Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2025, 07:32
Behavioral task
behavioral1
Sample
2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe
-
Size
6.1MB
-
MD5
d3598f91b2ac9b50fc4ab79d984c289b
-
SHA1
b11ce902780e0b06f080b147f1ea6abea7728881
-
SHA256
aec08458d6c65f48f62b1cbf2d06d8b8fa613cc11eb65bee6987046559f35ed8
-
SHA512
c5bec3a8afe3414fbc2f7ea3939b165cf5ab3b768ed068988896b3b2be74cb8f6909932061796edc17e9f5dc07a71f5e667691b564e7804c5559601a0522f980
-
SSDEEP
196608:pLkjkq5tgtRceR9dWcvKgS8ccUjkq5tgtRcA:pp9WcigS/Q
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Executes dropped EXE 11 IoCs
pid Process 2408 ._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 1444 setup.exe 1848 Synaptics.exe 5040 ._cache_Synaptics.exe 4144 ISBEW64.exe 3444 setup.exe 2132 ISBEW64.exe 4332 ISBEW64.exe 3000 ISBEW64.exe 1344 ISBEW64.exe 4576 ISBEW64.exe -
Loads dropped DLL 7 IoCs
pid Process 1444 setup.exe 1444 setup.exe 1444 setup.exe 1444 setup.exe 1444 setup.exe 1444 setup.exe 1444 setup.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2360 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE 2360 EXCEL.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2408 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 83 PID 1216 wrote to memory of 2408 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 83 PID 1216 wrote to memory of 2408 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 83 PID 2408 wrote to memory of 1444 2408 ._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 84 PID 2408 wrote to memory of 1444 2408 ._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 84 PID 2408 wrote to memory of 1444 2408 ._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 84 PID 1216 wrote to memory of 1848 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 85 PID 1216 wrote to memory of 1848 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 85 PID 1216 wrote to memory of 1848 1216 2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe 85 PID 1848 wrote to memory of 5040 1848 Synaptics.exe 86 PID 1848 wrote to memory of 5040 1848 Synaptics.exe 86 PID 1848 wrote to memory of 5040 1848 Synaptics.exe 86 PID 1444 wrote to memory of 4144 1444 setup.exe 87 PID 1444 wrote to memory of 4144 1444 setup.exe 87 PID 5040 wrote to memory of 3444 5040 ._cache_Synaptics.exe 88 PID 5040 wrote to memory of 3444 5040 ._cache_Synaptics.exe 88 PID 5040 wrote to memory of 3444 5040 ._cache_Synaptics.exe 88 PID 1444 wrote to memory of 2132 1444 setup.exe 89 PID 1444 wrote to memory of 2132 1444 setup.exe 89 PID 1444 wrote to memory of 4332 1444 setup.exe 90 PID 1444 wrote to memory of 4332 1444 setup.exe 90 PID 1444 wrote to memory of 3000 1444 setup.exe 91 PID 1444 wrote to memory of 3000 1444 setup.exe 91 PID 1444 wrote to memory of 1344 1444 setup.exe 92 PID 1444 wrote to memory of 1344 1444 setup.exe 92 PID 1444 wrote to memory of 4576 1444 setup.exe 94 PID 1444 wrote to memory of 4576 1444 setup.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\{D8890414-5EE6-4068-92CE-B262ADDFC6E0}\setup.exeC:\Users\Admin\AppData\Local\Temp\{D8890414-5EE6-4068-92CE-B262ADDFC6E0}\setup.exe -package:"C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{D8890414-5EE6-4068-92CE-B262ADDFC6E0}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{D8890414-5EE6-4068-92CE-B262ADDFC6E0}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{D8890414-5EE6-4068-92CE-B262ADDFC6E0}\Disk1\setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F264F75C-1C3F-40C0-8D1E-64D6AD3EEFF6}4⤵
- Executes dropped EXE
