Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe
-
Size
484KB
-
MD5
db4489c3a14f61dbd6c72f9f07d0ace1
-
SHA1
7f8e6c096fa8039b8532928f2276a5b019722724
-
SHA256
2eba27da6360056c02be100d686f7828a2320e6c38bfae483b160919f0b367d5
-
SHA512
7d84d41d3afb0016a64f765ac23db03bdb329442bf1f4bf81b5d1e5a59267c8f22f6cf2daa829f0449135931a64435e4ec752d9d33ed117c37b41b12b31c0a69
-
SSDEEP
12288:fKS1m3MwkqKwojlmsagDgkiCxmm6pjlnE4Ids:fKS19gojlogDgTm6pjlnGs
Malware Config
Extracted
cybergate
2.6
????????
eto.no-ip.biz:84
***MUTEX***
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
svchost.exe
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
123456
-
regkey_hkcu
svchost.exe
-
regkey_hklm
svchost.exe
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\svchost.exe\\svchost.exe" JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\svchost.exe\\svchost.exe" JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PHN75062-G5O4-V02O-IFGT-3572XB4L4820} JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PHN75062-G5O4-V02O-IFGT-3572XB4L4820}\StubPath = "c:\\dir\\install\\svchost.exe\\svchost.exe Restart" JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{PHN75062-G5O4-V02O-IFGT-3572XB4L4820} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{PHN75062-G5O4-V02O-IFGT-3572XB4L4820}\StubPath = "c:\\dir\\install\\svchost.exe\\svchost.exe" explorer.exe -
Executes dropped EXE 2 IoCs
pid Process 3008 svchost.exe 1832 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 776 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 776 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 3008 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "c:\\dir\\install\\svchost.exe\\svchost.exe" JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "c:\\dir\\install\\svchost.exe\\svchost.exe" JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1364 set thread context of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 3008 set thread context of 1832 3008 svchost.exe 32 -
resource yara_rule behavioral1/memory/2388-11-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/2896-543-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/776-893-0x00000000050A0000-0x000000000520F000-memory.dmp upx behavioral1/memory/2896-904-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 776 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe Token: SeDebugPrivilege 776 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 3008 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 1364 wrote to memory of 2388 1364 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 28 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21 PID 2388 wrote to memory of 1204 2388 JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_db4489c3a14f61dbd6c72f9f07d0ace1.exe"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:776 -
