf2cbaee063c4a1b54a058
-
SHA1
de07f4dd4bb61cea6f058addaa0b6ad922e1790b
-
SHA256
c42c871cd29b62344d701a854d15b370e7987d7daad60a8574d4e6b5a5636678
-
SHA512
bb2242fce06e808b7547fc27bf2459c7f0d2e1c3b64c2c20110ef9da093945622697cb2c9496ffe9760c4fa42ced6f9238992bab997a7acdcc78348f9655b9f8
-
SSDEEP
12288:wu+c+R2Swz+EHJh8LlWDoLaMVR3obhwxDzKQUwSIHvHq+luKwyB:r+gSe7h8LnXJo9iDzKBwSIy+lgyB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3476 powershell.exe 3476 powershell.exe 3432 powershell.exe 3432 powershell.exe 1620 powershell.exe 1620 powershell.exe 2084 powershell.exe 2084 powershell.exe 1264 powershell.exe 1264 powershell.exe 5100 powershell.exe 5100 powershell.exe 1520 powershell.exe 1520 powershell.exe 2652 powershell.exe 2652 powershell.exe 2788 powershell.exe 2788 powershell.exe 3012 powershell.exe 3012 powershell.exe 4920 powershell.exe 4920 powershell.exe 2280 powershell.exe 2280 powershell.exe 1004 powershell.exe 1004 powershell.exe 4520 powershell.exe 4520 powershell.exe 3260 powershell.exe 3260 powershell.exe 3976 powershell.exe 3976 powershell.exe 3716 powershell.exe 3716 powershell.exe 3732 powershell.exe 3732 powershell.exe 1224 powershell.exe 1224 powershell.exe 2488 powershell.exe 2488 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3476 powershell.exe Token: SeIncreaseQuotaPrivilege 3476 powershell.exe Token: SeSecurityPrivilege 3476 powershell.exe Token: SeTakeOwnershipPrivilege 3476 powershell.exe Token: SeLoadDriverPrivilege 3476 powershell.exe Token: SeSystemProfilePrivilege 3476 powershell.exe Token: SeSystemtimePrivilege 3476 powershell.exe Token: SeProfSingleProcessPrivilege 3476 powershell.exe Token: SeIncBasePriorityPrivilege 3476 powershell.exe Token: SeCreatePagefilePrivilege 3476 powershell.exe Token: SeBackupPrivilege 3476 powershell.exe Token: SeRestorePrivilege 3476 powershell.exe Token: SeShutdownPrivilege 3476 powershell.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeSystemEnvironmentPrivilege 3476 powershell.exe Token: SeRemoteShutdownPrivilege 3476 powershell.exe Token: SeUndockPrivilege 3476 powershell.exe Token: SeManageVolumePrivilege 3476 powershell.exe Token: 33 3476 powershell.exe Token: 34 3476 powershell.exe Token: 35 3476 powershell.exe Token: 36 3476 powershell.exe Token: SeIncreaseQuotaPrivilege 3476 powershell.exe Token: SeSecurityPrivilege 3476 powershell.exe Token: SeTakeOwnershipPrivilege 3476 powershell.exe Token: SeLoadDriverPrivilege 3476 powershell.exe Token: SeSystemProfilePrivilege 3476 powershell.exe Token: SeSystemtimePrivilege 3476 powershell.exe Token: SeProfSingleProcessPrivilege 3476 powershell.exe Token: SeIncBasePriorityPrivilege 3476 powershell.exe Token: SeCreatePagefilePrivilege 3476 powershell.exe Token: SeBackupPrivilege 3476 powershell.exe Token: SeRestorePrivilege 3476 powershell.exe Token: SeShutdownPrivilege 3476 powershell.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeSystemEnvironmentPrivilege 3476 powershell.exe Token: SeRemoteShutdownPrivilege 3476 powershell.exe Token: SeUndockPrivilege 3476 powershell.exe Token: SeManageVolumePrivilege 3476 powershell.exe Token: 33 3476 powershell.exe Token: 34 3476 powershell.exe Token: 35 3476 powershell.exe Token: 36 3476 powershell.exe Token: SeIncreaseQuotaPrivilege 3476 powershell.exe Token: SeSecurityPrivilege 3476 powershell.exe Token: SeTakeOwnershipPrivilege 3476 powershell.exe Token: SeLoadDriverPrivilege 3476 powershell.exe Token: SeSystemProfilePrivilege 3476 powershell.exe Token: SeSystemtimePrivilege 3476 powershell.exe Token: SeProfSingleProcessPrivilege 3476 powershell.exe Token: SeIncBasePriorityPrivilege 3476 powershell.exe Token: SeCreatePagefilePrivilege 3476 powershell.exe Token: SeBackupPrivilege 3476 powershell.exe Token: SeRestorePrivilege 3476 powershell.exe Token: SeShutdownPrivilege 3476 powershell.exe Token: SeDebugPrivilege 3476 powershell.exe Token: SeSystemEnvironmentPrivilege 3476 powershell.exe Token: SeRemoteShutdownPrivilege 3476 powershell.exe Token: SeUndockPrivilege 3476 powershell.exe Token: SeManageVolumePrivilege 3476 powershell.exe Token: 33 3476 powershell.exe Token: 34 3476 powershell.exe Token: 35 3476 powershell.exe Token: 36 3476 powershell.