Full Report
This is a weekly threat intelligence report review from RST Cloud. This week, we analysed 59 threat intelligence reports and have summarized them along with the extracted relevant metadata. You can find below a short summary of 10 reports, related threats, tools, threat actors, a link to the source, and a number of extracted indicators of compromise (IoCs) from the original reports. More granular information, including TTPs, on all reports is available via RST Report Hub.Title: 2024 macOS Malware Review | Infostealers, Backdoors, and APT Campaigns Targeting the EnterpriseLink: https://www.sentinelone.com/blog/2024-macos-malware-review-infostealers-backdoors-and-apt-campaigns-targeting-the-enterpriseSummary: In 2024, a surge in malware targeting macOS users, particularly in enterprise environments, was noted, highlighting threats such as LightSpy malware's adaptation for macOS surveillance in India. Notable malware families included Amos Atomic, BeaverTail, and HZ RAT, with Amos stealers specifically exploiting AppleScript techniques to steal login credentials. North Korean state-sponsored groups were linked to campaigns targeting cryptocurrencies, distributing malicious applications via phishing emails. The discovery of HZ RAT, disguised within a fake OpenVPN installer, and CloudChat Infostealer emphasized evolving tactics aimed at gaining unauthorized access to user data. Additionally, NotLockBit ransomware emerged as a potential threat, capable of encrypting files while exfiltrating data, indicating increasing sophistication in macOS-targeted attacks.Threats: amos_stealer banshee_stealer poseidon macos_bkdr_activator lightspy contagious_interview_campaign beavertail todoswift hzrat cloudchat_stealer qilin_ransomware notlockbit cloudfake rustyattr bluenoroff_group vshell winnti_group brazenbamboo_actor dream_job_campaign invisibleferret lockbitIndicators of compromise:-------------------------ip: 95[.]164[.]17[.]24, 45[.]140[.]147[.]208, 45[.]77[.]179[.]89, 43[.]156[.]13[.]232domain: buy2x[.]com, matuaner[.]comurl: https://103[.]27[.]109[.]217:52202hash: - sha1=40a2ef0be85d4fbaf52fa29aa6cf81a22a50b2a4, - sha1=0f7c492ad72741d70396b43d394796a09e2ec2a2, - sha1=0ffc73ea4fd20cc8d293eae67d0a2c51c76a797b, - sha1=2fee1f933acafd92ffb2152058786e5e9996123b, - sha1=3b4366d5a1d7a59fa6600ace9f666767b00871d6, - sha1=5876eb2770505a6a20801a0df533edd6b3872d11, - sha1=73a3a34d64f199a2f94545e1827d43e2e87f0dac, - sha1=85ce988064d5ac2a927f2ee46e5243e3ef5dabb5, - sha1=8abe82f6a083288baafac75227ca9ef54d405495, - sha1=aa4556b843d250a54d06bc3b2cc36a52ea645b35, - sha1=cd70d69ed034eca924227a89391237342d6dcbdb, - sha1=ce912458662aa0f5859c679be137fd5b836887ae, - sha1=dacb501872f6bc1741631ca1f7cd55991806a00a, - sha1=3efff55f643010647ac72a6761da38d934052140, - sha1=65f47b3297e39e85a4c163184b12439797fbac11, - sha1=7b13250ac5d8cb908bf694dba6e7d921f4d1b963, - sha1=23f3b070aad47f72ddf2d148f455cce2266901fd, - sha1=2e8cadad5ab90651ae36fb09fb386ffd91bd0d41, - sha1=367362b4ab6384833752b6936c296f3746859b82, - sha1=6c19a41d033ccc39bd42bc2f2e830e1f5808ca15, - sha1=c9611cba90349e78b6051c299dc8d012048a91a4, - sha1=6ab4179d673082ef03d8b200a2a70c251f058d4f, - sha1=cb8f4ad08b9715a16158f5897ad51ef38c4cebb1, - sha1=4d23cbaf34463167a3c51f04e2f20a607578b118, - sha1=78027c3800ff58321371a28b1e2a6d7e870add60email:Title: PlushDaemon compromises supply chain of Korean VPN serviceLink: https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-serviceSummary: ESET researchers have identified a supply-chain attack executed by the China-aligned APT group PlushDaemon against a South Korean VPN provider, involving the insertion of a malicious installer for VPN software that deploys the backdoor SlowStepper. This backdoor, tailored for Windows systems, is equipped with over 30 components and facilitates sophisticated cyberespionage operations, featuring dynamic Command and Control (C&C) server communications and maintaining persistence through Windows registry modifications. The attack, discovered via malicious code detections in the legitimate installer, underscores PlushDaemon's extensive capabilities and their active role in targeted cyber operations across multiple countries, including South Korea, the United States, and New Zealand.Threats: supply_chain_technique plushdaemon_group slowstepper mimikatz_tool dll_sideloading_technique sandbox_evasion_technique todesk_tool qqpass webpass_tool realvnc_toolIndicators of compromise:-------------------------ip: 114[.]114[.]114[.]114, 114[.]114[.]114[.]114:53, 47[.]74[.]159[.]166, 8[.]130[.]87[.]195, 47[.]108[.]162[.]218, 47[.]113[.]200[.]18, 47[.]104[.]138[.]190, 120[.]24[.]193[.]58, 202[.]189[.]8[.]87, 202[.]189[.]8[.]69, 202[.]189[.]8[.]193, 47[.]92[.]6[.]64, 202[.]105[.]1[.]187, 202[.]189[.]8[.]72, 47[.]96[.]17[.]237domain: 7051[.]gsm[.]360safe[.]company, st[.]360safe[.]company, reverse[.]wcsset[.]com, agt[.]wcsset[.]comurl: https://ipany[.]kr/download/IPanyVPNsetup[.]ziphash: - md5=ef15fd2f45e6bb5ce57587895ba64f93, - md5=967d35e40f3f95b1f538bd248640bf3b, - md5=a7ba857c30749bf4ad76c93de945f41b, - md5=6002396e8a3e3aa796237f6469eb84f8, - md5=9348a97af6e8a2f482d5dbee402c8c6f, - md5=16654b501ac48e4675c9eb0cf2b018f6, - md5=7d3b40764db47a45e9bc3f1169a47fe2, - md5=3582f6ebaf9b612940011f98b110b315, - md5=10ae9fc7d453b0dd525d0edf2ede7961, - md5=68e36962b09c99d6675d6267e81909ad, - md5=5e0a529f8acc19b42e45d97423df2eb4, - md5=c84fcb037b480bd25ff9aaaebce5367e, - md5=4518dc0ae0ff517b428cda94280019fa, - md5=5fbf04644f45bb2be1afffe43f5fbb57, - md5=874f5aaef6ec4af83c250ccc212d33dd, - md5=c915683f3ec888b8edcc7b06bd1428ec, - md5=104be797a980bcbd1fa97eeacfd7f161, - md5=e5b152ed6b4609e94678665e9a972cbc, - md5=6d07a4ebf4dff8e5d4fdb61f1844cc12, - md5=17cf4a6dd339a1312959fd344fe92308, - md5=8326cef49f458c94817a853674422379, - md5=427f01be70f46f02ef0d18fcbbfaf01d, - md5=72704d83b916fa1f7004e0fdef4b77ae, - sha1=a8ae42884a8edfa17e9d67ae5bebe7d196c3a7bf, - sha1=2db60f0adef14f4ab3573f8309e6fb135f67ed7d, - sha1=846c025f696da1f6808b9101757c005109f3cf3d, - sha1=ad4f0428fc9290791d550eeddf171aff046c4c2c, - sha1=401571851a7cf71783a4cb902db81084f0a97f85, - sha1=068fd2d209c0bbb0c6fc14e88d63f92441163233email:Title: Trojanized Chrome ExtensionsLink: https://dmpdump.github.io/posts/TrojanizedChromeExtensionsSummary: On December 26, 2024, a breach at CyberHaven, a data loss prevention company, revealed an escalating threat from malicious browser extensions. The attack began with a phishing incident that allowed threat actors to introduce a fraudulent OAuth Google application named "Privacy Policy" into CyberHaven's system, which facilitated the publication of a compromised version of the CyberHaven extension (version 24.10.4). Further analysis uncovered that the malicious facility, identified through domains cyberhavenext.pro and api.cyberhavenext.pro, linked to IP addresses associated with other compromised Chrome extensions. The malicious extension included injected scripts that enabled data extraction activities targeting sensitive information, particularly focused on Facebook for Business accounts.Threats: cyberhaven_breach_campaignIndicators of compromise:-------------------------ip: 149[.]28[.]124[.]84, 149[.]248[.]2[.]160domain: cyberhavenext[.]pro, api[.]cyberhavenext[.]prourl: https://cyberhavenext[.]pro/ai-cyberhaven, https://chatgpt[.]com/statushash: - sha256=ddf8c9c72b1b1061221a597168f9bb2c2ba09d38d7b3405e1dace37af1587944, - sha1=ac5cc8bcc05ac27a8f189134c2e3300863b317fb, - sha1=0b871bdee9d8302a48d6d6511228caf67a08ec60email:Title: Targeted Campaign Delivering HavocLink: https://dmpdump.github.io/posts/HavocSummary: The analysis of a LNK file uncovered a sophisticated cyber attack utilizing a PowerShell downloader that retrieves a malicious script from army-mil.b-cdn.net, facilitating actions such as DLL hijacking through the legitimate phoneactivate.exe process. The attack involves a multi-stage chain, with the final payload named demon.x64.dll linked to the Havoc framework, and the potential use of storage services like OneDrive for deploying trojanized DLLs. Collaborative research efforts by security analysts identified similar malicious activities targeting Bangladesh, Pakistan, and China, highlighting the evolving tactics of the threat actors and their focus on using trusted infrastructure for evasion.Threats: havoc dll_hijacking_techniqueIndicators of compromise:-------------------------ip: 47[.]250[.]118[.]131domain: army-mil[.]zapto[.]org, army-mil[.]b-cdn[.]net, at-updates[.]gateway[.]ceair[.]com[.]81-cn[.]info, uat-updates[.]gateway[.]ceair[.]com[.]81-cn[.]infourl: http://at-updates[.]gateway[.]ceair[.]com[.]81-cn[.]info/sspicli[.]dll, http://uat-updates[.]gateway[.]ceair[.]com[.]81-cn[.]info/windowskernel32[.]dllhash: - sha256=136dd864f5772a6567aff34fcbe6f0665b7cc04b2d486004c370f410bee259b1, - sha256=7498a07f903486473cce83fbf16b88009765af98326e1ebef4c48f103b874f65, - sha256=90f43a20a956b5d2e7b73cd3c2a6896a3af032414a297a23d0f07ef2f1016b17, - sha256=207b27f4f17802dc951b6300eaeeaed181ee7567526325f940e66242f54d3add, - sha256=03dc626901d475bed1118e04a53405000b082180d5cd5d1105c1180432cf0c23, - sha256=2a09b5f1429eb2b6049e374200cb39d7075dd962098adb6b61b0bafbcee9b487, - sha256=fe3659fe8ceedc9acbd84eca852f06feeb235e9fe83fa6da2383d17f6e0108c5email:Title: InvisibleFerret Malware: Technical AnalysisLink: https://any.run/cybersecurity-blog/invisibleferret-malware-analysisSummary: Recent North Korean cyber activity has surged, employing malicious techniques that distribute new malware variants, including BeaverTail and InvisibleFerret, primarily targeting the technological, financial, and cryptocurrency sectors and focusing on developers. The threat actors leverage deceptive job interviews to disseminate malware disguised as coding challenges or video call software, specifically through a campaign labeled Contagious Interview or DevPopper. BeaverTail functions as a stealer and loader, while InvisibleFerret, a complex Python-based malware, collects sensitive information and communicates with command-and-control servers using obfuscated methods. It establishes persistence by manipulating user data from browsers and employs a keylogger to capture keystrokes.Threats: invisibleferret qrlog rustdoor beavertail contagious_interview_campaign dev_popper_campaign anydesk_toolIndicators of compromise:-------------------------ip: 147[.]124[.]214[.]129, 173[.]211[.]106[.]101domain: url: http://147[.]124[.]214[.]129:1244, http://147[.]124[.]214[.]129:1244/keys, http://147[.]124[.]214[.]129:1244/pdown, http://173[.]211[.]106[.]101:1245, http://173[.]211[.]106[.]101:1245/brow, http://173[.]211[.]106[.]101:1245/bow, http://173[.]211[.]106[.]101:1245/adchash: - sha256=47830f7007b4317dc8ce1b16f3ae79f9f7e964db456c34e00473fba94bb713eb, - sha256=6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0email:Title: More attacks by Vidar: regular cadence and old strategies still effectiveLink: https://cert-agid.gov.it/news/ancora-attacchi-ad-opera-di-vidar-cadenza-regolare-e-vecchie-strategie-sempre-efficaciSummary: Vidar malware campaigns targeting Italian users have been regularly observed, specifically occurring on Monday mornings, with the latest incident noted on January 20, 2025. These campaigns utilize compromised Post Electronic Communication (PEC) accounts to send emails to PEC mailbox holders, leveraging the perceived trustworthiness of these messages to enhance their effectiveness. The attackers employed a Domain Generation Algorithm (DGA) and operated through a rotating list of 147 hosts to distribute malicious payloads in the form of JavaScript files, highlighting a strategic and persistent threat actor behind these operations.Threats: vidar_stealerIndicators of compromise:-------------------------ip: 206[.]188[.]196[.]219, 45[.]61[.]136[.]48domain: theroyalresonance[.]com, thetriviaproject[.]com, travelonmymind[.]com, treasuredcrown[.]com, tipsaplastics[.]com, tiendabarmesa[.]com, themachinerybuyers[.]com, mdinjlkfcajkjck[.]top, tiendabombasbarnes[.]com, timbreblocks[.]com, thenootropicsguide[.]com, thesacredpathschool[.]com, thosegentlemen[.]com, thumbmarket[.]com, topbitcoinideas[.]com, topcommercialbrokers[.]com, thinkmovefeelwell[.]com, tradeskillpro[.]com, thethailandtravelhub[.]com, therollingsquare[.]com, thetortemk[.]com, thepolymathicshaman[.]com, theserpentschoice[.]com, topfunsports[.]com, tk9frenchies[.]com, theplantedguide[.]com, trapthekiller[.]com, timothynew[.]com, thepikeman[.]com, thepranichealing[.]com, tradespaceapp[.]com, therapeuticpsychology[.]com, tradercompare[.]com, towerhosts[.]com, timchapmanforfairfax[.]com, tk-9[.]com, topdeckshirts[.]com, thereadingandwritingtutor[.]com, thisisdlsmade[.]com, tokointernet[.]com, theparentpager[.]com, theprosaist[.]com, tinytreasuredkeepsakes[.]com, thetransformationalgrowthacademy[.]com, transgenderlockerroomaccess[.]com, timeforstudio[.]com, trailsofintrigue[.]com, timothyridgefarm[.]com, tinkerandtwig[.]com, therisereign[.]com, toocleandetails[.]com, themagicofplace[.]com, thisindiecreator[.]com, travelseverywhere[.]com, treeservicelapeermi[.]com, thesolarsheet[.]com, trainedbuyer[.]com, midhkalfmddcece[.]top, theollivander[.]com, thessalonikiairporttaxi[.]com, tngiants[.]com, thevitaminscompany[.]com, toyland-planet[.]com, tiggy123[.]com, trankvila[.]com, thinkthegift[.]com, trillionserver[.]com, transcriptsearcher[.]com, nzy3tvbb72g3[.]top, time4showgt[.]com, travelingveteran[.]com, tonysschlockfest[.]com, theylleatforever[.]com, trackmytow[.]com, torah4today[.]com, thrivefulness[.]com, topvideoslotscasino[.]com, trinitazcap[.]com, triviasuperxtra[.]com, traphousegolf[.]com, treadpoint[.]com, thepoochery[.]com, tofa7a[.]com, thenoushkashow[.]com, tracyslatton[.]com, trendykala[.]com, theopulentgems[.]com, thinkpublishers[.]com, thernrco[.]com, toptravelflights[.]com, thisisrandiimas[.]com, trappseptic[.]com, tomotupedido[.]com, theplaybackband[.]com, travelinparis[.]com, travelmotivate[.]com, thelovelysarahnichole[.]com, tmkeenlogistics[.]com, traveledcity[.]com, threat-expert[.]com, timecapitalbitbank[.]com, tntwocfo[.]com, triggertrader[.]com, topdiscountedproducts[.]com, themfaagency[.]com, traversecityirrigation[.]com, tonicunningham[.]com, theseniorshow[.]com, torontosegwayrentals[.]com, thewildnotions[.]com, travelzgo[.]com, thezealotbusinessagency[.]com, tommykhoa[.]com, the-tuning-workshop-dealerzone[.]com, themakeitstore[.]com, thoughtblob[.]com, trackedpackage[.]com, thesnowbee[.]com, trinesoulrenewal[.]com, theslightlyfaded[.]com, todayybigbazzarr[.]com, thepluggedinmusician[.]com, tiktauli[.]com, tirionnetbw[.]com, theouttedshaman[.]com, theshopsnearme[.]com, thevapeexpress[.]com, tqrecords[.]com, ehjdilgfljdimkg[.]top, thelittlebigempire[.]com, ajiejaigbagfkha[.]top, tigereyegraphics[.]com, tmeador[.]com, thinkmagicmedia[.]com, translatinotranslation[.]com, titanzinterior[.]com, tourismheroawards[.]com, three-mongos[.]com, thenarcissismnetwork[.]com, tlcmmwave[.]com, thuanart[.]com, theproversation[.]com, fnnkcnemajnnaja[.]top, trendingbabz[.]com, trackercardz[.]com, tonireilly[.]com, theprojectboxboard[.]com, thepernateamannarbor[.]com, tokmanni-finland[.]com, totaltechnyc[.]com, trailblazerwheels[.]com, ghecbjcmdfghfkg[.]top, traveltransformslives[.]comurl: http://ghecbjcmdfghfkg[.]top, http://nzy3tvbb72g3[.]top/1[.]php?s=mints13, http://fnnkcnemajnnaja[.]tophash: - sha1=07380a59b80e6b4a17b5749db13e9eb2492c85cc, md5=f1da6309bc5d21d4ea82a4d70a05bf6c, sha256=597e7a3fe15fb5e2125f66b631719a663eca41d32c01d6d8533554326c5bd0a5, - sha1=c017334ed20d8261d2c4b8370698adc795d7fc99, md5=73a6cd3a145d25249f4fc98e03a592ba, sha256=06d1c58ef9eaaabb7c036a635807916a60844785ce7be17e54ef9d6418f42206email:Title: Threat Actors Chained Vulnerabilities in Ivanti Cloud Service ApplicationsLink: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-022aSummary: In September 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a Cybersecurity Advisory regarding