Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe
-
Size
575KB
-
MD5
97921228e2d648d225b4f1ed814bc32b
-
SHA1
b13f6a7b01eefa960360a2394f69aca8731aa94a
-
SHA256
4e675dc623035d1299f5bf2ecd72fb1aa10904d00f23c4ab136c7317bf14942a
-
SHA512
9b43fb2232cfd1919cf80e91f3a25f27c94f2aadc8627854981dd3f9d46a651ea6528ee98c183ffaa7fd751ae36aed6126fafb7609cfd6b436adaa551c0df681
-
SSDEEP
12288:tB86bWoRWbXJz7LA9FLLdrlGLE0kuGnESB3:I6bWlNz/AT9rEMtnESh
Malware Config
Extracted
cybergate
v1.04.8
Fcuked-U
owned.icm-bot.com:2020
M43IIL0K723SE6
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
WindowsServices
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
ma1lc0
-
regkey_hkcu
WindowsServices
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Services = "C:\\Program Files (x86)\\WindowsServices\\svchost.exe" JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Services = "C:\\Program Files (x86)\\WindowsServices\\svchost.exe" JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0J2CI178-6VV2-0HY7-IWNV-N5F0E2F6D384} JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0J2CI178-6VV2-0HY7-IWNV-N5F0E2F6D384}\StubPath = "C:\\Program Files (x86)\\WindowsServices\\svchost.exe Restart" JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0J2CI178-6VV2-0HY7-IWNV-N5F0E2F6D384} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0J2CI178-6VV2-0HY7-IWNV-N5F0E2F6D384}\StubPath = "C:\\Program Files (x86)\\WindowsServices\\svchost.exe" explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 2004 svchost.exe 1884 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 824 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 824 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 2004 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsServices = "C:\\Program Files (x86)\\WindowsServices\\svchost.exe" JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2084 set thread context of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2004 set thread context of 1884 2004 svchost.exe 36 -
resource yara_rule behavioral1/memory/1784-567-0x0000000010480000-0x00000000104E1000-memory.dmp upx behavioral1/memory/1784-944-0x0000000010480000-0x00000000104E1000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsServices\svchost.exe JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe File opened for modification C:\Program Files (x86)\WindowsServices\svchost.exe JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 824 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 824 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe Token: SeDebugPrivilege 824 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 2004 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2084 wrote to memory of 2692 2084 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 31 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20 PID 2692 wrote to memory of 1120 2692 JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:1784
