Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/01/2025, 22:19
Behavioral task
behavioral1
Sample
JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe
Resource
win7-20241010-en
General
-
Target
JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe
-
Size
403KB
-
MD5
8366d26f8afafbb471f0c8dc2f327b2e
-
SHA1
b3633e124352a84411cf64ac674babca007beb65
-
SHA256
2abf4ea5b3a97c4747c4e6b804de617d838a2158d6c301d7678dcb447ef4b846
-
SHA512
8db8b391b11f730494714bb553907164c5d52a5016bec24e3ecd6ef2d1f02ced0843679f6a5bb9116c8729cbaf27508667cc2d960ef8487a91e155059828ce08
-
SSDEEP
6144:F4fQ+jEiu+bc/DAd6OQskxVUks0i8ee6E4+DyCTAs6d9oFyExZt+gfmzdTjjfWFN:UQP0wEVmR14+CtQZt+TBeFT7
Malware Config
Extracted
cybergate
v1.07.5
KinG
7osam.no-ip.biz:1604
3OO667Y6N6Q3HW
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
123456789
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{521R770G-TE0G-UUYG-WG3T-IRQ5MV6P7GH8} JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{521R770G-TE0G-UUYG-WG3T-IRQ5MV6P7GH8}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{521R770G-TE0G-UUYG-WG3T-IRQ5MV6P7GH8} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{521R770G-TE0G-UUYG-WG3T-IRQ5MV6P7GH8}\StubPath = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 1420 server.exe 2308 server.exe 984 server.exe 3004 server.exe -
Loads dropped DLL 4 IoCs
pid Process 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\install\server.exe JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe File opened for modification C:\Windows\SysWOW64\install\server.exe JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe File opened for modification C:\Windows\SysWOW64\install\ JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe File created C:\Windows\SysWOW64\install\server.exe JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1812 set thread context of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1420 set thread context of 984 1420 server.exe 37 PID 2308 set thread context of 3004 2308 server.exe 38 -
resource yara_rule behavioral1/memory/1812-0-0x0000000000400000-0x000000000053E000-memory.dmp upx behavioral1/memory/1812-7-0x0000000000400000-0x000000000053E000-memory.dmp upx behavioral1/memory/1812-6-0x0000000002C40000-0x0000000002D7E000-memory.dmp upx behavioral1/memory/1900-12-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/1892-546-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/files/0x0008000000019429-548.dat upx behavioral1/memory/1900-570-0x0000000001E80000-0x0000000001FBE000-memory.dmp upx behavioral1/memory/1420-902-0x0000000000400000-0x000000000053E000-memory.dmp upx behavioral1/memory/1420-913-0x0000000000400000-0x000000000053E000-memory.dmp upx behavioral1/memory/2308-920-0x0000000000400000-0x000000000053E000-memory.dmp upx