Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 06:41
Behavioral task
behavioral1
Sample
61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe
Resource
win7-20240903-en
General
-
Target
61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe
-
Size
8.8MB
-
MD5
730bf213d90c18e9bef986876e531811
-
SHA1
ee9ed047072eb38d07e051038a01d31b7f2863a1
-
SHA256
61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8
-
SHA512
797a6a69a0c7b66e5818ff6048bbf4c6db41af29abc05875bddfc93ca822304358fee1d9d656cae0156306a3c33c6bd1baccaf8e517ef2a46ca8a649e4c00735
-
SSDEEP
98304:wws2ANnKXOaeOgmhVCPnsmtk2aX235t9jZcDRH2WeOE4MvKey0GlJJNuZIqPF:mKXbeO7HCfL3uWMkSey0GBNuZLPF
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
resource yara_rule behavioral1/memory/2124-21-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2124-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2632-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2632-54-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2632-52-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x000a000000016d0c-11.dat family_gh0strat behavioral1/memory/2124-21-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2124-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2632-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2632-54-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2632-52-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Xred family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259437384.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
resource behavioral1/files/0x000500000001960a-130.dat behavioral1/files/0x000600000001960c-143.dat -
Executes dropped EXE 9 IoCs
pid Process 2552 R.exe 2124 N.exe 2864 TXPlatfor.exe 2632 TXPlatfor.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 3060 ._cache_HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2044 Synaptics.exe 2164 ._cache_Synaptics.exe 604 Remote Data.exe -
Loads dropped DLL 17 IoCs
pid Process 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2552 R.exe 2112 svchost.exe 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2864 TXPlatfor.exe 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2044 Synaptics.exe 2044 Synaptics.exe 2044 Synaptics.exe 2112 svchost.exe 604 Remote Data.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File created C:\Windows\SysWOW64\259437384.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe -
resource yara_rule behavioral1/memory/2124-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2124-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2124-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2632-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2632-54-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2632-52-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2792 PING.EXE 2972 cmd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2792 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1632 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2632 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2124 N.exe Token: SeLoadDriverPrivilege 2632 TXPlatfor.exe Token: 33 2632 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2632 TXPlatfor.exe Token: 33 2632 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 2632 TXPlatfor.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 1632 EXCEL.EXE -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2552 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 30 PID 2096 wrote to memory of 2552 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 30 PID 2096 wrote to memory of 2552 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 30 PID 2096 wrote to memory of 2552 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 30 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2096 wrote to memory of 2124 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 33 PID 2124 wrote to memory of 2972 2124 N.exe 35 PID 2124 wrote to memory of 2972 2124 N.exe 35 PID 2124 wrote to memory of 2972 2124 N.exe 35 PID 2124 wrote to memory of 2972 2124 N.exe 35 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2864 wrote to memory of 2632 2864 TXPlatfor.exe 36 PID 2096 wrote to memory of 2952 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 38 PID 2096 wrote to memory of 2952 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 