C:\dir\install\svchost.exe\svchost.exe"C:\dir\install\svchost.exe\svchost.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3008 -
C:\dir\install\svchost.exe\svchost.exeC:\dir\install\svchost.exe\svchost.exe6⤵
- Executes dropped EXE
PID:1832
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5bbb165b049168a88dd7f750189c6cd96
SHA1310fc5e7be6f5fe8828353a64089f9fe69d3a28c
SHA25650bbd83321f043f1d8c4341cfc8b0476de6d04c8d8216e6d135aac01f4f04481
SHA512c242a751800545f881d4c904a4c78c023b683776f1f582ac4c6444afa4c4cf660c105503e222e7d993c8533b768ceb84df273cef2cfe8d8a54ea6c5195589652
-
Filesize
8B
MD53dc0c7f2f57a3dbeccbfc75ed6d14a54
SHA18947396707e638bc359ef654d726f88a223f6aa1
SHA2564674beb7313e8cf158f54ea1603a67b198d38eaf28bb6fdb3b3f88224e6a5708
SHA51246b17395067cdc18ec22b446dc38a664def8b8d85c233c93c5dbccbd01c795cd16c6250d3f3da2c2d98de367412fbbf8f3125221f21ab6a5bec78e257b182cdf
-
Filesize
8B
MD5dc2c58ba4163075d400de686d45fe559
SHA19050255b9f712c8581423fac92dabd25e63a5e7e
SHA256ac95aef91adbaf70fe3ba8fa05a1a7e480908ba9dd5a8813dae7b8640a0c5d2d
SHA512c6b2e677cf0fb5d1e341e89fa1821e52f4aa99073ce30084f21751b5dda92a5e4a2d604b63613dc44f88ac77ec30a25b0878fd51a62175828f8a2a5fd4893977
-
Filesize
8B
MD5726b007172966dca32ebc6881123c64e
SHA19e940e283a6b3f0ff285416d4f657a3b9d018ac2
SHA256fe401fed1d9b1bb37a75a86ed642f0aee929a831ff4839c8fab1fafbe9054f58
SHA5127bd51d4369b25ad68b45fabf0cf7ef55be26b9f30f7a188abbe1cf2231a90a5e2ebb49294e6cc8f343b1b2543385d2f95b8141d2b3c715730a1172f02b85b72e
-
Filesize
8B
MD537f1a1cec8f93fd868b9ee96066e6940
SHA13fbf3fe2d52747618b45e2635cd1b9f77e750d00
SHA25663e17b7055a85cbcfbe68e4995a45d71c645ed0eb099dffe5e3e158052350525
SHA512ebb58c3ec424034a9bd37670c0eea97f4c2163c1f79fc64e61b853dbaff0e44a2d5937ebf3e337f9fd9ddac8fdf1d3502e4a5856ac4fcd7d58c1f0b07a226bdb
-
Filesize
8B
MD5b9e6e8fbe08f80a5eee3155e403b3953
SHA1938087f986947ea5d38ca22ffd2cdd9fea70dfff
SHA2565bdbe798faffbfc587556543cece3a0e798994b9f166db8fb15779f6487507de
SHA5129929bd3eaf6405e90cf1457901070f3df94487c08405f722d268351085eb16ef23daa71c6467df3225453e5e3a6c8a6389f430cbc4e61e9b4d0364ac622a42e2
-
Filesize
8B
MD53b4914cc4738dc63c22b25c886e31352
SHA18e2a93451ba83952e35a62ba1457d1a45320b01c
SHA2562735eead012850ea1077959672f3522ba2e64d5e62b887145d0c6aa64d4e2515
SHA512c2fa6cc2f8888ada7fd0a81ba96c5f3984f74b61a9d3c9fefcb6c867af19e6f2a54436ddfaaa4030a34fc28cd7f6539b269fd7a889e8b595e1ebd25f2bcbcd2c