behavioral1/memory/1892-921-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/2832-923-0x0000000000400000-0x000000000053E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 1892 explorer.exe Token: SeRestorePrivilege 1892 explorer.exe Token: SeBackupPrivilege 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Token: SeRestorePrivilege 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Token: SeDebugPrivilege 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe Token: SeDebugPrivilege 2832 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 1420 server.exe 2308 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1812 wrote to memory of 1900 1812 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 31 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21 PID 1900 wrote to memory of 1156 1900 JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8366d26f8afafbb471f0c8dc2f327b2e.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2832 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2308 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"6⤵
- Executes dropped EXE
PID:3004
-
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1420 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"5⤵
- Executes dropped EXE
PID:984
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD54933547d8eadaf128b94b4e7b7c88794
SHA1fa6f7948ef06483eba4ae969b2d78fb3ae0b01e4
SHA256299f1253247f9b49653954484d48b0032914d76f5de278d0212c47a28ee0151d
SHA5123c8915114b255bce034b81b1295fdd4f525ba1ccac8111c9fe88244208935d2166d2699e44dee0e4ecdb935eefff819f0e982a83b2e35b839280f6fedae4e16f
-
Filesize
8B
MD58774667ab9cf4784b22c2caa29e61a94
SHA1bba494367423817adceacbc8348ff949a8d1f270
SHA2561803980267c43e21ad8b689e7d85c686e6ea14b5b699e1af93c36de487d796b9
SHA512ee0244a358b2f55816404fe859a1439d666ba71e16523a8db592a1d51ec71e4c3535e3228071762206cde887f0ab3aaf2aaa78a9b5c4d538f94358f6335b4182
-
Filesize
8B
MD59fc743bda7d4457aacd30fb93d343bf8
SHA1f27888faf4dceb2a0a8e49e86393b02d911b7dcf
SHA256a52ac58432d03030a2cbed7bb3dcb2a430b323b8f8eae51848ae618425fd5073
SHA512ac03eb91d2d2946df2773f8341f7a603c360b041fe18cfbb0c7f2072c3dfeae68cfd6c5dfd9a87bced07e865436458a6377b229e8ec425014db7e8a874c57be7
-
Filesize
8B
MD5f303815929eb8adfab58f3d998949cce
SHA155962a96f2c607b74d436793d1416b4cadeffe30
SHA2567a922d59cb8635bc5324ca72ea3e9aa89e6de6f50c929a52b5983ba9437adf64
SHA5120561b69f361f5c60132ee98cfe4cfa9212a6bfafd426555505badf7545ffda488fdc2f301a8bd5f3960f6a669730896bdec845a5dfb86b637042431aa3f4d826
-
Filesize
8B
MD5f93bdc64c9b5a2c0d806e2fae614ed45
SHA1c74a7d7380d9b27fec37f8685b611ea4d137b9ce
SHA2568c7bc6b30f3d0d61ae2ce794434eb7365c40986f223d07fbd37d0c6e8d3e1fda
SHA512040558e293a08281b20f626aa244874d0434a2402af21cec11a07eb72e5d3f5fb65d52de2a025d23e4fb90e075a03d86fe1334098ca7643310310ffcaf767d73
-
Filesize