38 PID 2096 wrote to memory of 2952 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 38 PID 2096 wrote to memory of 2952 2096 61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 38 PID 2972 wrote to memory of 2792 2972 cmd.exe 39 PID 2972 wrote to memory of 2792 2972 cmd.exe 39 PID 2972 wrote to memory of 2792 2972 cmd.exe 39 PID 2972 wrote to memory of 2792 2972 cmd.exe 39 PID 2952 wrote to memory of 3060 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 40 PID 2952 wrote to memory of 3060 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 40 PID 2952 wrote to memory of 3060 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 40 PID 2952 wrote to memory of 3060 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 40 PID 2952 wrote to memory of 2044 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 42 PID 2952 wrote to memory of 2044 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 42 PID 2952 wrote to memory of 2044 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 42 PID 2952 wrote to memory of 2044 2952 HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe 42 PID 2044 wrote to memory of 2164 2044 Synaptics.exe 43 PID 2044 wrote to memory of 2164 2044 Synaptics.exe 43 PID 2044 wrote to memory of 2164 2044 Synaptics.exe 43 PID 2044 wrote to memory of 2164 2044 Synaptics.exe 43 PID 2112 wrote to memory of 604 2112 svchost.exe 46 PID 2112 wrote to memory of 604 2112 svchost.exe 46 PID 2112 wrote to memory of 604 2112 svchost.exe 46 PID 2112 wrote to memory of 604 2112 svchost.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe"C:\Users\Admin\AppData\Local\Temp\61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2792
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exeC:\Users\Admin\AppData\Local\Temp\HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\._cache_HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe"3⤵
- Executes dropped EXE
PID:3060
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
PID:2164
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:2092
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259437384.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:604
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1632
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe
Filesize5.7MB
MD53b0c0331799d69225e1ba24e6cb0dfab
SHA15584f5b9aeff12b32d214d792e373901af71f3a3
SHA256bce1f6f6f6532266837b66d719bfbd177d406d6d7d8d5adfd5e7c59fcde651a5
SHA5122b1305374a734cf34661b4720e38fb9dc91a080d1f53be6092276f8f54041c4acd658b10fd65f5db21ccabee594c0a008727e3aad7d289147dff17a346998573
-
C:\Users\Admin\AppData\Local\Temp\HD_61afef8a0647c82037a325d162aff4f69a5bf11b276cc6d1d742f29435be2eb8.exe
Filesize6.4MB
MD5699db42d0470ab462d7176e92a188e95
SHA1afa2164839e79dd2dd1d39ab8a0e8183d3d07809
SHA2561ca4c084c7ff06666f9e3c64f5656738245b2f103788ead3d763205c959c875c
SHA5120c6b3bcc94617f2e8bc7c311dfb9004f7d187cdb4818582871e44c5269a7d39535905d6f175fd227d0ad178c93495765c2901a443882fe68e16f8b9c1a04ca1e
-
Filesize
2.4MB
MD5d5f3da928c026382b3f82a06da820223
SHA1cb3b4ff440ac05af54483435f1480627d2470c04
SHA2566836fa86cbb478beeff4bec5ebe44fd709b60d0ad9c363207b2a344c8b5445d1
SHA512006f8ff05e24d5baf4783e5fbd76b99187c7d1654ae28e5f3593908b72cdcfda6249a0c5e2f3c2d8b14d3677f0c8464de644f7231ea46f09a05aece0c2abc6c3
-
Filesize
20KB
MD5234e81fd0d3442ceb597638dee90637d
SHA1229a43a14b93d3eebab95999cb8195a6f5b91e7a
SHA256cec42599f22fade3980c5e7caca3ee26cdd8a6daeb3d1aa88f50f4df3dd1c141
SHA512b9e35e84466f9bca9bdefa15a1b760f13cbea88c2f163a8f1a5b0b8648509be5156266470724890d111b29fb0b772f9be2544d0bca6d7de7af24ff80b3e254f0
-
Filesize
28KB
MD587a2ef402099268e0cb7e8197800d95c
SHA1ae945de7dfb82136985c61af6ef1ec95167f9bd9
SHA2566a463ffd70d66763aee2ae61cf9e02bc93ac41982a9d788844b0037992403d1e
SHA5121b6982ecd2969636d733ad0897c62dc401d4afbc5cdb05a28453160931b088c69c5ea9895e99c7c5c27f3460ea39974a95476e70abd6c5263a2dfa723bfc3838
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
Filesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
Filesize
899KB
MD5aa0449b97d533096d0f2a8a2ecaea630
SHA15f5a0c55b656f0c29938e81287b9b6a815face13
SHA25618da06578b28fc9bf450309c398fc63a1403a4d79b011d8169178ad1fa1f85c9
SHA512c59f45ee9a0e3f37fb98c71b4d5feaeffb18faffdb085da7242144eb5b49c80e9a43111528f86bf5cdd57640729e2304a9019b53fc7f5303d31b60c382bda64c