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97921228e2d648d225b4f1ed814bc32b.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:824 -
C:\Program Files (x86)\WindowsServices\svchost.exe"C:\Program Files (x86)\WindowsServices\svchost.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2004 -
C:\Program Files (x86)\WindowsServices\svchost.exe"C:\Program Files (x86)\WindowsServices\svchost"6⤵
- Executes dropped EXE
PID:1884
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575KB
MD597921228e2d648d225b4f1ed814bc32b
SHA1b13f6a7b01eefa960360a2394f69aca8731aa94a
SHA2564e675dc623035d1299f5bf2ecd72fb1aa10904d00f23c4ab136c7317bf14942a
SHA5129b43fb2232cfd1919cf80e91f3a25f27c94f2aadc8627854981dd3f9d46a651ea6528ee98c183ffaa7fd751ae36aed6126fafb7609cfd6b436adaa551c0df681
-
Filesize
222KB
MD523762fdee142a2c54d1e5dd9309103dc
SHA1ca0e795cc38e62c209d563d4b846c50d643daac6
SHA2560d0f3e12191e8f02ea6dad930845511fc32e57b9bed282aa3ad7131ff26aaa03
SHA512688b8ecb999f1a8505cd8e73fe008fcb460dd785e91abb09551505f896af4ded26e51fd11bf8c905ce859eb294ea8ed26419ee481bcb9b6d3b1d608131d8c14f
-
Filesize
8B
MD582f8f2e6d30873ca942c96e49a9fefe0
SHA1bba2c663b06291006a6db22344ae60b9378c7994
SHA25601d1761ed026f1b3c97fdeb69466d5c5db06387120eb04c10ccd81ff45871096
SHA51291b78bbe8250417d15a53568820132a1d79d1eadfd395ab701c60b6d7234cb89f7a06c37dce6f557e5682198859c28340e0e3d5ab002b8b358d153b47eb2ef04
-
Filesize
8B
MD5ef788c8f216e03856176525788f8ff0f
SHA160c2774357a51470d1bf2473cfd4d544b7348b96
SHA2563e518f733c40d9ffb37bf0993f98cd3688a3d946f528c58cbe82a29ac2c79321
SHA51278915c29042cb1eeb517f3a2a6ed9c0485b8c802083945bd0f996534b1e390cb77e4106ffda3502043536f0d0e6fddebe341c71fee4a9ebaa83e8475d3700393
-
Filesize
8B
MD5f0f4abf03cae272ae6b7f71dc19ae228
SHA1955b3e1c1b04c298b21271a8bbb654259a3b7742
SHA2560872449a22c0d8deddf229797cba8e3cf20fc77464a2ae71de52bcd8711306f8
SHA512e4d6d5b4b1d1f2bcd1358521a46ae26dff7638ded2732214ce1bb9cea4241f142ea688d1b90d36cfc82bdcab8f77efcac015d7b4cfe725b39001fe29a96eb5e3
-
Filesize
8B
MD5cca57e833305dc0f6e88451066c541a6
SHA1f14affcad6142fc7d1b9ee0c20e6588843eade9f
SHA25681e477f334e088f8c6b0eef7b79350296bf727d4b35b53263511dd505d2b787e
SHA512957a7d0236b3c8f06bc5406615e950622cac0317978ac4419d56fe6574f81d9dfde31a0d8b3d119a4a9aabcb2f471e3881ed9ba9b2bb596adb2922e96038dbe6
-
Filesize
8B
MD53370dfee093bc331903cc04ae8e307b9
