Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
submitted
14/02/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
build-x64.msi
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
build-x64.msi
Resource
win10v2004-20231215-en
General
-
Target
build-x64.msi
Malware Config
Extracted
darkgate
admin888
prodomainnameeforappru.com
-
anti_analysis
true
-
anti_debug
false
-
anti_vm
false
-
c2_port
443
-
check_disk
false
-
check_ram
false
-
check_xeon
false
-
crypter_au3
false
-
crypter_dll
false
-
crypter_raw_stub
false
-
internal_mutex
WeBiMyRU
-
minimum_disk
50
-
minimum_ram
7000
-
ping_interval
6
-
rootkit
false
-
startup_persistence
true
-
username
admin888
Signatures
-
Darkgate family
-
Detect DarkGate stealer 3 IoCs
resource yara_rule behavioral1/memory/2988-350-0x0000000003820000-0x00000000047F0000-memory.dmp family_darkgate_v6 behavioral1/memory/2988-352-0x0000000004CA0000-0x0000000004FFB000-memory.dmp family_darkgate_v6 behavioral1/memory/2988-355-0x0000000004CA0000-0x0000000004FFB000-memory.dmp family_darkgate_v6 -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2344 ICACLS.EXE 2088 ICACLS.EXE -
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2656 msiexec.exe 5 2656 msiexec.exe 7 364 msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Command and Scripting Interpreter: AutoIT 1 TTPs 1 IoCs
Using AutoIT for possible automate script.
pid Process 2988 Autoit3.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f76a14e.msi msiexec.exe File created C:\Windows\Installer\f76a14f.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA6F8.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f76a14e.msi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\f76a14f.ipi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2040 iTunesHelper.exe 2988 Autoit3.exe -
Loads dropped DLL 3 IoCs
pid Process 2848 MsiExec.exe 2848 MsiExec.exe 2040 iTunesHelper.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2656 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Autoit3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 364 msiexec.exe 364 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 2656 msiexec.exe Token: SeIncreaseQuotaPrivilege 2656 msiexec.exe Token: SeRestorePrivilege 364 msiexec.exe Token: SeTakeOwnershipPrivilege 364 msiexec.exe Token: SeSecurityPrivilege 364 msiexec.exe Token: SeCreateTokenPrivilege 2656 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2656 msiexec.exe Token: SeLockMemoryPrivilege 2656 msiexec.exe Token: SeIncreaseQuotaPrivilege 2656 msiexec.exe Token: SeMachineAccountPrivilege 2656 msiexec.exe Token: SeTcbPrivilege 2656 msiexec.exe Token: SeSecurityPrivilege 2656 msiexec.exe Token: SeTakeOwnershipPrivilege 2656 msiexec.exe Token: SeLoadDriverPrivilege 2656 msiexec.exe Token: SeSystemProfilePrivilege 2656 msiexec.exe Token: SeSystemtimePrivilege 2656 msiexec.exe Token: SeProfSingleProcessPrivilege 2656 msiexec.exe Token: SeIncBasePriorityPrivilege 2656 msiexec.exe Token: SeCreatePagefilePrivilege 2656 msiexec.exe Token: SeCreatePermanentPrivilege 2656 msiexec.exe Token: SeBackupPrivilege 2656 msiexec.exe Token: SeRestorePrivilege 2656 msiexec.exe Token: SeShutdownPrivilege 2656 msiexec.exe Token: SeDebugPrivilege 2656 msiexec.exe Token: SeAuditPrivilege 2656 msiexec.exe Token: SeSystemEnvironmentPrivilege 2656 msiexec.exe Token: SeChangeNotifyPrivilege 2656 msiexec.exe Token: SeRemoteShutdownPrivilege 2656 msiexec.exe Token: SeUndockPrivilege 2656 msiexec.exe Token: SeSyncAgentPrivilege 2656 msiexec.exe Token: SeEnableDelegationPrivilege 2656 msiexec.exe Token: SeManageVolumePrivilege 2656 msiexec.exe Token: SeImpersonatePrivilege 2656 msiexec.exe Token: SeCreateGlobalPrivilege 2656 msiexec.exe Token: SeBackupPrivilege 2784 vssvc.exe Token: SeRestorePrivilege 2784 vssvc.exe Token: SeAuditPrivilege 2784 vssvc.exe Token: SeBackupPrivilege 364 msiexec.exe Token: SeRestorePrivilege 364 msiexec.