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0E15B152-521F-40B1-81F1-A7C57B5B9D21}4⤵
- Executes dropped EXE
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{04E11B66-B023-415B-836F-5F0644C4EABF}4⤵
- Executes dropped EXE
PID:4332
-
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B50ADECA-293F-43CD-985B-5E12118C7D59}4⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B480A3C-C7BE-4FF0-8862-4336A0F9A0D8}4⤵
- Executes dropped EXE
PID:1344
-
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exeC:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{46B24514-71BA-48C5-A97B-2BDD586E2705}4⤵
- Executes dropped EXE
PID:4576
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\{111A8E47-0AB2-4B69-9F3B-40C7AEEEEBBF}\setup.exeC:\Users\Admin\AppData\Local\Temp\{111A8E47-0AB2-4B69-9F3B-40C7AEEEEBBF}\setup.exe InjUpdate -package:"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{111A8E47-0AB2-4B69-9F3B-40C7AEEEEBBF}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{111A8E47-0AB2-4B69-9F3B-40C7AEEEEBBF}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{111A8E47-0AB2-4B69-9F3B-40C7AEEEEBBF}\Disk1\setup.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3444
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD5d3598f91b2ac9b50fc4ab79d984c289b
SHA1b11ce902780e0b06f080b147f1ea6abea7728881
SHA256aec08458d6c65f48f62b1cbf2d06d8b8fa613cc11eb65bee6987046559f35ed8
SHA512c5bec3a8afe3414fbc2f7ea3939b165cf5ab3b768ed068988896b3b2be74cb8f6909932061796edc17e9f5dc07a71f5e667691b564e7804c5559601a0522f980
-
C:\Users\Admin\AppData\Local\Temp\._cache_2025-01-12_d3598f91b2ac9b50fc4ab79d984c289b_darkgate_magniber.exe
Filesize5.3MB
MD57e90f1980f7ad185b3e672ca4daedeb0
SHA180e2516963e6bccde1722ce1b7ca225d58f04f66
SHA256720375b8d6ce0a58fc4e64398af8acdc4c5e611171fbd60a1b3f0475ae91510f
SHA512c937879c27ebac8dbad2c7663ea82de275e4a0ef62b83fcc2dca35d4fdef47b638ecc8e70513588a51861ef6c2ddcd600df497d7d56f3391cc5be90cba5b061b
-
Filesize
22KB
MD5bc1732963d327b8db5d4ac99212753b7
SHA1e06ff3983c2286a4767cff3621b561111820cc42
SHA256c7ba55db4eda8f1bce1206706c11e72e537d355e7fa638fb3c4d44c264c729ee
SHA5120852d4aef7b913d2822f0023c84115003b29f67c9d345edb716d3457b9cea5667b199125c2f1ad29345888e59a901b5c78eb35b9244a2a86693b4beafdc524ac
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
177KB
MD58a1e5a6b1c4e0c7d706eb2b36fa6c8ea
SHA149199a62de0eda485b5287bad469f92ad8ebd407
SHA2564104fde5404bfb3c5347b8ecdaec89a2e746b1162dc75186bc79738805818c0a
SHA5121393bd6c06c30df7414494e5b06242445eb8afdf5467c6a5e875f2c63506b0b581322b6444c6d8f06b39aa5b04d1c55a631ccf932dc6d5043296dd3ed3cd9fc8
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\{42F05E9E-71D2-418A-9FA9-DBBE3C134E65}\DIFxData.ini
Filesize84B
MD51eb6253dee328c2063ca12cf657be560
SHA146e01bcbb287873cf59c57b616189505d2bb1607
SHA2566bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1
SHA5127c573896abc86d899afbce720690454c06dbfafa97b69bc49b8e0ddec5590ce16f3cc1a30408314db7c4206aa95f5c684a6587ea2da033aecc4f70720fc6189e
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\{42F05E9E-71D2-418A-9FA9-DBBE3C134E65}\FontData.ini
Filesize37B
MD58ce28395a49eb4ada962f828eca2f130
SHA1270730e2969b8b03db2a08ba93dfe60cbfb36c5f
SHA256a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932
SHA512bb712043cddbe62b5bfdd79796299b0c4de0883a39f79cd006d3b04a1a2bed74b477df985f7a89b653e20cb719b94fa255fdaa0819a8c6180c338c01f39b8382
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\{42F05E9E-71D2-418A-9FA9-DBBE3C134E65}\_isres_0x0409.dll
Filesize1.8MB