the exploitation of multiple vulnerabilities in Ivanti Cloud Service Appliances (CSA), including CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380. Threat actors leveraged these vulnerabilities, including administrative bypass and remote code execution, to gain unauthorized access, execute arbitrary commands, and implant webshells for persistence within victim networks. Evidence from affected organizations indicated that attackers employed tactics such as decrypting credentials and establishing command and control channels, while details regarding specific command executions and webshell creation were outlined to illustrate the exploitation's mechanics.Threats: landesk_tool timestomp_techniqueIndicators of compromise:-------------------------ip: 142[.]171[.]217[.]195, 154[.]64[.]226[.]166, 216[.]131[.]75[.]53, 23[.]236[.]66[.]97, 38[.]207[.]159[.]76, 95[.]161[.]76[.]100, 108[.]174[.]199[.]200, 206[.]189[.]156[.]69, 107[.]173[.]89[.]16, 156[.]234[.]193[.]18, 205[.]169[.]39[.]11, 149[.]154[.]176[.]41, 67[.]217[.]228[.]83, 203[.]160[.]72[.]174, 142[.]11[.]217[.]3, 104[.]168[.]133[.]228, 64[.]176[.]49[.]160, 45[.]141[.]215[.]17, 98[.]101[.]25[.]30, 134[.]195[.]90[.]71, 192[.]42[.]116[.]210, 82[.]197[.]182[.]161, 154[.]213[.]185[.]230, 208[.]105[.]190[.]170, 136[.]144[.]17[.]145, 136[.]144[.]17[.]133, 216[.]73[.]162[.]56, 104[.]28[.]240[.]123, 163[.]5[.]171[.]49, 89[.]187[.]178[.]179, 203[.]160[.]86[.]69, 185[.]220[.]69[.]83, 185[.]199[.]103[.]196, 188[.]172[.]229[.]15, 155[.]138[.]215[.]144, 185[.]40[.]4[.]38, 185[.]40[.]4[.]95, 98[.]98[.]54[.]209, 45[.]33[.]101[.]53:443, 156[.]234[.]193[.]18:44345, 107[.]173[.]89[.]16:8000, 208[.]184[.]237[.]75, 173[.]243[.]138[.]76domain: cri07nnrg958pkh6qhk0977u8c83jog6t[.]oast[.]fun, cri07nnrg958pkh6qhk0yrgy1e76p1od6[.]oast[.]fun, gg[.]oyr2ohrm[.]eyes[.]sh, ggg[.]oyr2ohrm[.]eyes[.]sh, gggg[.]oyr2ohrm[.]eyes[.]sh, txt[.]xj[.]hk, book[.]hacktricks[.]xyzurl: https://file[.]io/E50vtqmJP5aa, https://file[.]io/RBKuU8gicWt, https://file[.]io/frdZ9L18R7Nx, https://pan[.]xj[.]hk/d, https://file[.]io/1zqvMYY1dpkk, https://gggg[.]oyr2ohrm[.]eyes[.]sh, http://98[.]98[.]54[.]209/a[.]sh, https://pan[.]xj[.]hk/d/6401646e701f5f47518ecef48a308a36/redis, http://108[.]174[.]199[.]200/Xa27efd2[.]tmp, http://45[.]33[.]101[.]53/log, http://45[.]33[.]101[.]53/log2, http://208[.]184[.]237[.]75/fdsupdate, http://173[.]243[.]138[.]76/fdsupdatehash: - md5=6401646e701f5f47518ecef48a308a36, - md5=a50660fb31df96b3328640fdfbeea755, - md5=53c5b7d124f13039eb62409e1ec2089d, - md5=698a752ec1ca43237cb1dc791700afde, - md5=aa69300617faab4eb39b789ebfeb5abe, - md5=c2becc553b96ba27d60265d07ec3bd6c, - md5=cacc30e2a5b2683e19e45dc4f191cebc, - md5=061e5946c9595e560d64d5a8c65be49e, - md5=c7d20ca6fe596009afaeb725fec8635f, - md5=f7f81ae880a17975f60e1e0fe1a4048b, - md5=86b62ffd33597fd635e01b95f08bb996, - md5=dd975310201079cacd4cde6facab8c1d, - md5=1b20e9310ca815f9e2bd366fb94e147f, - md5=30f57e14596f1bcad7cc4284d1af4684, - md5=78cc672218949a9ec87407ad3bcb5db6, - md5=d13f71e51b38ffef6b9dc8efbed27615, - md5=d88bfac2b43509abdc70308bef75e2a6, - md5=60d5648d35bacf5c7aa713b2a0d267d3, - md5=ae51c891d2e895b5ca919d14edd42c26, - md5=f82847bccb621e6822a3947bc9ce9621, - md5=c894f55c8fa9d92e2dd2c78172cff745, - md5=e09fef2f502a41c199046219a6584e8demail:Title: Tracking a Malicious Blogspot Redirection Campaign to ApateWebLink: https://www.validin.com/blog/malicious_blogspot_apateweb_campaignSummary: The investigation reveals a malicious campaign exploiting subdomains on the older Microsoft-owned domain windows.net through Azure blob storage, allowing attackers to bypass spam filters and mislead victims into financial scams via phone calls. The campaign is linked to the ApateWeb group, which operates numerous sites that distribute scareware and employ deceptive tactics to lure users into downloading malware, including the use of heavy JavaScript obfuscation. Key findings include the identification of an active scam site, a malware file named invoke.js, and the discovery of numerous associated domains registered with URL Solutions, Inc., emphasizing the necessity of tracing related malicious activities for effective disruption.Threats: apateweb_campaignIndicators of compromise:-------------------------ip: 92[.]205[.]55[.]212domain: wess1-secondary[.]z8[.]web[.]core[.]windows[.]net, freevidros[.]blogspot[.]com, altitudehighjackhonorary[.]com, javforclass[.]pages[.]dev, unusuallypilgrim[.]com, peanutrefusesplit[.]com, specificallycries[.]com, stereospoutfireextinguisher[.]com, detoolmobs[.]com, besafenet[.]com, jsjiami[.]com, hoanoola[.]net, groostaupy[.]neturl: https://wess1-secondary[.]z8[.]web[.]core[.]windows[.]net/werrx01USAHTML/?bcda=1-866-961-8886, https://xyleney[.]blogspot[.]com/2024/08/xylene[.]html, https://altitudehighjackhonorary[.]com/jwcwub6p?key=9dbaeb330c535e09497e34853b004e28, https://proftrafficcounter[.]com/stats, https://altitudehighjackhonorary[.]com/api/users?token=L2p3Y3d1YjZwP2tleT1hOTY5Y2E1YzlhZDI2MTE3NjJmMTFiNzlhNTI2ZTJkMiZzdWJtZXRyaWM9MjMzODI4MTQhash: - md5=a969ca5c9ad2611762f11b79a526e2d2, - md5=9dbaeb330c535e09497e34853b004e28, - md5=fc86bb79d711de2867bb24722e44025femail:Title: DarkGaboon APTLink: https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/dark-gaboon-rossijskie-kompanii-atakuet-ranee-ne-izvestnaya-apt-gruppirovka/Summary: The cyber threat report identifies a new Advanced Persistent Threat (APT) group called DarkGaboon, which has been active for over 18 months targeting the financial departments of Russian companies. Discovered by the Positive Technologies Expert Security Center, DarkGaboon employs sophisticated techniques to avoid detection, such as using the Revenge RAT malware, signing malicious code with forged X.509 certificates, and manipulating file names with homoglyphs. Their approach includes phishing emails laden with malware, which are designed to deceive recipients into executing harmful payloads, and their operations rely on a global infrastructure with command and control servers located outside Russia. The analysis indicates that the group demonstrates a high level of proficiency in the Russian language and financial terms, suggesting that its members are likely native Russian speakers.Threats: darkgaboon_group revenge_rat runpe_tool dotnet_reactor_tool dukeeugene_group matrix_group spear-phishing_technique process_injection_technique dead_drop_techniqueIndicators of compromise:-------------------------ip: 31[.]13[.]224[.]86, 91[.]92[.]255[.]100, 94[.]156[.]71[.]238, 94[.]156[.]161[.]83, 77[.]91[.]73[.]70, 65[.]108[.]20[.]198, 193[.]235[.]147[.]38, 62[.]233[.]57[.]160domain: kilimanjaro[.]run[.]place, kilimanjaro[.]cloudns[.]nz, kilimanjaro[.]theworkpc[.]com, kilimanjaro[.]bigmoney[.]biz, kilimanjaro[.]crabdance[.]com, kilimanjaro[.]dns[.]army, kilimanjaro[.]hopto[.]org, burkinafaso[.]duckdns[.]org, rampage[.]myvnc[.]com, myvnc[.]com, cloudns[.]nz, theworkpc[.]com, bigmoney[.]biz, duckdns[.]org, dns[.]armyurl: hash: - sha256=d62c20b5fe9e2a633943a0b3832d465ac0bf327b381955b1a0930063ac68b051, - md5=eb155c0c6a44f2435c9962f8366e82b9, - sha1=b7dd4d7c9d15ea3e83cac7b1c9e6beba1772fd57, - sha256=96d08b03c02814ba39f53384766a0fc7e6d649912b72ac4eab8b39851c6417a5, - md5=59a0eb72f40bfdd4bc5ea2867bc976d0, - sha1=573e4be03a1cd28e0ef346ec2d9374d839222417, - sha256=8eaf861e84a25223ce323ef2b1741e4bfce9bc97e9da137fb3cc830ffcb3ea67, - md5=480a10c530427a583207b22e7483faaa, - sha1=7c0bcbd98bc0ad73ef67fed3db10968767c0597b, - sha256=82ecd9b4fcd750238069edef31303f4edbc25e96fa04c7d80fdac2bf764392c8, - md5=db757db83ecf5f21c9a1236b51fda274, - sha1=e4bb79d76229854ceef5cfa9e98351dcb8e847d4, - sha256=1961548350c331ffad9488b4364861c9546506e0c5cf0bb0251620c696939f24, - md5=ae14f85e8311e269aa326562846c5adc, - sha1=4e939df3ad7ce00ea0aa1edbafafbe72f60d3006, - sha256=1dfaa9bb11840c12bfdc5b0238e3798599903281c168fbb87a6b5792555b6b8b, - md5=dec195bdbed2467f38e99c0e0abb08ce, - sha1=54e1e676bb52b707e94d7ae90893f7825ac62073, - sha256=53f5b807b831b140f5d9d638135347391f82106eff4c6ae7b9f5a34c8e1797e2, - md5=1d6f4812b92e80b4a062e8670151a00e, - sha1=14f9c1225077d8968eeda1d3e4ff9ecda777a646, - sha256=318ed4e886a8413fa9085c3549c937b33cd23c9376cf4e4874d3f643015f7cf8, - md5=3453684c1575fd9c4b095cd01769a171, - sha1=3998c3f48e847b3cde240653568b7e952f8c8493, - sha256=83b0e00306988177db2c93cd1e8ce3e98bc903a5985c6e7179adfe00b8e7f3a4, - md5=c3b9fc66bc3330961cff36517decf558, - sha1=29bc553b0eb63a8339432de71a9288bc02644806, - sha256=464086951446901221ca1b8426cb171134911e5071581531b0872e220ac7d0ea, - md5=24b4ba4bb2d848f66709bf60c1b5421e, - sha1=84f34078356ba7b8dfba0d063207b7aa5ecd9fca, - sha256=ce7576d0da2620a06b4a3416d0ee1b800be393c56b5c5cdd6478059a65e55c4a, - md5=687d2713a0165555aaa709137a061e35, - sha1=8c89a4b014bd793e1ed8cc9b3ffeefe040a209c0, - sha256=d387ceab767090c9db27716369a88ceb13c0ac68e7f6dd591fbc3c725f39ceb6, - md5=b0ce67269f4b7f494a63ad7b2bf7f146, - sha1=cc06679565b31d966033d39f89e4fbc1d398898c, - sha256=a74c395928a5f7c6e197d988dfaf94c82856c0a82d979055469041a0b177fb0d, - md5=3780bf16dc589837d65f2ed8e6837968, - sha1=1db0ad10ba0466a527b145ece3319e35948d7053, - sha256=e350407e3250a8aa84a53b79e1c65200d31fba7d8e64663c29e24367e0c20723, - md5=515b77d02055e9217af09bbefb7ea42e, - sha1=c3076f6618ac96d622361a2780a012ae677b1184, - sha256=c0222cd66f7b2038e006e496df5d2104b09e7cbcd87525eeb21bea071b67a6e9, - md5=cdabe7a789ba26c37bb82abf06dc1654, - sha1=be19697d874baad8a843b6ecf5bb96a2eb088d62, - sha256=415cdfc92a28b84c5d1276bb7b65fcda8677998c440fe81538626756906e2506, - md5=d344222741ef0cbf71c4fc79fd771cd7, - sha1=df1971a3595d17980c510ee1cbce487ec8af59f4, - sha256=251199578ccaaf1fcee5fceb4b3bffd1e2aeed67d97c561c94c0755c91ce4af6, - md5=a7b00f116bfb30d418a791bf8f87fdf9, - sha1=9725b79f1bd37a071268a4ffc02616893deab46a, - sha256=ac78fb0033bf536de83e559b9490261cfaa75392ec751cc928828710ec0981a0, - md5=58b687bb41b1ebd58c1ea159311d18b6, - sha1=978677be682efe0ed0136263d0cbd9c5a08cf361, - sha256=3fcf1419f9d59ff8fbedff0449dc9d4634b286997e6dbc5ce8de80bae18431bf, - md5=7b60ae06df9d99ddfb8caf153325b02e, - sha1=1707f861477546f8f43dbc99654bfa31a3c83106, - sha256=ad0d2f2aee4bb7e7e5a1796380574021c83b8acd6dcf7d2b5576512d3e4a79ec, - md5=1656d88fbb4d65fbfb7be8f67996a56d, - sha1=e5865394437972d44eb3e7a49a4825ab92ac9a1f, - sha256=edebe2c233d456db064a78e34c3c4b408cdea43640f251766337afb7189ab885, - md5=dcb61f1612851918649821a5c741dfb2, - sha1=6b8ea28022b80ad8571c78bb4f172b527220057d, - sha256=5f0b59da66aa15586a62482e1b1c21c140f1b184aa44ac1b54e5b32ca5f5bf22, - md5=243360d1052a3c6be7d9933dec278650, - sha1=f98c546b4bb2db8729af83dc1a719514828915c6, - sha256=1bf002333c7c6ca59b4fe5f040939786dba69c5c9349