SHA1ceb26abc81bb34301e0b470c77bd5cb03492e501
SHA256a406c056a55382638b6e9665462b1d4484cd687b7993b5bda7f5202b9898dd63
SHA51269b5da7f4f81feec196fb10bb21cbb1ebd02f2b13f5538cc1a5b35a545f304e9af2820ec6eb8128d4208716bcf4c8511ff91329fc62c73e80df59510f689bdfd
-
Filesize
8B
MD5758afdf54258d6d04caa59ff3c1d954e
SHA125c6250ccfd68c77e8193a726b2125dc54ce9f67
SHA2561b0f434241ab0ec9c10a3628498a534a024b8e21d0faca7aec44352cafe2d21c
SHA51253d0c63e2777d38155a29a87beccdbd1e31e5a8381ef7052f9029e9401b59a9549a7cd6d2e38679dd3f1f126d1149d9c028b0d3d74707ebff0907ca174a4427a
-
Filesize
8B
MD55a03e9592fa99c8d7fd2d2af7cd0df20
SHA19daf3a7f06152fabb68c5cbb0ad384642ed17cdc
SHA25652897097f4e8d95adba562668a6447850398bdb0ae5bd0e9de66f98ce4fcdfdd
SHA51289cade9d90f3449799267502432fbf624da6e31af5dc4b3a4162f649dfc6d62acf5789e6c9f7bf07f8965942aa034f24418a1af9f8b07168e8368de92f70095f
-
Filesize
8B
MD55b3e9c6c10f7281b42d693dc2640dc9f
SHA18df39997a7110e88ae2dd23aacb19a40722972a5
SHA256ea2b2bc66f9ea3d789fa67a4671b2ddf43f2e7c6a242a071bea37beaed548589
SHA5124fcad59dc09e253afec9c1dc8674e05f898ad9a3ec1ec971ea15b3606877b19d9734699edfc242a87e44f15f37998d793568d3d8a7b17a62062f57a3688e4b45
-
Filesize
8B
MD58acd274541f31cb35c9fab0ceb47e050
SHA13d36b8bd67d0e2525bdcdbf35bc44636f995c130
SHA256bbc8e65caca59fbc3bd8b40a6db0bd5a6c4159cfe5106cd37fa112f99aa50981
SHA512013978924e6dbb9f65fe14b29b146ff528212286de55dada4c93b7b672ef0950e5f2812f0d444f3ac4f6748c3e2589be07bbfb0cb1bd82c7ed56a4a229894551
-
Filesize
8B
MD580de4ac0b78e714382efa773d076e31f
SHA1e74c1d4f843431f77811473aea4ee7812c5c95d2
SHA256c3a2fbe444752793b402de81e26b019e953d17c553f5b426379de8eeee99b8d0
SHA512a0a3e6be8b48f612d186a290915b03716c9442e48e4d67fcd50737424e53b701cf092cd1e152567db43c37dbf73abd9631fba55c9795e9d5cc4256ad0e56529c
-
Filesize
8B
MD5f167f6b5fc1ec62d7c663a3dd1c8a49e
SHA1c54bbde323db0c8b5b2870d650675a5974e55381
SHA2568b109b7d801b21ae3cba2c4d01ad30fe44282c99643a4350e55e5be806bc2655
SHA512c0dab85b4332b28fdf8f181c697dc590b570fc1ee0329021d54283c64b8e42aee981a587d0d6e447883fff42f2e8c9d93a66d30b15afeff631f2af1d7c046900
-
Filesize
8B
MD5b35ee2bf674994be3d6cee440896dd12
SHA130ff647c96bc33e7c4d13f80d3be24ee58ae5237
SHA2569a4b069911901ad94cc8cff0757ec6cb7acfeac7e5b899e3b77d2ba9c3e08ae6
SHA512a6a0102e09fbaebe16541dfb8c3846739fb7cfa973b6757b1cdb1c1c36a0985283ddd5fea1269bf3f037e03555d2e43539173f319ae6fee8195b2691c5d5ae09
-
Filesize
8B
MD53af15cccb1ff53a79751843fcba737cc
SHA19215e89e70227c86e9132acf77e553e185387b22
SHA25663b728a0be89612622865a52838ae15eb76808e1dc07a90c1b5a578d81b7b12d
SHA5126a3750bfee6c67c2261c2fffba5ae01aa11b2ef5ba84a7636a6f9aa6ece81029af2abd22e39e7a2032f419945214955556f4a992ab25fbc4368833278e0cf2f7