-
Filesize
8B
MD56f922d67ae757ae056b7e0066bbbb51a
SHA173523f421fe39698fa1987d2f9acaf47d477976d
SHA256c66f75fdd4d2c3f8528338f0c9bd6441357d536ad8e09521d69c1aad11a0654b
SHA512975a1c59438bc01d221e1e5ff615a65fc224cfbb9277e37181be411f9beb87e530faed863a37bbed67abc4ea82feac18693ac0b8a45c6b39fa6cf43c49d7f464
-
Filesize
8B
MD5bbe915ec567d53327f7a34ec241acdcc
SHA16c92b4916f8e1da7f463212af13bb49e6adad880
SHA256f763352bec58e37a62f81da4217ff14e9f449f1a61e4ba86b90cb8c698ed59df
SHA512f7937e58f8f65590493514786092b78b70b6d4e11971f69dbf93759774baa99caaf0bc88b2c01f46fb850ba6e26cbe50592a38917bf96f29868e55847cef14e8
-
Filesize
8B
MD50c055fa52dfe37b5ae29f783d5b0fdd3
SHA1641da43b91cf4b25e69c3872695baf3ca68e8c81
SHA2568339ba172063b5feb30363475a5d12ee1d4fb3ae9c11262761fd29093b9f65bc
SHA51240522ff39d8c78e1b048c76a6ef10feb4af95ebae543e63cdd4d9eea3186ec873cd9b4127a6bc9c66305ec90b90cd87b2c058f5a8b5f0b94864f8230b5466515
-
Filesize
8B
MD524f1722d5e3567e88cc4a458e9b6db3a
SHA1e3880b45923e70725eb9e4d6be41117e4b4ef125
SHA256a201f77b85fd49788db0a343bca7543b8b45206b1bc6c5e72786a9d2f20861d2
SHA512f321e1fdb027c7d48e8b56d31ec96968625ffcfa5f8a473c62e17d90d3e5de7ed98e8c75501b1ff845f1406df981026c04ac30df4ee6ce0680bf0dd214bfc50f
-
Filesize
8B
MD54cfae82585a104976223eb4b2cb52e37
SHA121a2dccb55e9fb8c5ea5a38a6925c4bb3a765364
SHA2566619bf4ab2cc6341b902ee57b1d5bb6980e10c15975267fb22de5d8b8b4721a6
SHA51219afbc22c9ac0fb8240bcc01492248c87478f2d13ddb8f677b391cdeb1b0343933dc325f607d010c7c72169b035fb9cf9d07da38c7278dc465c97805b4fbdf5a
-
Filesize
8B
MD5b77f0c3da21c16fb2ddabc7f56ca28b1
SHA1d421c3fab7e46c92d6fcc668fe7f84f519d970ef
SHA25628653e21784cf71d35437034678a619cf8f1374410fb045072719883a2c31137
SHA5121ed4777854e41ed4ffe294d9faa7cbd75e526024178ee18d883f621fa112f289850aba70b7b8ed8223304a2615d320ffa354a49476a99c844e25e01f3822772e
-
Filesize
8B
MD5bcee40c618b6bb58be99fcc061037acf
SHA165241ab618e7db7ca07a8b03f4170123f8f6f036
SHA256dc495380bbed038aeb2c493984827695a7b40ead219382468b8ab06f3028c5eb
SHA5127cfbfc704fb37983fcb522f30609f01961122f8c1aa33876e51a1f4e0f3b04e3e567fc732f146ba9266ac5d9871bb9737650b78dd8426dcbb6cd44b2c3bb86f2
-
Filesize
8B
MD50f87041abfcac2dee8346e3041c01734
SHA1e3dbeffa469a8c46bddea2cc4843d3c95c20131d
SHA25607f42e3d62d7d1d7cc4535c289c191ac804a0cb80a57cb8edf31dd3ea6d8ee1f
SHA5126fc8975d89c783d55f4980b06978bab33a0593e24dec8a58adc206076c6ff5d5a659e9c8e35fbaa173d3c4623e2e4be56189a3366b24fa749213e778d36dc59f
-
Filesize
8B
MD5c4787bc9b60ecee57adf5f038d5fc7e5
SHA1488e86ad1da6dea6be78e7d665f4e50ded978e6f
SHA256c89b1a9869e826e9c336089face2d2e0965cc9874cd1c3d458315df3c2657572