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 1732 DrvInst.exe Token: SeLoadDriverPrivilege 1732 DrvInst.exe Token: SeLoadDriverPrivilege 1732 DrvInst.exe Token: SeLoadDriverPrivilege 1732 DrvInst.exe Token: SeRestorePrivilege 364 msiexec.exe Token: SeTakeOwnershipPrivilege 364 msiexec.exe Token: SeRestorePrivilege 364 msiexec.exe Token: SeTakeOwnershipPrivilege 364 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2656 msiexec.exe 2656 msiexec.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 364 wrote to memory of 2848 364 msiexec.exe 32 PID 2848 wrote to memory of 2344 2848 MsiExec.exe 33 PID 2848 wrote to memory of 2344 2848 MsiExec.exe 33 PID 2848 wrote to memory of 2344 2848 MsiExec.exe 33 PID 2848 wrote to memory of 2344 2848 MsiExec.exe 33 PID 2848 wrote to memory of 2020 2848 MsiExec.exe 35 PID 2848 wrote to memory of 2020 2848 MsiExec.exe 35 PID 2848 wrote to memory of 2020 2848 MsiExec.exe 35 PID 2848 wrote to memory of 2020 2848 MsiExec.exe 35 PID 2848 wrote to memory of 2040 2848 MsiExec.exe 37 PID 2848 wrote to memory of 2040 2848 MsiExec.exe 37 PID 2848 wrote to memory of 2040 2848 MsiExec.exe 37 PID 2848 wrote to memory of 2040 2848 MsiExec.exe 37 PID 2040 wrote to memory of 2988 2040 iTunesHelper.exe 38 PID 2040 wrote to memory of 2988 2040 iTunesHelper.exe 38 PID 2040 wrote to memory of 2988 2040 iTunesHelper.exe 38 PID 2040 wrote to memory of 2988 2040 iTunesHelper.exe 38 PID 2848 wrote to memory of 1784 2848 MsiExec.exe 39 PID 2848 wrote to memory of 1784 2848 MsiExec.exe 39 PID 2848 wrote to memory of 1784 2848 MsiExec.exe 39 PID 2848 wrote to memory of 1784 2848 MsiExec.exe 39 PID 2848 wrote to memory of 2088 2848 MsiExec.exe 41 PID 2848 wrote to memory of 2088 2848 MsiExec.exe 41 PID 2848 wrote to memory of 2088 2848 MsiExec.exe 41 PID 2848 wrote to memory of 2088 2848 MsiExec.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2656
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9BA5F6EAA20A386FC38FCF832DEAE052⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2344
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\iTunesHelper.exe"C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files\iTunesHelper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.a3x4⤵
- Command and Scripting Interpreter: AutoIT
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\files"3⤵
- System Location Discovery: System Language Discovery
PID:1784
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-95a346ee-efb4-4ddd-9550-77c4ea7d1b5d\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2088
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000570" "0000000000000590"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e94fb54871208c00df70f708ac47085b
SHA14efc31460c619ecae59c1bce2c008036d94c84b8
SHA2567b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df86
SHA5122e15b76e16264abb9f5ef417752a1cbb75f29c11f96ac7d73793172bd0864db65f2d2b7be0f16bbbe686068f0c368815525f1e39db5a0d6ca3ab18be6923b898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5198a9e62eec29db1305d1af420817675