-
Filesize
8B
MD5315e37826e431bec38376b6316f6f9a1
SHA1f166ce1e257bc610c70b42443889acd9f43df8af
SHA256bbd88547a13003734671834e17c12fdab4778e6d3afb4ef4d4c9c3453ec5da22
SHA5128de7a1ed8636d72697f15de95c255dd68273c19993540a954b752490cd39db4d66383b9863ffadeb0256ef93d96db1f267140ef9d5c34c1bc549584a258b715d
-
Filesize
8B
MD5906ae2b1bbf05f333e46e2fea18b7d38
SHA17f417529a8d440840a7e60538aa65109161af68a
SHA2569d940fc20cb9b269be18e39637124a7549f3d6ee5cd53e0f99a4c914057297fb
SHA512a78e94e7b13da4cc5c369d3f63e874aa0174799e40106c342933ee4a78bfe68e11b3966588823fbe319fc16e37eb1b26a5bd0c16c0dc3b04ceab7c51d866d9ce
-
Filesize
8B
MD5ff5465d5f2f410785dcdf6f87dd84eac
SHA10fd183a3dce178b083f66f840343a832ced32933
SHA256a170007fe3846165362fbaf736119758b3d1de57a7e0c10693c39a3befa34288
SHA5120993d9e681e5009a37d7322287907ce237cca37229779d15f4fc34bd75ba5e997cfa3beb7e583875053e018a3f2aefe427986fe72466e2ac5d07efee565bee3c
-
Filesize
8B
MD5439c791410d3f3fe62fa77f5392d0f0b
SHA11a49a72c180c7d7ec4b105ff8f641701e5316fc8
SHA25671e7abfbe6d67301c84e5566ee3cf2d86debb09a9a78b4ce2c62ddc01fe32335
SHA512a9f153df40cc922756d736ad6dca6ed7c613358317121d998e663941521498130be16c9d69ba772cbe01daee748943a0487ddc36cf8b6fce85a84ecd4c5017ac
-
Filesize
8B
MD5951b8276089473737f49ed81eb3e2580
SHA151ae80b834ebcc7316cd3f8afe7264cc12229514
SHA256a3e075ba54beff2f641529444592aa847c274746bee049242e78e86dfe75237f
SHA512b725e249bfb017513313336d1999168907db5b24af27154092e4c71a764a2114ad66ea8641881227641784bc57162594e1e31607332ed1dc5b8dc24fafb51589
-
Filesize
8B
MD5f6ec7297004633eac0d76b744c9c8e87
SHA1795f972bd7cdf61a1e3f14688ccd61b82f498e64
SHA256fb740fa07872965bdb519cc65b5379e9e3c2f881c33dfd152b852351ae7b97e7
SHA512903247d6b743b8e437bb2ab542a64cb7a9e0eeb87683c5ef02f38715ec83004281810596ebe899fddf9f34763e2e28e79fa97ddf4e9ff3c75f66cdb4b1ed9de9
-
Filesize
8B
MD50a0f4be3c4ddf97c01b0c70b44d0c47d
SHA1ecadc2155e9a5fc82f18e181211fb82a3b6a0947
SHA256abc630867d6fbe01c88d2639d938d06b045041a17cb0623b5c877012a886eb32
SHA5125be30bd75c090906dd73428091900291ed2d38fc929443cc4df2e1dcbc341d35b67c547b68a742a0979f20550c82bfea9a3f2f4637d81a6403eba55ba3a6e392
-
Filesize
8B
MD5887b83f71f27f7d1851feb52a0131ab3
SHA1170d86a41d6d2aaa158fc43c5c0c29d5fc6f3945
SHA256e0c9c368c0fd6494402245721d6b4b89df6636813268c4067e6d3b2373751104
SHA512b62e675eeb86e3673116a7449667be525eba1869e8a0a2425df1cf075fc7d6d782a823541e22e43cd996c9651f75bb26395710277436b78962429b204e8d15e3
-
Filesize
8B
MD52dd84c40f70cb9eadc6fcc99d194aab2
SHA1df9690fd02702adfcbf5d881d385ad42e5777004
SHA2569dde291054aee616185ff761a5f2dfaad12f3e63e598cc5b3d26098b7e1bbbc1