8B
MD55d66fcfd62b4beeec7abcefc9cb73e1d
SHA1575a8b1536d289750b0193ac094f68f7c5b7f480
SHA2568fead2d7813750aa0a0536cb739cb383703d1bd3b385c4c19949019b46592b06
SHA51285df1f0b79a37b40b61c56e04429b1f11f32e0e8fd572d9415af0d600dc17dcdcb9b83a69721a7e0c0b6dfe1f74446a0e3afc8e3fdf60735ba47eba9a7fc9dd9
-
Filesize
8B
MD5e68bc1d7fdfa7d7b76ad7935d77e95e0
SHA1de7f3f84534bac19a93a6923e809075e84688f15
SHA2567887e2b4bd634ea20da50f255b2a05a91db2ea934e58371535a88c8e7eb64d25
SHA512368d5f56c7611e051193e2ddfd8488263a438761593884d331945a5289877f5ca9183f9ab8487a9f1b8d85564be3a1fa15e2923df96dd7aef5e31c26e960ac83
-
Filesize
8B
MD536e9592a64f0116c611743c78ccb0d1c
SHA17d8ccf1c5ad3dad1972d24d8c1339b269332fb93
SHA2568c8573d82d016a9ec815398b9118ca93b0833873ec0b4854efb0d5a1c2166b16
SHA5121403b18d311c6287cae06cae160fd1dc8fb9c196a93ebb89bb3b3c75229d5e2042d5511e4549ec2ee25c123102a56c88d1b5fd4ab37395909e29e446c3841d98
-
Filesize
8B
MD5b6876e9caf1fffeeb31c7426759827ce
SHA1fd6ba8ee5aebd16cde245513a96eeb89d945227a
SHA25637d482724804985ce0af3cc218f7134cf8ddf05e8fe781532599ba58798ce4e0
SHA512717273f3e226a5ebe26591b61cc85f9b96cf7441399e82271e2042a7cbc9c714f4e1a37f28e463715b54f2680d41f8717e26b3cf10805677a7dc7d73a9586824
-
Filesize
8B
MD55ad1dec8ab8109a59386ad06a21bd5b5
SHA14add7fc79ee40f6d16c299be4c82474843bc8d2c
SHA256fec01453588ba2c72d53024d9975bdfeb08cf89f3d00d26998982631c1aac07f
SHA5122ff18dff6cc539557fdc2365f8b0c8bb2b06f2771425ae20e915e2cda655cf3dfedde0f080760d406037a34b36bb62c434914233d037d850a9e955b3ab4383a7
-
Filesize
8B
MD5c14db7ca31fc87d770d815a57b691b60
SHA1fa8705ace8684de592e93edf0cf7619b67dac4bd
SHA256d825eba944c7a7c631b1b3e07346eba619a1ba7f70287b0903c24784ab8c8076
SHA512be9c69105c22275bce24cf9d174e7ea6030c2d48863bae5d5ad647c410a59eebe73f862c1a36ba569c74a82a2b405a306982ead12a6b8629505bbb6f0a809469
-
Filesize
8B
MD5ec68a127bcc9b90625e21addba624704
SHA110bdfc521949ec79d29f47b922911ea2d724ac9e
SHA256deba2b53acba52697e67d55a0947ed37fb646523caf10c3c86ac42d9dd94da9c
SHA512fd371a064ae51aa90e375e149a5e5a01eca6111b366891d88478eab23b744f24217f7647dfcf54aad5da583e39e90956f03323c7c3d209349197c4d3fca62aae
-
Filesize
8B
MD547acfca6b9dc0812c4853c5c4c5c1b84
SHA1fee70190e9ddbcac52b82f8b2287531bf008b40c
SHA25670ee731903b030ebf09120a95437caa39505a603e3d33ad58f38d71b8441fd54
SHA512b6471872fde80d3fd3e8336cf67bd62d4f28edbdcc5d6d93fc58c6c261bcbb2b4c6f6d11ec826c4dfb6fd700a1fdf24aac2018002138727e24ad882acf830821
-
Filesize
8B
MD5fe29f40980715ffaebfe24547c99078b
SHA13ce1edec78a1c94c568888372c471d74d9833b6a
SHA25664b1232f8528775011cd070c47818fe091e4aa0bee5251e8072f961607120012
SHA512fa8344e945e9f5aaf51f04f453ab2dbade97e28226dbd6bc4e3b49e109bc40bd2ab84079336cf9ec1fabd20bd8993eab87be1253463513bcec41422123847786
-
Filesize
8B
MD5a1f16d086703b36fefb8586a8c6b660a
SHA127686cba7e852b835173960560002c3d5812b8c4