SHA5121f16a841219bcbc003ef3190d3d059ff70ee09433fa19a846df7f1434979cabbd5e03658afbae276ed20e672637ed7dcce14d03feb9c64f2fd30f2f65b0045ea
-
Filesize
8B
MD536ce90f3ef0932e455078b967db31714
SHA12f14425be39d89f0c3dbfc7dcdd0318f19a6c841
SHA2560f35d7c3db13c4dd6e1ab00690b8bed4b3080b52da09dc88bba5db161e2b32fe
SHA512c972df098df5411ab5845b96ea8009969e2128a5e134bd602336e3c8d1f1aec1c0c292f1b5690ff713f349d66a038e47ed1d1b4044d7b3b0635471832dc9fe3e
-
Filesize
8B
MD5ca8874dfd0d38e16404185ec421365a8
SHA1250405cdc2c6bcd814c93de3751dae94ad61c587
SHA2564ce6006227b15d6b1bfb759ccc26a4760d28439f8c84e28f91b755cf46f6556a
SHA5124bf3bab2e1613a9e51586ac62bc6f4a0809a1d4ab5012021c1c998b58587b3ec1f24efb5d161501e53815389328b9bdb7928f983d8167213c38c2e34bd4139ef
-
Filesize
8B
MD54ddcbdedda1856997d363cbf84421903
SHA1790d34123396fa1ed46578303b6bc3efdcd79e47
SHA256b905c2911480b3bd746ef5149127fd18ade5153c21f373b76cec97587378b139
SHA51270681b696ca64187a2e28ae084a2a1740e95751e65397d36446e05fb5f41ffa85a6b64ee6fbe8a1c6e310ffa17ff82d795e162eb328e4e4f049f007b03d77014
-
Filesize
8B
MD51ce143ec5b5c0203812280530a0a74bc
SHA1266ae8505031693107f638fd7819b3b686787d9a
SHA256f4acf91e38839e0840a426bf6d51e11a0da498667f3f3a2131abe216b42de45b
SHA512d2a0085e91f48392143a84cccbe63a186ad3c4ed9bacff087771faf88e05b4484f53fbb8f787262952fcc8ba28ae4fa186779d0361cd423e590545132de74d12
-
Filesize
8B
MD5709ff4ec9cca5852efad64c84b65fbe7
SHA102a2958ec7f1781ea9bea71ad8a3224e35698dcc
SHA2565d2e10a88c9b036a9ce90b99ac5a6f55189f7579f302bde849434e6a4236a4ad
SHA51220b4fcf0f4f16d09c93f1010ae5b37a98e7ad87b89f84ec6cac2181e12894f670d71b4e6f24bafb71d4676656e388455881f54a2c721e6e3180de45cd8bd7988
-
Filesize
8B
MD575b88040d19007f98aa874852647854a
SHA1786f76a9ab8769a8a3a84334ae0ace1341cd3a93
SHA25605ba31fc0561f05826a55a44fc43d44b61d3a3cb8996a8ab73a7b98cdb668bfe
SHA512572b544e95f23e04400ccf14cfa420ed95330d6654290513ba1e701146bf0ac83a4f8f3d96cff699fe9cc51fb5e22fc5d862cad596e5bd4b34671973d9a41a0c
-
Filesize
8B
MD519a595a7026e8a4781e382f300377e9b
SHA19db6aec3362dff2a19d2945fc76d2887e065ea37
SHA256059e811b11f285b0da546e53dfb27699a09e5c89c30fed4ea38749bae042cf1e
SHA5128cee38aef8bd45e56f62335cc58e32e1a695d7b75df184bfb70682bca76727e310514aa1705980c2f9014195d0dbddb76525bab31c8ee81cc4b881ec20c1c12c
-
Filesize
8B
MD5e1d109898087e4a48e30b857665fcc07
SHA1fdcf060b1123f7df2990d714db470009c22e332e
SHA25683bd68bb69051caea8d2a6166237421735ef227a248706f9957a659ebc113f09
SHA512e0d01472032cea75e740e848b5e855991b4a3f4e4745f48e62f08343cf0c6aa3cc6a480b82c9af3dc34100cc453653868cb1c5ba4c735b02a6c59bbcef9674c2
-
Filesize
8B
MD5cb735ff03f24fe806ea9e4388152dc86