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 4208 wrote to memory of 3476 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 82 PID 4208 wrote to memory of 3476 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 82 PID 4208 wrote to memory of 3476 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 82 PID 4208 wrote to memory of 3432 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 89 PID 4208 wrote to memory of 3432 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 89 PID 4208 wrote to memory of 3432 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 89 PID 4208 wrote to memory of 1620 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 93 PID 4208 wrote to memory of 1620 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 93 PID 4208 wrote to memory of 1620 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 93 PID 4208 wrote to memory of 2084 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 97 PID 4208 wrote to memory of 2084 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 97 PID 4208 wrote to memory of 2084 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 97 PID 4208 wrote to memory of 1264 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 100 PID 4208 wrote to memory of 1264 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 100 PID 4208 wrote to memory of 1264 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 100 PID 4208 wrote to memory of 5100 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 103 PID 4208 wrote to memory of 5100 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 103 PID 4208 wrote to memory of 5100 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 103 PID 4208 wrote to memory of 1520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 105 PID 4208 wrote to memory of 1520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 105 PID 4208 wrote to memory of 1520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 105 PID 4208 wrote to memory of 2652 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 107 PID 4208 wrote to memory of 2652 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 107 PID 4208 wrote to memory of 2652 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 107 PID 4208 wrote to memory of 2788 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 109 PID 4208 wrote to memory of 2788 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 109 PID 4208 wrote to memory of 2788 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 109 PID 4208 wrote to memory of 3012 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 111 PID 4208 wrote to memory of 3012 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 111 PID 4208 wrote to memory of 3012 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 111 PID 4208 wrote to memory of 4920 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 113 PID 4208 wrote to memory of 4920 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 113 PID 4208 wrote to memory of 4920 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 113 PID 4208 wrote to memory of 2280 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 115 PID 4208 wrote to memory of 2280 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 115 PID 4208 wrote to memory of 2280 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 115 PID 4208 wrote to memory of 1004 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 117 PID 4208 wrote to memory of 1004 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 117 PID 4208 wrote to memory of 1004 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 117 PID 4208 wrote to memory of 4520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 119 PID 4208 wrote to memory of 4520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 119 PID 4208 wrote to memory of 4520 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 119 PID 4208 wrote to memory of 3260 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 