b01a30a4a62c7b874830, - md5=d4fb75723635c6143a524ec0c2d2a2dc, - sha1=09714f053631d6802a4a317270cea3f29a42bd06, - sha256=35fef296455be6d5cf6e1e561063d9493fcbd2799235bbe8636e2f3791dd0731, - md5=8010dcaeb467ce1c6cef72e58c6fae17, - sha1=3bb8d05d4994ad2b6ecb3b454e87ed1367f512ec, - sha256=908de039657086d6dd288d7f3f4122cd871295c24fcdf67572b5a2a56c522cc2, - md5=6c0762a9be89742be5a37a54f6ead5ac, - sha1=44c3ab88534f87773c66d8fb5f7c32bacc4ff346, - sha256=e82bda68537592c26d525a7a7d5f29bc3348f9929a2b650e08590fb8b0f6515e, - md5=a94d883f586089346b5b9264b40e0690, - sha1=14ed257c0e0f6f7b5fab3309fe39c2e84ff819cc, - sha256=79710fa293c11acf4083006f5221322cfc6e7368812350dafff53128ba9eb71f, - md5=7d07caaebbbd218db51eb6af8cf45bd8, - sha1=ab4098247d0fa9eb4a53f977f0ad43ee3a53e309, - sha256=61296e0491113ca29f2b7575812362d7da16a73aa5853fc01ce086b103e2318d, - md5=27c80f363165549bc364c4245676e7b0, - sha1=71c1985991c82c4cfd715d225ed23e6d7b348b38, - sha256=89a3dfebe6346f0742f7894d5b3f62f59df7cb1ea7771fe7e9853c1c2c5c3c5a, - md5=349eb2973907ae04dedf8fda40f65649, - sha1=984dbea185e1afee39c1aead06edd1f25cfc9eca, - sha256=618a8e07a22ff2489f5dd6bdf56dee16375b14167c0d6a4c7e24a24e4fac254b, - md5=dee7216a6afb4243269d0af9e2016f04, - sha1=7342429f01fd466a8b44d1ee1705da7026819531, - sha256=463cd5e6ee0bd5ee223578eb9e0c625b42af18326219dc839971163c65476011, - md5=ca98c89c0d4cfa642b182c0453e66086, - sha1=0afcedf9761c836729643695f4041edd34461396, - sha256=5f7ad5ba04a2d4d9c5ae8082892c8c0fa8cee785e1d65169bd7857ce9ffce45d, - md5=dc3d50663361a2a2544cd21644da2033, - sha1=44fee31809c8ff8322abbbf78210073a6ae5ba7e, - sha256=25cbf53ec5ced2ace43ba4e8f30c7a95ad682959a24a0cabbf094d8a67411193, - md5=279df3128ffe4fd38cdebb4595dca531, - sha1=4f9e4228caa7ebdf3a8788c7a2c41fb78035a987, - sha256=5872bde52d4156065985fa2020b2368de6f4be6e9d0d175b756dddd4a4d0d0fe, - md5=eeb2f69be8c0a2e06df2fa45b4bcc493, - sha1=dfaff58c9ef7c9906f3ad596ec274ae6c9f2dc6e, - sha256=a60204eb19c0492ac3634822ba80a2f2cfadd1e728a76fda291b9fce13773e3e, - md5=bc2ac3787eeee2d61f7509499e08d343, - sha1=3462ec02b0e5b410004a6b715696ff9982db44b8, - sha256=545e300783b887036ea40d2b7d6dc3483b9762558eb82cfa4a4c92f77a479e19, - md5=2557b46b682740dd17d02cf631b34b48, - sha1=a87219c341472d7f36bbe69b99adf51ad81093c0, - sha256=a49ea4f4b33b89788a1d39f82bba6be7df7eab2cd2f11b8ae4b46dd5d42fde08, - md5=6f02bda3b575d8f6b2224e59cffd17b2, - sha1=4a3b55383695132442703ea9a882688381b9abdb, - sha256=8c526b2d24caf2129abe3fd8ac7748a0a51b6b93d2178b89e3c4194511bc80a3, - md5=81adad44989d38838651c3fdc431bf8d, - sha1=d074f413a003e4a016049fac370e92eadf24c6dd, - sha256=104bc62336fda9e617803dfa203b69afc6a3bf443be6e51c2c57e33fffcc87d1, - md5=d0200b355abed369e7696c4e3a998a36, - sha1=ef3a4345def476aef9760d2b5dd180fbe509655b, - sha256=323571478335afa66e66c61f31b20c118950ed4e5284a0978a0c0d2e0505cd19, - md5=88df53188455e49e9941e85a98aa146e, - sha1=6f7315d4823ae343868436b64987992ef3284eb6, - sha256=0e84a26064c04ce1d6e1dc1849e0f8395aeaae5b3f3f812895039fe4dd95b6d1, - md5=0ee253b26481aacb0923f6ce05b1cf44, - sha1=9f17a50af9a82e2debd8db1a2214b292da77a4be, - sha256=d331f1240dfa8db82f71fba51aac1bf35720dec059b21ecbf7d7d519d68cd13f, - md5=0cc162075b8d72b07a9c8823c54af0f7, - sha1=f4ffb57761096813401717b4888187cc21401b16, - sha256=f3e11b1ae18c916e091142af21e9573e036f99fe052233e12dfadc01bd0d25ac, - md5=92ee77113f969910afcb01376ab8ad88, - sha1=f7e4f3d288759b8c541ca123def460a036a8bdc5, - sha256=22564dab62ed180d2388af885ad8b5956a171d8c6ea3199120e20ddd7d8f8ab6, - sha1=a361f67c52d0e9b22b02e13fdf8908d61fc6fc3c, sha256=d60f1f584e816eb6a1069eca2e0642f89d722a756b79bdcf0f42df058fd7107a, md5=8de619e1211bb13fc361c6c189eef339, - sha1=9ffc4c11cd611ffea878bd26a4bc0f60b2fe86c5, sha256=600d4082b74793a65bd90f873d49b95b9a09831957eae9bc43e8025efa42f4a7, md5=cc2ed20423cc4ac4f6ec497124f25423, - sha1=9cb11e7f235ab1356fa05cad912053fa1c1ea4e0, sha256=658360269ef10c399e2f8836780adf309517dcb76ed063f8ef006c9365b8b84a, md5=47f150480c39e1cae21ab2037a99322f, - sha256=acc39fea87a67c907f3ed01598d57fb45393140e0258c9f1120d7c5342dcf749, sha1=e469ced3eac5113f3fb34b798f72ad86fa90d49a, md5=426c1d9ebfe2aa3cf6f6d6b93307d851, - md5=aec40bbacbe6872436a1eed8f1ab3cd6, sha1=1b3b3573f49be10bc30b2aa53362b99bb9fbd926, sha256=e7b5b2001a9a3898cf4b845599d5551e9e270dbecc8f5e73844e4b776db674a7, - md5=13d927b1b27f21055ac442229b97d182, sha256=ca2354b8029f9c15f5a7a21010e142971b11cfc3e7deaa1fc613a545426704e9, sha1=029ddc24febe13ddcdc1c8cc7717e8247298d24b, - sha1=bdea272a98fbc82fef84053928980cde45e98879, md5=cb4db2c54bff1301bb0157911cf55937, sha256=9905eb3f141031643936add68fbf3e2f49562fcfb6d3271659c70984cdfa17c7, - md5=f3571de623faabae7f814f06b2c93c94, sha256=b2a37aa95aea454fba3bcf0f0705e6af9c1f405eddcbcafec56af11b0c9cce11, sha1=a51ff21eea07b20a966093e856a5e60911de740a, - sha1=c2d441d436097ceb969958aa1ba22b3d27cc060d, sha256=cf05356d202f6a5b64246603bf5dcf408397be53f0d7c79da4e5898c7d116728, md5=e89a9047984e660b12a5b9ab415b435b, - md5=32a43eb1e37b9c7969bac01a03f627d3, sha256=6b8940c45350d5935a03a69ab52ca2d2978ad61a0039456317f804f610798cd3, sha1=40ed18ef7f0e2a234d46fa0ddac6ebda237f54e1, - sha1=1db596e5832e81ab24902baa71d5ca8b9af7de7b, md5=90c96ed5e40a93d3b860713cae3da3c5, sha256=fe39afbc105a7dc82de9c15b609008bb2e5b2e48b06ad082e284e6b1061ad396, - sha256=4127b7fa53dba5af732166b986f8bab5e9c40deccaee59bb57f463cd5862fd8d, md5=5c35b577ea065084f3e