SHA1cf9c47472c79193a148ce8c68330ed393b1cdd0a
SHA256111ed999435c1f1d432b45b856f5bb13cfceac10aa844cdb2713b5d7cdf3ba51
SHA5126d7d18bba1093b5a78c5c5117e20ce2b927647def6f5074996a4d9cdb9c5c7d6759c88344f83814c9510632d24737705afab5f349e212231b6d8647563afce73
-
Filesize
8B
MD5e8a7716a5bc12d30dcfaaf67ef0f2a8b
SHA1244c8f0c36445b8852e924543ba08d4ab8c2a6ef
SHA256e856cde126d64ee97c3a63d7d7fd6d2d6496c1b69a2f8ad39c0a69c388aa523b
SHA512db5d759bfb9b79320d95f23dbed3410bafa03817ea2238161412f1d9dfdfc32d569ae321f1df4b8c17753fe04fbb00c7470ec68b98cc0ebf4c41dcd958ca58c4
-
Filesize
8B
MD57b6e1e169647d1c08dc7bc9ddb76d5df
SHA132f093d34f7fcdb488efae97ef0d379ccf405177
SHA256862ca3585099cb826f264cea15cb12612519a9da33b7673a8588a32a0b01a1aa
SHA512e563e2881fb076ecfb1109956017b0aff858ca32142b94cd7dc35d8819513fb1e8450a9cbdc2469bd804f0cf326446df8200ce6e14bbf2e00bdabc41d70b25c5
-
Filesize
8B
MD58ddb1972f69a72f9ccd9be6193dc6284
SHA1f7b9a029de4bfba616fde6d9f0fe25e926c0e4ef
SHA2564f03fc336730688d82b568bb48170cd3badcb410e0025bef5a997902f802dbc8
SHA512446de636c3c229b1077a3a5d10101a06fcabe5782680e8b48b800678b211c34bb9026a833fbc1fc35ab3108ac4ac86b4454653419d8322a9f4cd725dbcc97c5d
-
Filesize
8B
MD5b12300e6c3a1f746cbe06b5af965ed83
SHA127d435a3f734e78730c587354fa2440ede1f71f2
SHA256ba79756d15346eeae94ef1cc16b61364d52510118c2bb441eb61681661fa1e55
SHA512efc5152fae73fdfe80b11faca16efc1c8d9f094f4e6c11c7531755076244d853c9d42ae54568581801168607939f4f00418200fa623841343286db4c2f30215e
-
Filesize
8B
MD5c81f44853d3975534b2483e4bb032ecb
SHA18964d85a9935d4c4ad3e3071e3128eeb2a4dc741
SHA256d5488b1bf35d1ab38a19a7f50b0fd6fc01998e7df811455159a80305662407f4
SHA51265724231cc3352f2e3e1d9d3ec5a82e65cb67bf39d436b61bd58e0bbd0dd277b257f7679213dfabe3545706f6af5c53dfe317af65a3399bfe59da1a838a25705
-
Filesize
8B
MD5427244241db58deb8809b37aef631065
SHA1c2a3069d10a68f5ebf6c04b4ea4becc03e292fbb
SHA256be684e967775d46be301f0104cef3256b31547f0c2eaeb23461490b6121405b2
SHA512ef18c8a493c84142213b2e198df0d8e301471261f28e0970583c48ff2e1acbe9456d946a8d765ee0120d869409736294692a2943aa57d167f6ca9feb2c96e812
-
Filesize
8B
MD5d306519ee407c1b027d8b71b4b539233
SHA1da0f58c19e49d6f4495520a1598480a2e5d038f0
SHA25660d027d48b5ebab3a6db40b470d92e81cefcebd2689bbcc7c3d4a2dcf34a792f
SHA51275ad94aab2724844522eedccd7f31a91711f8106cb06ea9193335a8f20fa2cf05fdea8ced792045384cfd364faf59a1fc038727743e7071c5dbf6fc4ab0c3705
-
Filesize
8B
MD52c9425e732bd3a8c7c4719fa5db61cd1
SHA1801d8eb31cb573239d07b5ecddf578c4dc769894
SHA256a9c843073e1fa3085f2ad46b3dcca3a906510b246118467d31a0031c7250fd81