121 PID 4208 wrote to memory of 3260 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 121 PID 4208 wrote to memory of 3260 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 121 PID 4208 wrote to memory of 3976 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 123 PID 4208 wrote to memory of 3976 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 123 PID 4208 wrote to memory of 3976 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 123 PID 4208 wrote to memory of 3716 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 125 PID 4208 wrote to memory of 3716 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 125 PID 4208 wrote to memory of 3716 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 125 PID 4208 wrote to memory of 3732 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 127 PID 4208 wrote to memory of 3732 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 127 PID 4208 wrote to memory of 3732 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 127 PID 4208 wrote to memory of 1224 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 129 PID 4208 wrote to memory of 1224 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 129 PID 4208 wrote to memory of 1224 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 129 PID 4208 wrote to memory of 2488 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 131 PID 4208 wrote to memory of 2488 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 131 PID 4208 wrote to memory of 2488 4208 dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3432
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2084
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1264
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3012
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4520
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3976
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3732
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1224
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c018e16dd35f28481778200f64d48f7d
SHA11c62dc5094a3c3c1a029a6c364e085f8b394a5f8
SHA2561eca7f2483e92089e119033f7da113033c06f53bd1925eb2029fcbd00cf14425
SHA5122b100699503cb3c9775faf2ccb3f2365fa412eef29e2d8e631e1fa606bd2c5a4652c3dfb929da0d9964fd1ccf123ee81c509a9a45b03028fb045c6ce3f6c19c7
-
Filesize
23KB
MD53124b64293c805065cb7ddc57929637f
SHA1ec9a69d5d1a7f6a1a30c208763685bc3ddf98f74
SHA25693bb72cdf5cf3fd6b5014e85a924b911c00181b30c4935d5a6777e04f112108c
SHA51282df172dc666f5c66c603e3b8021b1967131002760fa81dc6cf53de63e6739a5b51a2d3886481a9b8deae9e2384ce452e5a20c50157a93bef6c8cede4cae0fa5
-
Filesize
23KB
MD578f33494d1b195eb9d13fbd921388bde
SHA138898be0ac4619598adecc5c8ec3a535b56f1158
SHA256e4ff5647acf159934519245f436bf2adaff9c7ccf47b09cfc3c9ae61f61df01f
SHA512ee14e5d10a31d0b2652594849d350e9049cde769dd548c2944e9305f6d4bee5126f450eb92e67a95f5e48ddf8c866630abfbb02398146f88b14ffbe8ca4ac7d5
-
Filesize
23KB
MD5a286e61b0b316a5f7a1567f6f0da1a44
SHA179f8bb3f818289526b4c1b67f8bc7952a096a196
SHA256fd12c55e785c8d1e477c1dce5626c249e158b0c62e3780141da03beab69f3d4c
SHA512b6e4832c1a490b5c352b6aa0a14b9f4ca677734da4df49c801b181aa7e35df60807777c30785b54458099297d02834e1f672ed7d960f6d56ee0d6dbdb5eaad28
-
Filesize
23KB
MD5ed386d05569b8e1cc910d1a55d07690d
SHA1e0b89f27ccbccd9cbd1151a689a2578bb90fc386
SHA256e9eb795ca09df3e981ce922c9ff86c256124b5a393067de2be81126e649bfe88
SHA51218c2d6e92145106bba1e75a8e912d1a7aafd89cc7b90bb797ff4375d82acde4c78524ee33e5b79b398c4347ee7dedfcb27690f11fd81edd85dfc6bf3dc01b600
-
Filesize
23KB
MD507c34aadcff80c69a73d98d1c04a7bc5
SHA1c88fefda530da3853502ddc843f87125a2ddc811
SHA25692ca231257872a5af940201919d53ee99a73f0b40c0e73e0e7cfb471cb7d7a82
SHA51240504e4e5771f753f375f51beebc4e78a8624186e8ce19be7ce4e05d62ff56fc5bdd7daf4338ad2f3809f1a3e177048e227fb29db121c3d9c20a86aaac194834
-
Filesize
23KB
MD52f238205c57c41ccc6f983cb3b8ab54d
SHA11fdb32ac82ef9c1b7a67ad2e92c803aae011d8cf
SHA25656e2722e0591a9395a2fbd452308028116464f995b84f175455e8b3360add80b
SHA512c0f07573008666f3e71676a23f7f378564bd1a08e6bee813982319972ad36785a745e715d85fef8406e1a3d3011dafe9399addf53b4f03bc2c9f73dcf5a379ad