SHA512a6632f6cab012be87b97d85389f8b34f4b5fe35d95065d6bb47168e60e64083e7e8a3ec2ca543badbc4431058e01d8a6e20175c5791872e39a0409982dd038e5
-
Filesize
8B
MD5995d6f55ce1a8878e9979ec10690a29a
SHA1418fddbc89310493620693b6b3f32a4f215d40a8
SHA25622d1ff56292a8b5086d1e6de976f129bcadc74b9b116dd0efb6d94bf1eda3582
SHA512a8e925811af0568cb3c6b281110d948e957665f3d4f019ded7aca4e5bebf54a2846217ed9c42efa377b1cf2d943eb2557816b190bca3feeea0ec211bc9248cba
-
Filesize
8B
MD5400bbdde33785836f76c3a8c6ee6f571
SHA199dc3178143d4a76a58f0dc1153ae63f081147fd
SHA25627abfd8046c2acff6cf00b4e309cd2a271500088bb65a3f82930547729cedd37
SHA512ad11527f0a3664b709c09b27ab823fea4e8a369864dc8aedb5dfe243e700fbaf22945595f44f7ec046eaa99c40736ce742c52bb72dcdb9a55d6db7da7e6fbc47
-
Filesize
8B
MD587d0fc6e0b84fd5b960d4d34f9bd21cd
SHA117a57de4cdaa8eaa29ec75da706439ec3eb9b2b7
SHA25631fc7c1a1e1e94e7d8fcc2ee04fbeca46aa40991444cf05654db3397d61e62fd
SHA5126ac818eba5b71eaab1c1b1b1a748c37ddde9c016a3f8a188fbe825509096179f8f086c7a79c48ee6712d6999b3133a0a3970c3e3563722ceb47302639fdcfc1d
-
Filesize
8B
MD559f16e3ad4f3039c9a4e4f65c7375b46
SHA16b7f9f47a89fd0c18f43ef60f00fc54ca95ddb4a
SHA256e7e52c73e793fa48d363f543152d8f47f220ab4abb070220bdcd196150b3eb6f
SHA512298efb3ee0097d5462d74cfb6db456c975189ee7bd011611caad33cd06806f48d937798665ffdf1a43ff8aba44ec1d0999813164c72f011a5b6a7ccc3938684a
-
Filesize
8B
MD593c3e3d3c4f82773a1f91f521cb8d458
SHA1a5722a75923665845555ed296cebe55a4c045fe9
SHA256033cd38de655b8820ce192b92c45644294727b6ac5303121b78e79706c41a419
SHA512dd8759b84c55d5b5448a1c13631d4b840b780e8243454c68f45525b2c8d7051d9a555376b960f86ab24c90bc169a2b0e35703ba0b61db9c37eb980f7f7ee013b
-
Filesize
8B
MD55eb4a42754c127b33794f90ed3c138ea
SHA18965160cf1e6db7424d97b53d888fc65374bada6
SHA256bf99b14682e7905ded60767d227fdd7b730290d40437d2be78c554e789799ff9
SHA512e19f15a484aa82a16814bcd1a32ce071d2b280678090e080aedfbd793223b8a9b9d192a9ed6c77037d1f2ed8fe55a52ce7dc1a75d0513278875c3089072b3b03
-
Filesize
8B
MD5bff36bff2a85253024db4ef9ebaf9567
SHA1bffcc79418a35edfa88c6a9503349acf3777bb95
SHA256b63b3b46990aeb24baa38f0a011a213127670d015423e303d9341dc520ddc6ce
SHA5129b833745f302e8190f6b8637be48c84a5acf65ecf0b578b75fa627322006c6c4afdc00d17f32816e2dcd334db1095585c95bc7944aec361beb85620de0bbc962
-
Filesize
8B
MD579861e848dfba43a8e532b5712c5e6b5
SHA17eb9cc586b5f44cc52f2edbe5023f9e35c6235a9
SHA256d75ac2127685485a456a3ad8fd1b0a7374b46662f1b5b81c7bdd6eda046efeb8
SHA512cef7bdf8f4fc5754deeb169f779df513efb4d0822ff398ad09dd223170b8371fc1073488dd2e961792d81cd43807fe762e0c875b15d6f665ff9e4bbf42e74163
-
Filesize
8B
MD50d9d69997db0025b663b495f4d384305
SHA106cccbb4f1c26a9d81ab467228cd658354a3e994