SHA5122e7526ee4e0f710748f51a7bb49722748d87eeb9e586a74f7fa7447288e73fc719d88b3573f70d69d1ccd7a27564c8abac7de77af98d1d84855fdfc3b579bc97
-
Filesize
8B
MD56d9556cf17c821c7e18ae8e12db5615a
SHA1e2dc3d1ed3e43f5dfd334b8ec5425648fa0ea066
SHA256d4f5eb24021d0d17b9e4a608f09b2fe4d57c6d931e1ec600da4b4b20c5d92bfc
SHA5129080d39411a7d27d8fb2b5cbcaeaacce0af0cc187384b1156754de5a3b4868bca5ae6d61846fdfa394748aa80b7912970130743e2c1f4cc8116f1a9702a2d5cd
-
Filesize
8B
MD57f8155d3b9c12c9d364dad2c61524272
SHA1662c30d0f72090bc4d9cc8b482e1ef48bb838b99
SHA256cc6cfadfc3ff3f5ed55223483be9d468bb13593d7e63c97a9cc29e1e43c8ce0c
SHA512dc86c5e56244bf2fd27520f4612e2af9551a300ab2261d63ddffabdfa74548f699edbd0c01c661cb988145d56fc69f4a914b1c73ab42d7bbe9030417102bee37
-
Filesize
8B
MD52ffb2147807e4875f9042bc6177045e7
SHA1044fc7a692b29f051a0838dc58e2a4742d7bce14
SHA2560ded06ea77559554ffe8b41a46f8fdfa8013af6ed9293af2d0c7e06203f34ced
SHA51227b8877b763c57a7d4ecbba6f0c591e120e998c1592b6e8fda1ff33a28afe9f2317ef5bc2b5010f032a503187d18bd5b989cccc9b0b122d7b550d003b2133f67
-
Filesize
8B
MD57da96dc81e26134e30421cb7ebe9767b
SHA14b93c95dc902ca1905474b5ea365b280e6be73fa
SHA256b8d839695a8133c6c6d8cce119e5ace232b6ca06456743ce5e2b9c2a2deaebc6
SHA512c3ef266776a8fd2e58aa1f0b4676612e743c85121c11d604a55699a96f08e9514226c7ad3df25fdd57bb7777c7ce368fc37f14a7fe8540ce5913bbe3211f6f23
-
Filesize
8B
MD566c49d5d86278401987118df5b005fae
SHA15cf0593a473726332249e3676eb8d0c6dbdbe7d8
SHA2567909f7a76472c4b8d8acc5a293cbe71ab930b98fc1923b71fd96055c1474c770
SHA5128867c5f6a9c36563a80554f1d7d9909e49f0f8c231dd2c0af01418e9980e750004cac293d0a34a0db31c84b88faf0b76203706fe537ccbc9ee80f39368208a3f
-
Filesize
8B
MD5504d69025ca3ad5d9bbd79fcd6e665dc
SHA1cba8186393d1525d66f3401eabdd5b44c9b404e1
SHA2560fa96962881a410e6ec93f6ca848582791b44e9c7c62d0ac4e9a196c2c50ccdb
SHA512160af04d75ca75d05a6fa2bdf14bd8f82927661a025a1c76a6d13b081a048f36b5d10a396c224ff4c50a3055db07d84ee273cd90a28914b7510f5b1a4dbf8e81
-
Filesize
8B
MD57d7da27e8a84749e881bc3e7b310a672
SHA19b39780522ad890f3c104f3564c29aecfb5d50bb
SHA2564cad35efb785186418adf44665d4266dbf1802bddd307e3d85387c8b5219b647
SHA5127125a2fc463f7f28707774d37fec0177f377ec3721ad1cb0124041ff1a2e5f0b905cb3c088f3ad2e7b47859107bf893b901c9f73d1127a941e4d0fb061d6852b
-
Filesize
8B
MD519cce6e17331a7617ae72d0b53452468
SHA15dfaa0da977c347ff9eaa6f8bac5f0b7521da7e8
SHA2567237b245407d44c79063bdc661517e91bb1fa808f5d794758ad4a5419816150b
SHA5127353a0a277fb059257c12474a26ab9731f255cc4b1f91f5273c70c58c1acf61ba680eb2cd32dd7d6c504c1d20510be3b971dda08437a910367016430375e934b
-
Filesize
8B
MD50c332e01cf44b3ae3f7374d82653f7fc
SHA16605331a2ab5bf9c27faac0ad95883d778829688