-
Filesize
23KB
MD503876375fd9d1aa675c85e6454bc7a06
SHA1ac3053b021f0592e3e26bac893bb7e45d7ada6e1
SHA25691c0b395931b5ec4c0b37e2394d0267d2675ca6218f1123df93dbfbed24c3a63
SHA5129c9dc559b7da93b68bd2fd0dd4b98564d30b24f281cd2a009cfe0cf9fdfa4fef42b764988105688048c8d7a66295df9a84740d8bf4ffd7147c4a800169068492
-
Filesize
23KB
MD58fd1c512f7cea8f5512a32b8abff7d32
SHA19c793782afe3df2da9d64d56c23f8f02ec913134
SHA256698fa884ca81205e2ea4990eb88def23f926f6b03b7170d3e05a94fa823abc5d
SHA512590c6923f227fa09348f458d6a20c51f045530723f8574ebe13b9290a5d24eae98ecf84febc75eaa529ac843358b34a7b24be65cbf8f091b580b60168a576cef
-
Filesize
23KB
MD577a3405cb0a6e27f64e4c819f4e9dae5
SHA1747b8d942a490e70f73f311a0c8f4144efa92704
SHA2562b4c6b28359f29beca014f99422cebddca6c53b8dd3c770a94484aff4913138b
SHA5129c599084c9fb1465ed56dc0f9c7310b211568e03077ed76f97c15dd6986c8a17fe7affb97c83595a156140eb0d3fc351c5272694f406af61877d6ac5ed103e05
-
Filesize
23KB
MD52e756be5bd28634558c9aef155c9a566
SHA1b83fee875fc295afa8ad79df8dffb20cfe54f1a3
SHA256612aa5cab09c359c8b21540971f817cf55348ce9f7d41e4438d1228f9b08ff5a
SHA512efa908038fdf2be8cfc2a4d43c629b0bdab6a34c0f59410ae7d0f0420bacea9596a29c92ea5e2c6ab162bd656cda8f27c80cdc4ad8f84e60276fef6ca7331395
-
Filesize
23KB
MD511ec69ee976de00f50060396d9a35d83
SHA1871717366929fa8198e6a354a2d1195e01697dfd
SHA256588de42c81cbc41416d6d30b9c7dad40aca3038f7d44abca01ad319ac852f322
SHA51209cf2337bac8c2a2261529bd1a92822b8dc1c3e9a79ac2b3c5928b7b781af68be1a1316f907aad8fdcc26315a79cd3c16e3fbef239f876f046fe4e5ac79736e4
-
Filesize
23KB
MD58452b3adfa872882c2f80a3d4628ff9e
SHA105385daa3b13c8ce22079a85e7452667afe33ad3
SHA25610eb9e9f9a2f17dcca3ed0b31f0b8e0f5156581905222fa05b662ffdc12e0092
SHA512a6978a9faa215ac0f31d58b73b624810568f9a43b96428aae4c5b5783d78f0584e42775e32c8d37c5994d7cb933f86776d802f4c588fadde89f0801081143155
-
Filesize
23KB
MD53bcdc0b551c328241bc8c41dfa94c9e2
SHA1747f97fbdd2c63477f3e59946a28d8c533811310
SHA25692cb36bebb24e7d6e3f26e84516862c003fc78091d145bc00a28bbec24cd108a
SHA51289e8b88bbd1201d7a482d40ea2f33974b64aac64fdd637eb59a87c39440bf135ec893f610e1786975c284958f56180523bd6a5d09eb4030bb1dae3f0c7b2dfb9
-
Filesize
23KB
MD592227f9111b1b4dd2a068c9e732306e7
SHA19d971961bad7765237cec267c9c3eb44131845ec
SHA256260fb806b511a4f8bb3d29381f73ed46bd5685b36747029f1035eed81ad4ac81
SHA5126c0a29356b75c08fe4e8ee5b37d0bc0916523f2956f1a099b0075c3470497c7edb6021a15393edf38d6fe9f042499b2e7fac142834050d380582b31e28c5249b
-
Filesize
23KB
MD58df6762a901d77d440f90232f1fda5ba
SHA1ab2a7486cb1aa6d9e9f20ee1a10cf54cfad6b71c
SHA256111bd398548c74f3e5294275a0a5fd7d73e416c764911b8b8933e0b10aeb322d
SHA5122e079e391dab77900b873543484725aa7554e4c9943da1358e4f8128d899676ca2c2b18b20029897a26e251d12ff28901f6fd28869d2d171318bf59c70778397
-
Filesize
23KB
MD51b6d5be4c8e0f55c317976775e4e0a3b
SHA15094d9dacc1287aa78eb658543ccb16050e0ee34
SHA2567018a9b7602ec6ee0d553818140234530acaf42815a4a532572c4db92a4dd581
SHA512e5bd9de8701daf9a4eb4ff4987e1c54a10e6d796b97f86e0492f49d5bde9fa894d12efdff2439da1db6f3cc6bc002c0be8ed168a954b93a22fb26bc7630d5653
-
Filesize
23KB
MD55b3f16e94f183630bff4777ae6d18ca3
SHA1d91808d4eb182f9b685dd6523467b60a07a0df53
SHA2563aa722fe1be665473c61ed19ce8ca4aa144a0f9ff9c2865e47930e75b50d084e
SHA512afb0c82babe990620d7fc917df97104fef43058a67445b99b82aaf17dc9ac6c517cf24dceeab19b2f0fe0a87396ca314e93ec32cff333a5979a6ed0f9910b896
-
Filesize
23KB
MD518e0e389e10450719bbdcf44563d1510
SHA1ab77cd86907a80272a79032b0b664b56974df8a1
SHA256d244bbbd60785babe8fa5275087149e7ba9e3ebf6e4debd7bb4fa42b4871353d
SHA512c857e0ccdcd12f8c7087530fb698bf912deba2e3e465fe265ecb9f22c8ecd995f93662e9d45b22cc6c59ebc9ba7aa3f319c20b127f91dbd7743d7763ac9784e7
-
Filesize
23KB
MD5a4a1489f9256938fbfe27cf941e7f9e6
SHA13401f5b53c604d941c3f6b059498bd14db3953eb
SHA2565ac4ffe4ea5f209933f0d3670a48f07445da9d2912f84c28f1243478f574d1db
SHA512ac43a72888525c32bfe7429796a7edc12d9e5889468c3db6af0f7036a483ccb249c162de8fb0470b9440ee623d0b400d36e985be50a82501161d8c29f1007f61
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82