SHA2560f854020cd00665d052e412e6d08d2b8ec3af4547cb7052071cd858c4100b9cf
SHA512cbaab0363e15872b0a2a80e7e544d32785969dea1aaecc1de072d7ef40f5296195a7596adcfe66a2409d97e692da812aa1c64c886fea9ce0d9dd242cf35382f2
-
Filesize
8B
MD585c439f7dfebe5d181aabb37db1190cd
SHA1a07260f067d99274d6ba4a679f40f35d42b8b43a
SHA256e468f99a2aa206755a4351fef50f4dcd2dee350475ba235638647623c9afb0e2
SHA5124e2fcb615eb66cd7bf7f3d2e0245ad5aab1ce79f0c7abcae9ad5a4a23427e6d78178891b37309bf2a55a9a6dd29d4207306f93a3b8395fd48f5471c9f5ea84db
-
Filesize
8B
MD5aab295227c914fb5318ff1b00fd5fd35
SHA197d06a3ad688bcdcc5fdf89875cc0e88d3d1c7e0
SHA2561df414008b038b32f03155809f227aa0facfc2a259fa07b548e0136a6da43fec
SHA5121eff07b0ea900cfa14e396670e111404646204816a89a058257ce43cc77d8d7847c1caa446f8ccafec19c485445a2e51520636f19d848a359825744d75e0355c
-
Filesize
8B
MD517efcc14938e4b12e7a199ae612e03b7
SHA100ecf0078604b8bbf9333cd8621959d7d24a2fa2
SHA256c66b9b724d3a6f2ff59575887b28c4d6f15b3be789bcac05bfb7a075b355747b
SHA512972c3d1069eb7c7bda084e77eacabd8028683af9b1ff9cd4037e1e1ae584a54d5fb48c9cd85b294bb63885735cae1b1c2edb4d8e63759ee9ef1ac6343d84c800
-
Filesize
8B
MD50532a136c8c3ec7f0e269e96c931133a
SHA107f7823d3a361a09bb33f6ee707a6a6e0af02b09
SHA256f5590ad9298904375685a4e3052a5e8bc20f811990300e387c5e8a123d7febf0
SHA5121e5389f3e8ab94d1ae061d720a594d7e03fbdf5fcc78aa4bca9ed307067a281e7d5f6bbb8575399b4a0681c847af725069a0c7d63d568c6bdce92e3257fad342
-
Filesize
8B
MD512e680524be235ae981a233d87e8abed
SHA1b80fe949f235a77318770f3311e926f191d36e52
SHA256222c1569110c4622977719c41967e95e22f226f1f01e8ded355bb6da6f2b0da0
SHA5122a18ada097da01f88a75fa2693a2b7a1f9bf2f70f0cb708ee23a419e8bc559ac23f36f43b2b1200b19d11476929fbf66b154e14166174ff4b414c2cf141b5178
-
Filesize
8B
MD5f311f9b3c10a3e23966419c782bbc141
SHA186c7cca5fbb6c03c12198d9327729f00d2ee28a8
SHA25613bb143142639137998058b8e9f986fac33ea72c150cc1547f22692d7827af00
SHA512d7322aea8876d0186126c13b11d8425d2b74a4dd06c9ab768d94cbf7db897d25b9acc20ad7742a48281d984615195a9d4e643392300a1cd3c3cf4e37576870eb
-
Filesize
8B
MD5941174e4b096793383dffe7c1a475e36
SHA194935781255451fda47eea97348d1240efe7859d
SHA256cb37daf2bf825ea1eb8166b7058dbbf13bea7a5266c1367f46339db37551722c
SHA5124aef17c6763b75849e07a35e8fbcc6b3b7e892a9da41cb08093e9f1759d80ab02e98785dbb013756f2e129ddb922b671526d6310823e063688598b3e447a3bdc
-
Filesize
8B
MD530ccd9f2716fab33cd2e3fb3d221abb1
SHA1bcdd838cb6921e1d7127a0d53c78f6dc725f178e
SHA256c4f75427549ea97e21e4c170855390a8fa8b1a4c9110d9a729ca479fdae3f464
SHA5127c140fd2f8932264b8f6080d00e8fac5abac4dd2d37b991e26417fcd1d8460f74c5522e0a25ac1126112317db2f3b1db1497c1b204679b267e7d29d2f6be271b
-
Filesize
8B
MD5cd58eaa8057f21fffd8724868d84d903
SHA11f38630edaedb6c3e238e9c0984b4a1604a364e6
SHA2561b23da7d81f98e3fa8cd291fa890632dce72347a9c9bf876802a236ff5acb44b