SHA256b6eed94011de8a07c888e164e18c89edb03f98cc7ab968d9848070793860db03
SHA512e983527be02b9824c2bc255d66f5795a74ad056cbe4020b0fba59db1c22df58be5009aa78ff7d09b0acb7a1460c932db1a8552d87646f40a71e099d7383e1dc1
-
Filesize
8B
MD5421bffd767bf12fd7b7b727b0cc8bef3
SHA11592b6b130e144a0908f69cb30a11267542dd2e6
SHA256b9866b555d931a384936faac160177aa63c588f0bc6b2eb00350e46ca859dab0
SHA512df5095f21a075c3c75e41e2cb237401af7809e295354e487c7d35cd1903334afc97682a2ced006b8b8b3991d5bee1c831dd6f7d5493806c75664f33bad38b840
-
Filesize
8B
MD59aeab3f6f0428751e82db34dffc5e38a
SHA142ede904c43bbb065c2ca7c350c79af5f8de1a05
SHA256c24d9d00cfeacd4b7f04485df78f9a8222178e9a99ece525d7654f9ebcfbbcdd
SHA512a862eb2c7970388c0958819f8484fda705fb949eaad7d174512a4518923f89426b111f126cd98441f881eff733c18b100883f94cd46f0e8eb7913d17109f220a
-
Filesize
8B
MD5ed5ac27dd43cecb661607c2ab99473ca
SHA1223d7247633a08fd0decc6fa121bf85a36938725
SHA2568a9362ef14301aa4ddaa2deee7d3f360ec0241b8fcb3bbab95ee3a3b3421399e
SHA51290dee7ec0466cdb1e248dd964c897778bb48ce5a4df1dc3500329615f77e150b5a75550fd27208b3528e4ba275636a07bbf3d33e0af726dd24375118499b963b
-
Filesize
8B
MD548f40173ce6b8af4202045e62af293bb
SHA1211216ad65652e024a61de038ef930824803d7f4
SHA256b24b5170d4137a1e9b7b3d8fd667588ae3edd8eced924464617cdc2c70488d83
SHA51296b8ab42f4a13c9d71240124ccf200d8ba8a1aefb2b2d79d401ee4e4812857c86d29e1cc67d881d00287e194953bd7c13e3998cfd1d2d0218288788096d7dbc3
-
Filesize
8B
MD588fcca534292e61ab67fe91bfdbcbc76
SHA11ee1fb3fc97e91a14a1816fb8084f0e725d35e18
SHA256c6d20f4ed7a8c6e99e043de7ac0ce4ef5d7f757e788a7fd2b77c532b743e0664
SHA51296cbf42167869cdb78afceb4865b4a42ed83684a7737d066cafd7daaa3f53603533fc756028ff1bbd6f4c5ee58d88c4a34ba3434fcb510690a9b456d6bb5cb9d
-
Filesize
8B
MD5fd0ae02cb616a48653227006cbf490c0
SHA17a37934025403d2707e2350d87e3645c9e6a69ca
SHA2568238a7bb38690bd20e89704723a4a73c5e40d92cdc9a642fcfbe450dff1c02ee
SHA512c84cf89c6daba7e2df8c8729b2cf70bc3e733d75d510a794735b3d41b51c98335ebf72998759b1fa41ef8b30f742fe1c70f5bc678e8f303a76500a3649cf2209
-
Filesize
8B
MD5f62a6d538b91af24b8a556ec2f37cabe
SHA1371a7af8f86586584d0130aaa7357cbe8668d757
SHA2569a2fb1bb0ce2c833b20591607ae07803c1871118ce08c083af5bc059d4ac4d5b
SHA5125f9649741dfe13423779bb568ce5dc672c996948f4f60661467799062d031b4a3543fb029e52697f47720f946e3cfc3688568717aae53864e00aa419dae9d079
-
Filesize
484KB
MD5db4489c3a14f61dbd6c72f9f07d0ace1
SHA17f8e6c096fa8039b8532928f2276a5b019722724
SHA2562eba27da6360056c02be100d686f7828a2320e6c38bfae483b160919f0b367d5
SHA5127d84d41d3afb0016a64f765ac23db03bdb329442bf1f4bf81b5d1e5a59267c8f22f6cf2daa829f0449135931a64435e4ec752d9d33ed117c37b41b12b31c0a69