SHA19e4d6a177913b0d6df45705398bb380bf30fcd7a
SHA25617a720bac6aae48ec75bf565360e747e52299440622d77a9236bc00bfd316f02
SHA5129a93aaca1c6a06694c379d51112e9a321f5a15f73e2d8cd9d3d857b4138026d193b6cdf231c3bde6043703671b4db43ea9a17a9a6f52c0a696bdb70db88455a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560
Filesize264B
MD507087cb3e8f58a7b77ac935229dd6817
SHA19a89377414dec3acb1d3cd1bc1456e7ce2fe6297
SHA25672d648380814c66d864ff963eda582c51ce0640bd8df0e84f807f167814602f6
SHA5127b69dd869911666c58104dff46c6dc62475e7d6d0a732026ab3cf594dd8467bad753e1deefa9931f56b8464540d43296a9e35645bc09a0edd455508506de88a8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
5.6MB
MD5d339565d7c5224c45092b3aaeeb3797f
SHA1c85565693714583e57fb9addb64368cc87288efa
SHA256359e387871378831eb1293f41b54436abc6357733d1a573f0caff90ab1cbf07d
SHA51214b3cb62aa99f53a8205783297285b38268306d4876ebdc65ab42d2c7c5613dc4b7010d3f25f2ad60747e136ff5939dca8f6a986f7161f27c0d791f4e874062b
-
Filesize
3.6MB
MD5b4677a50c291d7c5a7f9f1b80f39a37f
SHA176d183107f9a8f89f09e25149e6e3de777b25d5a
SHA256c2d43d768cebcf63e8d0c3ae8ffd2cd5070e4ac656a132b63d5e7372cef69c62
SHA512bb2a3bb016cca60bd5f8a33773752e8f88bae764a6497eaaccf563da8607805b5723b30135c001f2fbc20c628e75c099410d9fd09b375c3d2901b6e7f70ba356
-
Filesize
358KB
MD5ed6a1c72a75dee15a6fa75873cd64975
SHA167a15ca72e3156f8be6c46391e184087e47f4a0d
SHA2560d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
SHA512256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
-
Filesize
1.6MB
MD5ce6e163809f5e817ef0c259672f7a1cd
SHA1123e2f032b2fc45d6d9fe482756243ed61137476
SHA25628ead67d2352ddd11f963e8b23930905ecbaff371162dfdae5ed096f62eb3d79
SHA51207766db4cf023bf059415a58a9e1384acb39260ba71587b4eadb99f84d307c0ab70f76390894ab786a6461a0c809f8e9fe435f7bf9b334a369a178c54b295229
-
Filesize
396B
MD5fb11a2b6d4de09417d1209ea1b9b0267
SHA112e505b8c60b117fb546de71cccb56405db0d2eb
SHA25633274794938036eb57c83136a539127b1782174645755d7a1bc683cfe24387df
SHA5127e4451537a60546062ec1dd982dc9f9001ead9a715a2cacdfac2770ef0f0f3a3805d23f8c1f1f1d831ef1dc0d4e22f00ec6fc49d76d79c78b16bba6d90690fb2
-
Filesize
1KB
MD58137febdeff603a2745a3fef8091f3f0
SHA1a98b8ac550cdfbb38286faa35d78a9150b628942
SHA256bf587d46f3397834443938a31446c9edad9755946820cfb2cf8486edec83dc9f
SHA512e02322aa57a3dda92d11b9c5a7f715d900cb88619baf495d4c11f595fb2d39ce47f1beb86c4072f2588fb525f05d8bd8a9d49b4cf67f7cf36e7551b314e0e918
-
Filesize
1KB
MD5c245fb0290d0b30100ad722b90011f36
SHA149d31e78ae5875451968327076777c770b7c2497
SHA25620d4a9e6602373e65fc7ff6bafc83f5712d62790abfdcead11371fd4186f896d
SHA512c770d6d6f2bd21e344203b2bdccf42a3d99d5be97ff4c378f303458b242dbf3553c7a00eb0864a832aa41d1fb72566efd083236a18f4af083ed9e5d28be9b4c7
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
474KB
MD56354b28ac4bc8fa465d80c3ea3893116
SHA10eea737ad0a1a0cb5c3f14279a05d1fba6c6216d
SHA2569515b7b3ebe97e51842be2e91241f0332916d6ec8aecb767ba418de4d21f57f7
SHA5126150a7b646326f01118535c2469628de79e20b7461dccf44a2311d0c1f7e4ed2d8523e7671e26d9c843fabce2946ea33adf4cc4e6acfd3216e1e06cdc1efa53b
-
Filesize
76B
MD545306f5622da212035662680f1c09e0e
SHA1a89ae25df7b6bc8a30c4dcfdc267cf912e17f1bb
SHA2562a5eaa4fb540232306ee036ed870369570744b34d8bd17743293e4763d19933e
SHA51299c9a4c77b346cf95930575fdb6a0c7ef4fe3cc75831e8f4c5d8114d0b35ff8c7fa6ca4f4dca6b34b53bd133766565318da0904fb467f88a1d7f47d0577115b0