SHA256fe442b1c5735383bdbcfd02a76841efed9cf5853479ec4f7369f5a7eb49cbfb4
SHA5125f077459051eed1b33fb5a4329c8ebb30be70b129b6daa6fe888f0d73a61e52f5528274209d4891c71a3304d3a712b2f3c5b1ff899f5f78cb36062aef009dc0f
-
Filesize
8B
MD5f5e57d01653a2d864a3ef836665a8c89
SHA1763ba4e0da833f1285756893e93c693ba8d48a05
SHA256b1a7c954bf0b6f0d5c199bbfa1ad0c72bfc01e996322eddb7d6bf7c19289d533
SHA51218ffba01d547bb9f4e44c15e79d32817b1d60796a223cfd79fab395d2773d0f1abbd18ab2d3e91012ca175952fc5543e201e2ef26ae5abf070d6b589a2ca1d76
-
Filesize
8B
MD5bddfe075065e2e0b008aa48ccd13eed2
SHA1bcbf89a46d9d8b3a114e1d087f84efbc5b7fa844
SHA256e28a1f7d4241312de7394d9becdce7ddf1bc1daa69e3cc615ae94c6af3526414
SHA512636eb100bb264a693a06644f6d4a47b571810e0a628a309cbb3d1a7ff230310ec5dad050092b738030654dd876ab7f932ad8f60c380cf5bb1a017c41b84d35ea
-
Filesize
8B
MD52153f647d9d987b95abd6862458abfb6
SHA13b880c61e901a82a6cfe5e12c8cbe47b78608f55
SHA256911a96813b9482551a1e0af13cf40794d535e444599fc02ecc0d4b3af2fe839a
SHA5121c919f267368914319409e55fd5541190d53a171e28a028103014388170866664f395722139ab5e61d5002f84d366bb93b73b5f459797dc85f8b92e6d97f2bd9
-
Filesize
8B
MD5cd4445f4fb0ad94c555c1027147e6038
SHA1a20a4adb8f306bbd19c6b772024a400134792eff
SHA2563d397ab84a6e60ffc0588b78116c5ed1206bd52ab3af99a5488cbe4662d478c8
SHA512f56730b1b4d8482a800f2bf6bb5a8e165d629bd93cffd41a9701e3e744888cffe2a317b9a265a6b0dcf2e7c9a8426327f36c1314725479db9e45460a1174454a
-
Filesize
8B
MD5026e85d4f994f0606e882c51d1480e71
SHA1e3c0a359e9c343dfc85fdfe23dac1ea20d1ec9ed
SHA2563c5c62fbbeaebe8fc7f0a2f7fbdb1526c2e009bda1ae81dbf58ff969fd9dd800
SHA512fde886485cacf90d86e027531395ab92fcbe82ad9884020282a19afaaccaecc2281a35f3fb070e3abe58b25fcaf3d72592d8b2deef088fd19812944f2a7ce3c0
-
Filesize
8B
MD5273bef653b7593aaa7f10ed5c0f9f94e
SHA1bc6089c2149267f14e4732fd7454a4c906d3e477
SHA2567ccef9632a1c4dbc0c1bc8a3d75111afa9f4a93e38036439fbfe87330a0abcb6
SHA512e890b57e58181c1111a71692069d3aab07e718ac230bb744d67f8d723af4ec984e07d2754151c839468de83df069c7e0af1352241eafefaf7b3c34ccd6ba4539
-
Filesize
8B
MD58ca0cef374c5fd5f38a21f2499796064
SHA13b0b1859b158e364f36e253f730cc98d2532abca
SHA2567163380b26b2210bedf64c9228058e46727213a607901b7189e0187aa68187eb
SHA512c62a1f76ba4656dc308a3a5c2fb9cb09366a48b61a2bb96f16c0cce69309d6d2c0f28d0d7fda0a50f818801ba81a65d5f9de6aeebb2e4a7fa9a8a41f5a8de5ad
-
Filesize
8B
MD5bd063170c49b61ab7377fd41c8d44cf1
SHA14911436688ee5eafda594ece958ace0fbd22f42b
SHA25613d504856927d50fc4d94b8619af493182f1718e8402e236b58ba19f63236234
SHA512f1fae18b95c76397cc86a66b2c5ca1d915faed6a35bc207f2c1a949cc8873cebe4f06aeabd7fee70af59ac7dd6b09074447b7f9acf5bd066bde11154240dcb2b
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314