SHA5128190b89bd1d954bc8c4814487ff77b45e53f4368c75628028ef82eefc289bdd293bfc7e771ea0dd08c3a5693f7e33ad6ee0c310cb572eb95947cc6a3cc8549e6
-
Filesize
8B
MD5827d8f42890f5f169bfd5944558f80f4
SHA13deff298adc316c3696ce223475ff4647952c39e
SHA25600c936432d3170d80f56eaff4a8643028a0b11ff2370d1441d4eef914fead1a4
SHA512ffa55314318ab64ff228c8e4f3db8e48be09a32ee0d0addbc5ac0e9f86bbdbf148ad0c4f78104880fe1cf243d631db95b3612be177a588cf4ddd41301d9c2d61
-
Filesize
8B
MD5451d791c5bd2e89a298e30a7002fcdf7
SHA161b5206c41cf5320f4eab95434f85740997780b0
SHA256458d4da4973ea73bdcc0c6330da11194ae25943bd97cc786329f068e04330f28
SHA5128c53c06a2a4519ccfb1aad9852a61aee5307747590924575ec95cbbed58dd1c10327a181068140e5ba7b05a244efe9ae70a4e2f3e8fedad4017972f0269a5964
-
Filesize
8B
MD5716c1c18cf678f7eb9d341461a70f226
SHA1d2f77c2c03464b3d8aa18a75a59959bd9120702d
SHA2566afb0f27dac9fa11be4898c9c1618e57e308d94804d5c3bc942aef80161ef512
SHA51207ab882d37d900dcf207bcea4652eaa767e7b3165ee5e1dc36be469771a70472b00a98acd8ac8f830edb7152bc30ef9a5b2c29feccc447a2c9f007528161d190
-
Filesize
8B
MD514b12afaa4275cda5fb7e10ae75231f6
SHA1bf9d6746202fdb1370a0d684361b48a7772ea671
SHA256a3460ee6e44353ce9bed20ac70488299f51a00403ed678665cfdc7e93406786f
SHA51274557f0bfc2d9e5078d6d5c387caeb4c0d48aba8895bf3e5be7cbf622665190f15e621027641d7793a99bfe7e3b885ae6de5641e0f86e1cd6531614262db63a7
-
Filesize
8B
MD53cad805f29e06b1229100981eaafd9c7
SHA197cc630bdd1c36ba66a69dc49ea5ceb45c708e47
SHA256bed23b22c8c59a58a4d325ea56b3a542adf188be4e17468445f279890323b708
SHA512fb68d2e2d7eb86f9593782465fff23f381aa18830d9911b92b4a07f0cc518bfdb603e098f15a0b0336af9f39dbb0a53dc8a065c0eef8f05d6d3a3d28764fbd4a
-
Filesize
8B
MD57fb9796c40c03614a7e48b857d1aac24
SHA13c6f5b0752e60caeebe42097768471e347a1ac9b
SHA256a884043f7c842828f5b572375136ed036fd455907ee2300384a46d9152f1cbea
SHA5121f8442a883a8c77651da0f8ae9496be86f70029d14c26aa8279759803a379b03ed339359d93feeb4068576817dea89eab7d2933247089ef8f540c1255c02853a
-
Filesize
8B
MD5458392526eb402017751a9d9eb0fc754
SHA1498f033d61ad9cf4f375c3df8c5eb74d3e0e373c
SHA256aa165c1be78395484ee0155ba38563c4cbcdb25f377a149cdf99b15305d0ed3e
SHA5127d781c0246442409d1fae353f8d160bd208387749404649116551d6d1150d289e0683c2b80f2458426211cad1df476de1885c59bbfb6c8567a3f0a6dd3b56811
-
Filesize
8B
MD5f42618da4e425601540418ccad2dd0b5
SHA1de5dea25d25801faa63472c6382e49dc9f3010c9
SHA256719285b926ab873d6924f075a6ea93d69aa1737ed116b5a386f34d664e1e3b17
SHA51285290f92aaced25efac5f8354227e8a15004db8d270caf1d1248976bf5769e546d6a1421182d9b30df8e58d1a3a6d1e439bcffd5de660e45feb7c48b430067f4
-
Filesize
8B
MD5a5cc723fcbe6ee2d3fd326049ddbcf3d
SHA14187752c3e6242131036f783f276b66b868d8c80
SHA2566e9e3e22e9789814b31a7d2b4b0673c6937984b8f338144d0037b27c0632309c
SHA512239a53390b4f52ce044350ad46e408c27c632b79fca852f46344b0146e056d810cc329e77c805414e5c2f65a2feb0dad4df74d99ff1aef800f8ca0286ca11fb4