MD5a05838872c391e729b414d2b15083983
SHA1027038259b7c4bfe0066b6f5635e416efbd84157
SHA256a7c7db8ce84441df150ee880e5bde9c17bc7c85dc87a61b1760738eceb61ad52
SHA5120b13d56945a381dcfd453e9d21d62b030007d24b89fa6f7eaf75d62ca80f7c7fe1842a44d9deb25e286ac8fb1fe7c3567666c1e116c96dfd641b56e99262125a
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\{42F05E9E-71D2-418A-9FA9-DBBE3C134E65}\_isuser_0x0409.dll
Filesize968KB
MD542e6c4a0d3fc291bf3f01b666bf587db
SHA16be7b99dae48fafd25bb929ae26dfafbffee096b
SHA256b9a2a3e9061a7c6e8ab5811cb93abb0358e3df2c882530be98b824b71ce17f6d
SHA51227b151d3b9637e9d8402ab406a3fb21e9dfb4d6c8aff429ef2059ea16cb3eb314f510660cad45eae4dff7ec76d9be16594c19514ac52bf445e000926d70fef2f
-
C:\Users\Admin\AppData\Local\Temp\{9DB071A1-B323-493B-A8B1-3CB82D0FCBDA}\{42F05E9E-71D2-418A-9FA9-DBBE3C134E65}\isrt.dll
Filesize422KB
MD567b3328f3cc34596ec941dda8574f606
SHA1219a67104a18f71c0ccb7b9d73f435d76e44f584
SHA256cb80bfdd8263bb9aff04bdc7d6be71ad09800895b616223d8f97048aa0a506f7
SHA5125e81fac5a4e48353bdd0a60e8882b4b51a79298124d9fe8235940643bf2e4bfb13a881841a69dc479e1658cd42c6772c76a761cc2be8342122e53460357c5091
-
Filesize
21KB
MD58586214463bd73e1c2716113e5bd3e13
SHA1f02e3a76fd177964a846d4aa0a23f738178db2be
SHA256089d3068e42958dd2c0aec668e5b7e57b7584aca5c77132b1bcbe3a1da33ef54
SHA512309200f38d0e29c9aaa99bb6d95f4347f8a8c320eb65742e7c539246ad9b759608bd5151d1c5d1d05888979daa38f2b6c3bf492588b212b583b8adbe81fa161b
-
Filesize
788KB
MD51c14194bd13d114f8507cc6fa28eb1d1
SHA1baf3d92a549ec7a419ddc697dafea8282b577960
SHA256ea231c7a836a666d57752fcb0d50128a9292f7162433ed13a64a0a733c7b46f7
SHA512b5e4e4b7075ec52a083903b0e96ba6e9901b7f0080eb93f9b2cad0d268c3302c437fd63ee49085fa0819bbd323b872f2b55116f3bd8cf9bb8ff19bcff99b4220
-
Filesize
2.0MB
MD53f6c14ddde377b537eb7db19670fb3a9
SHA14e1aa09b1460644a97f6e35b13abe41c56c4fa9d
SHA2567e37cb453c1dc21b36309459c818a447e10d01ae486353726ee85d3ef53c49b4
SHA512b01e268ebc2f708b51cea635fe9e8b4bc2e7c7f8fcfc7e44648e9bdffa2c0efcb5e9e4bbad4587645ba1d4caf078b83366cb9d0891516b8e6b47891774d6b2a6
-
Filesize
12KB
MD5b2dc83da67807e9eeeebc37f1dda488f
SHA1536460cba50fd5bb718354911b0941ac9d1d78b7
SHA25688923f58734b4aa924f586e48ceb3f0792290ebf986ba4322732a38be422abec
SHA512bcfc43df3b23d0d2d4c15e7be061012bc7812cf63e98db566d719d73041dba20b82171f01365c96426201c186cea6ebebce572363bf4a954de46083d162fa9da
-
Filesize
550B
MD501afef378eeb930d1f5f486ca40f3b66
SHA14a5b7bd54a58e920e95fbbe80ff2c316c4cdbc06
SHA2562a1c8858a63ae79995fef03a0abe7fdbcf368a53d81e0a41e276c7b9ea949a02
SHA512f066fcc024407eb96fc4ea8ddfb85c2c4448c9e723863108e588526b3bdba9792c1c24b59fac244ecf18fe739f0bd27f3843f30cd4de1ccbcd397f5ae5b6b246
-
Filesize
229KB
MD54990595c81aeaf50f32c5681fbfe4608
SHA118c6bb6dc5913e7fcbaf1e2612ecdb59db2b93ac
SHA256531ade9f6105d5ef1ca0add9cad64fb1025180a6767bb6e30bcdcaddc99b07b8
SHA512c0ff23670388ca9eed4224368d8eb4c1b2f688fb1cdb25a7ced5dae584088ca5933f181d548c1c876c590c8f0e81d4dcd7c7133bfa84b7bc781ef4b01c11cb95
-
Filesize
1.2MB
MD52c0b1c504d9f05c8423259649681e886
SHA1d80584711d9c048ca4f0b8680363977fd80022d2
SHA256365466c2d0e39c68cca25dea949e52cb4cf32ff1658763f22cd807b64a8ed7b0
SHA512daab508ab804123d8dc09fa69be9b05848590b58a31ebb99a63011051eab476ef09a50902afccf6d312875e1ec9b796e02d012cebab15e0202a5bc364c32830c
-
Filesize
2KB
MD5d15600b0ad28b582c04bda4b5ea78a28
SHA1460f5f77b80b0aa1b996f1e99e433796732a630e
SHA256578cca02a20d215086110b7c16bcae3e94186a3267506603aed2398e18eb20ad
SHA512755b0080e378a48ae02d406688f51f5c6ce4ccb530ae0d8a8367806e140040d82b4827fb2d0175f63bbc3a43aa23a5e9b7125c93867bbba8be779722296b4c60