96cbd0f8c0243, sha1=0b4ee12cf2cc9e95e663bea55b0f295e2efc1554, - sha1=16ec41940fcab7d5833362042f832dfeb18f1058, md5=c6a3d9de5d6a1fd93d1d020a05ef7cff, sha256=f2a16e3108681152b5a1592c14dc8a108f12303ec3dbaed7d6e7ed5d3d997e28, - md5=e8c67849051158fd84aa49516936905b, sha1=5e6ec9c383dcf548a29f78f842644d0ddb7d4eba, sha256=451cb5ac1b10fed28f333c08161a8bd18f9050bf7902e2cdcd08b4df170cc134, - sha1=726e377b9493bbcf3d27605a4c57209d4352717e, md5=d4bc4eed713df39e58d2adfb90a9f19a, sha256=26b9052fa6b82bd0b6611b9acb40b7b12608afc80cccb5e015476643cc896a6c, - md5=9f341a9b66cb61d0866de0443e6f344b, sha1=6c3d9439fe7045d111c1afcc4cf80f47e5dc6b12, sha256=5d241d7d88a14ae8149b3dc129b5156e8d8356e419d9b32d87196d60029f8a1b, - md5=d77682d73ffe9cc89a93a8118c4aedf8, sha256=ad480f734b24c0ec45711f000f61be0e10c45f611ac79df5108f07970f75de03, sha1=d3ea0e553e412528c00601757d0c2d4aa7e79f77, - sha1=fff069ba421988c94f5338467717b15c76241ee3, sha256=c1d37609c3d9753a05b3e47a7600c940f8449499835fc883a45fd07627fa2359, md5=9e91d1d5a0d616547c011d79c52c83cc, - md5=f72e9676262a1396808d3b88adb1a615, sha256=e85cb66f54fcab2f462c3aa031faac56ae0027aa34361a7a54c5db37f97f0107, sha1=3e44f708b3453c292754f2247da6197eaf4006a0, - sha256=9fa2b319304d04b29a5afcc0b586ed271bad121feb1d02b0956050d155dc0fd1, md5=751ddda61dceba005555f2a767af5cd7, sha1=426a40454a1387ac6e5f9a3fb5149fef23c7dc1b, - md5=b71f98cc9a02b21542f7d9501823b0b1, sha256=bbad63c7b28534b58987f1acb852f799668386f67f8bef4dde35d9985d495b99, sha1=05dfbb41cbd0c7c2448471d8e2f03166473b16c6, - sha1=fe81d79df7e3e0497501ba9627962c25693c1f1c, md5=cc9ab55b63738d3320e4249f210eb21a, sha256=cd408aa67ec73ca9938dd4f97e1f520cd106466752c48d41547d9dee38efaef7, - sha256=2139427e9a599404937ca12273739f3c384b2c2eded48f7428f1c3eec856b794, md5=d4a2ce84aaa7a18806aa204088a901a1, sha1=eea84510de73479ca0a9a16f78c881b34e2d0cce, - md5=a2bd3c567dde86e5876190c9089c2902, sha1=2186539943ea3525059d77b37cc6521b5ecec9ab, sha256=9a4a9c7cae60f9e86f9cd93f950ea71ebfc5552e7a40018b156890113415e076, - sha256=6115e9a01a23c503a1f0f0ce3e9b162468175d9e9e2ae1524b259f3481bb18a1, sha1=14b395c740442f639e818794f9fcaf0cf7b25af0, md5=c29cdcd5caba4350c5c0f229b2d76fb0, - md5=9386c473b373ac322c172ffa7a9c4802, sha256=3c82160bf4f88af7f2102161380b6620b292d11e33411ca02238bde7f57e3bdc, sha1=1e65157f1636e8bf637357eeddb045dafecd2e4b, - sha256=c1a8a43a421530b38911d5a90968d4fd9b988734b4ebce6887bea46ed9adbdfd, sha1=a373a49c7df519a019d927873ff852ac73e43bd9, md5=5d6e45ce278e0d44b1a357d1b1b5e161, - sha1=e049e2528e1d888c0f64d875cad97c44cdedfef5, md5=68390daf93aa7ecd3e71f16632b2941c, sha256=55574b157df1fc531d5364af8bcdc131bfdcfacd5578fa25725a1dd86c8506c5, - md5=f4c9ce4fdb369f458523c7cfc287c143, sha1=99950d6ba550a6926004fba8e3b0f00a76febd4c, sha256=c2bbe8d6795f4031da4f40c1fcc0f31caa960e3c7fac00812e866845c74f05c2, - sha1=7907abf0682c8f77738f42c28c5d876373a158da, sha256=1ecb7526a9d3f53a65a6defc3b66e4d187c20754193e157a4a96277ba12381d7, md5=a6b3e2f869228d1a7581bc9dec93a271, - sha256=8f0773735d6672652a52ddba98053f174804625d885bcd9d0bfe9835c522be9b, sha1=0cc25af2613ecfaa6a4069430f7270b695c7e8ba, md5=c68e2326fedafce87bd8343933ddb5f9, - sha256=6338f3c3878f18f009b155022c9c8521d792942fd2ed3f37ca4a6461155ac612, md5=7074ed35684fca56cfdfd7ded4cbf669, sha1=ac6fac3be313f77032173944b18ff7da61e6e8e1, - md5=ef94c674a113e3f007c75ddfa1512535, sha1=62a8d22d3dc93dafa8748f7956cf0f552ea2d076, sha256=ca41f050653e231ec4b7c25b1ed156d88ae1cd627f9dd6f1460a89d63c289289, - sha1=4a6468e5d1ff350de89d81a2e9314cf6b1856a88, md5=267c6299117f96b58c775864e3e748ee, sha256=0fa14c9aeec6a58854deac043017b9a7d9cee865d64ad3b3e3fd181e78fcc55b, - sha256=a908d1dc7cbacd72e4cbbf5bc85473a740ac23ea51b33d3edbf975e008ece9ba, md5=f7476d98bea0e3acb5a572b506394f41, sha1=88905e2b1e4d6bd3d9f1f0462d089a4c2a0fbf9d, - sha256=fe06b1fba9f5b3d9760e1e6757bbdc3f8ffb9a55a588c9d030eff854970bdf11, sha1=da7aefc91d0f04433a6c1d57fd5f754d4abbdac0, md5=6079a6dc617bb169c3d7df8f2bfa6f39, - sha1=c712e28334382af80ff39438ace17a355d701835, md5=d6a50cacee1b2b02b6fd7bc32a29185a, sha256=5e876b74e3887eb943b1c5a214c4c5331b0639de11b40ce964c716c64311c24d, - sha256=830bf10a2ace2a5e011fadf96ba903dba609bbe973c2cdb35fae395b9bb3424a, sha1=104b080660edee8da8c75c062d5846c13f9b39e4, md5=2eae64b0147996ca4fe80495aedcf6a2, - sha256=0408b0ce2bcadf7e691ebdc7003a717949281a0849936854ccb8bd57cf223080, sha1=94767acb48ad7835612e529796078139d648d589, md5=7b1128e4be18609894120dad54aff7ef, - sha256=8609b13d8187533502e11e7e510d74502b9eb199dafbe7e2efb14e786b0e82b2, sha1=2688f6a4642dd181d8895157e0babcd73254a847, md5=ef02968672bb20416ffba82d71d3d91c, - sha256=0698d33b27434e1d50d7802e4d39e938b7b6a86593cc8e327649d736aefe6159, sha1=6383216a740e7c30a3ee5bf3884b976d941dc182, md5=2866dd4b271ee6c9b6c35359f5f725c5, - md5=c620bed95e6a375f15ecb5d04a1ff970, sha256=add656a9fa787834182f2c2f3e9f64479b4f393d434ed2ad5cdb14dc35346d77, sha1=1eb70ad801963239d5652a3c9e2a730e197727b3, - sha1=ec855b0ca576c066a01bca26e03eae93eabb727c, sha256=737a88630888f9c5fba32f209ef1533ecfa5ca1d48a1ec1cb4d16766f2e70380, md5=4e786681aa0421960d11c8d1aee9006f, - sha256=9073d4c068e80650c30325d544dde859a98c93ec99895a2a2e31bde6decfa1bf, md5=f60d132056983a4621b72cae136ac3ac, sha1=ad837a63bcfd84a23022f0a3de11d976fb5a52c3, - md5=827f627aaef021cc65eba223886d34a9, sha256=44ad90c5c9b26eb57351d420ec793353473c8f382dc4cb426c40e4bca4790da4, sha1=8563f056bbaf6e7e3ff8e60c