-
Filesize
8B
MD59f4feb854a3840a0ca038257838a1745
SHA13e9b525836f35dc652ffbcad405c22fa249ca8a9
SHA256b852526bf1cdcb67d4ee3b09c3a04c2c2e8e9147df28cba7402a23e7ece63106
SHA51227aa26601970471e6012e688929b748bcde7a849a68b3203a3f1d1e765395f3ad184546bad2bacede6d430a2281164b3f629c08fbc595223b57d4d7ae609ca39
-
Filesize
8B
MD5014ad284c3c1f3d347ee190273592d38
SHA1a6dec7cea10a42f0acfa4a84458269afc7816171
SHA256cedba239ab86655f2f61e216b16e941cae676613eb0fcb9200fc441c0a13b3e7
SHA5121fdfd6dc20126a5152c9aa547796711c63a3e0fb7e0f663e8275cc17766a14815ef918fb9e2fd21358473de9a3f18ca439b9e3fc1ea8a7c658c4b6b387207901
-
Filesize
8B
MD57d89d6cf939b804162c2cf68e47549f1
SHA13cc81fc365d43d6d42d322f322daf574f26d9fd4
SHA25685b60b1d4823323b1fba4d414e63e031fcbb739754b6e297a495dad9aa0975dd
SHA51222e02e1a4df6ba1f0de30228198ec4b83b578f09262062d39a315d2479c86c0bdb7a93733ea9321002919dfa0720c6581007bc3446b1b6095e6eafeb21c2fe20
-
Filesize
8B
MD57a250f66e83d4e97422103cf3a1476a9
SHA10f26e51ef90da81ebf17eec32aaf6393815783b0
SHA256e65bbb05adaf65e12283dfc460af3557451c5dd34635d3166391b7b404c5a336
SHA512aa607b45fbf6f3e6300038fd4ab1d09ee3c606cab2345134083d393682e102509121fdeb8aff1367647ed5a1af1176cc9b12bd05270a818e033c4e5dbf35fa27
-
Filesize
8B
MD56a716798abba0ac40f60c195a7714d5d
SHA10ab30fe3a8790df55e2d3485b8ff0b87c7f25032
SHA256ef51aec178df73f84e6b81f908d88ed5903b2521e18a64d44a5e74f07273f1bb
SHA512a07f3aa052945218ba31564331821d158065682d9e1c1a7bb628a8f3e7ec124e3122c791a82603ef1754cdc76d60c5f3328425a8fa0866a8bdadae5b4874093d
-
Filesize
8B
MD581f1a32cff8ab20d026af88c94f58c2d
SHA139352f366067f4dd50c75d1688b4ffff6f8f4104
SHA2561e59af2451040b03047984bf6a1ae437e037d09f6c5eeedb832d6f2b1008fa77
SHA512fa05c5f1fce48d211451c4ceb1969e8b168a4ac13b3177361b4d1589a41e71862a36fa2e0210eead35dbda997eb6705847db93ec45a7bafbf3496b39e9229937
-
Filesize
8B
MD5a7e32bed73079aa781922f1773d27e8a
SHA1e87aa347c9d52e496453c3a321fa52b066326d52
SHA2566c05b74d7c1a2bc81f0a78a0b142f4b7d683741c5cd56488990a29ca84c176a6
SHA5128b8cbc1bcbe3df638b0f976d3b92bdeadcd19b26875ad328d049d9aec79b788c5d682b4af7eaad7dfa38845079c0b820e5e49bdb44599be43fa022df390c7154
-
Filesize
8B
MD5e7ce1903eade6834146a1383a14c8c05
SHA12cadf30f20fc0c957e4430d3ccc92c127ed52319
SHA256192ff219d57f9aa18b209e5a78cfcc29c72ebe413d14c76da9fabee6df2d5b92
SHA5128152c06154bd8d1649249984c6f93fd845a99828d2ac235290d167196c7e0ba1e8c6d45ea2cac94924c5d2687ca244ba8c345a5daee8b2ab4342a3385f422c11
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
403KB
MD58366d26f8afafbb471f0c8dc2f327b2e
SHA1b3633e124352a84411cf64ac674babca007beb65
SHA2562abf4ea5b3a97c4747c4e6b804de617d838a2158d6c301d7678dcb447ef4b846
SHA5128db8b391b11f730494714bb553907164c5d52a5016bec24e3ecd6ef2d1f02ced0843679f6a5bb9116c8729cbaf27508667cc2d960ef8487a91e155059828ce08