3a1636f385fc8d46, - sha256=c9997d5664a47fac12a286025f182ae425a9cf65795ec237b9649a45348273d3, sha1=aecc6400d68559ba92637292644ade24e02b9ddb, md5=c9ad8f950e975cecfc2e85b79326b4f4, - sha1=0255a5f8a25476e12f9059af20d1512bb246425b, md5=da589a84667a6261eafe5847e7f56319, sha256=e8324f6c83f17fcf233f0cf9580a533734e0862d24ee93212b3dccd7cb50fd65, - sha1=a7ee01c37ad1d63ecdb2a31443dafe828514c9b8, sha256=ed07d8ea813aba7b5fd4112072351cd9274dd03c519f99600ac83e1cd5939180, md5=752baff528973e3fb5e39d9d421c3d46, - md5=97edc7c867fa4d4be767af65c57da13b, sha1=6d514eead25503ad43fc1bbd29594c199bc8454d, sha256=be0e748d7c8d680babc8c19a5f8aa053aaa7eeca1b570927a33599cf849f46f5, - sha256=71eb596ae9333775ba6c3f73edba2823677439d1d6390c373996d3a6dfd7172c, sha1=da09e6afbed98a0f53befd04455d030bebd67644, md5=d0c1e6985cc08c8485f71ded5898854f, - sha1=8cc3577ea8294597d71103fa3a214e8b9d66ab5e, md5=8d47f2ceb9502c7774057dec3f9d2c6f, sha256=b005fbd21dc7866bac98fc8f124d22df37c2344090dc990ad4fd6e30e061c2cc, - sha1=276d525902cb1f7b2ac77c03190505217d33b0a7, sha256=5d2afab2b692a3a3a491f0ac7c32ca2b5ca7d6afd741dc89fe8da019afa65a85, md5=50431e85ada0cb9f89660696d0de0cb6, - md5=2c00037dce09fbcc5903e6a37a5bcf31, sha1=902cd34a656893ebd6e448ca74e68fa8acd32341, sha256=87018b2a9a4e76c20b48ddec1ce40d58585cc2625056fbe2e007ed1556759bfe, - md5=b7148ca558f1410c4282649756c5d9b1, sha1=8e10598646e0a4f043f6aa4da9cecb048ac9d70e, sha256=94a144a927f6c89d3c5ace94016cb26a30abd4cad3a6af6eaa71ae7d0c8a36d6, - md5=2cccd65afdff18a68435a8e316d44035, sha256=b383fdbd9d2e0288b20cae15e75c790d8f2f17d96f678bbb84ea74a2c2e20340, sha1=aa2b6ebf5819f190617afbb8d59d54779fd0ad6f, - md5=3784259e517249da229f773ebf34a875, sha256=9988d4ad835051453d2c2c2ddc871f56318d0bd20abc960a8d5450f1a33b62d1, sha1=e79bbcb9098971da52115dc5358a0f7d16526da0, - sha1=2c6f98d8112b98eff411659f8380fe789a1f4e47, md5=9d270c40d2376950525b2b85b35f3911, sha256=305fd18a12bd241582d7b3cb54412c2d7e8d9ada9ca72b4f59930c403d56eefd, - sha1=afe37a5d34ec5bc9c76fe46a809801274af4768d, sha256=3b949c2a17bba1410c9d0d346d4aa6b9f4ff82115575cec9c5107918b9b9d0d2, md5=660b78dd1ea42c871e048244c14e45a9, - sha1=fc6291dbfb358ecb51f28dcb4ef4b280a7f4cfde, sha256=58c6715a4117932774f68a32c07039d6c545a777cdf1f2e78befeec7693b442a, md5=817e4f78a29084518d82cb65a0b77c04, - sha1=83d24fa6edfa405b610146387e88d5e4b8cf0bb4, sha256=070e2011fcf05104fbd672f34328fb6dce78b2d70f2eecde93c9652013eb62bd, md5=23342493055ff4bc5bb7ec2964732825, - sha256=60d3dd8741a1e0df548d556965538321b364bd406447ebe13da57ec19dfdcb43, sha1=782dd0ac8a66dc4d3395794386683e8adf31b288, md5=40b57a4ea48d7ddfaa8d8ccf81214925, - sha1=f9d0b499fb643d9f852d4f96d81a674312aa4975, md5=7add75a66f0e2d6ad3a833b288e53211, sha256=bd182d73086a921f950e97aaddb743e0c2e6a2c1aaedc2b253416b64e86ab4d4, - sha1=7808b437890814ae5477e9973a2b9da084ceeafc, md5=006986d8a6ad033254b9f167b6798789, sha256=c6e9096a68fa763292e35badb3cb5a3d52b7689506dc236441373ecffaa6076f, - md5=f8b850ef66f87d13db157c84b5e3238c, sha1=c3d13dc88edc3d8b5293b71b38c0360b876ed130, sha256=80b778388dcacf1fb031000f88ff5c8e73405a118816925476c6cf772b21ec2b, - sha1=72bf4e03079ed8d48b3793b74c0326b89118ee91, sha256=6a3a8689a6efac4ecd33df0a90af052515df6f4765cc9568733675f7e1b5194d, md5=56f58a85a3f0012aa0da61b371c07de6, - sha1=e2879de2b4ec82dae772d70a6a368fc4329e2845, sha256=00cbe1459af134db82c597def4ba96f567841b09e723486fed166a9d3162798d, md5=e9f4d0b4cb1cd7fd8f07ff8fcc408c02, - sha1=e60f8e4bd69eaa97d67876d7d24c18f2baefe0f0, sha256=240f5f66096ebcca4faeb7280680dd65e32ff1edca39a6c024d42b91990316aa, md5=a8397eb45301e6911d872bf457ae3164, - sha1=e72e5b2f97c9f64bed57f2ad11d987b7ea087352, sha256=805179b8eeed1c2a298093e1de00d726dc61d3eced24f76faf4922d96f93221e, md5=8c9dd2337b89ecd9e522d51991fd155b, - sha256=7d66d1fb16441ea00f77771d9f5f8b8f274c7f745c6b76584cf9392231b060cb, md5=bdd0e1419661ac5fa690e691ff0bc6d2, sha1=0ab17e18c95cd1eb7c6f7844be52ab0088e5ce34, - md5=63cc73d92a5c2a0bd151c816317e9a7b, sha1=74189baa16069ee19a9a922dacea438c1b85afb2, sha256=6441d9e8e9e83788c1bb8259c6cdd883794b832f4163c16d74aceb65b2960731, - sha256=b58070811b7ebca94b58426c09c10c31259c9990789fe7fb9842b88a629f873e, sha1=b9b20af1fcca43071bb1fca1a428987d935808b6, md5=74830f995386f7d257561def63beb979, - md5=7a083ec5198f69391442b421975eaca5, sha1=235eb96927b719d33be383c5784e4e998fc01bdc, sha256=d3072a5d1cfea576e0244cfd210d175d7afe2f4f454aeab8ba0e2df57961e264, - sha256=5edf95597579e65df018dc17c55a56148b69caaa32b4fae4ea220f242a9ce655, sha1=651b31f1984d633605460fb241715d714b9e0f5b, md5=5d1cb26ca0a24de686a155b0823d0b80, - sha1=77258cb2f1bf64cc605fff99f17e59c31b549032, sha256=ad1c31ce2c59311affd18d7c619590d145cd0ddebf943eeae4c794cc12aba998, md5=711eefb9bd93a1dd4b849fc10cd2abff, - md5=944d8846a4f1dc3b4fd54716b35c7419, sha256=7055aaab46fc5b6cb2ff02df85cf8dce1ed062fecb251742f549e5d1f6cf628c, sha1=0a00a62a79a261b0cb2f7345126b3968f70b9440, - sha256=bdf7066447657fd526562dcdf1f0fb3e34fec8636a2c4090b58253b98caa1462, sha1=b07c8b44c354883b1625d415e99d860e8bbec721, md5=97393818d97b1d8d22a3cb6ae1ba29d3, - md5=1872d9f7b3cc3ed2c1538bbbee36919d, sha1=1e0f53b059452b59cf6ea40251e8b963b331c9b5, sha256=b074c5be825a0f7f7ded0e468f714854d0916b4259c6bf4d93e3cbfb215d282e, - md5=b022a3884a89027ba3cb1e2a6b95c7b3, sha256=26dff7bfaff200a888631b1ba7c58e03ce2ebb002bd0d23f1a759dd58fa1c36e, sha1=bc68e3c37d0329d889a304d87558ac150a25272c, - sha256=f44aa6ba6f076525f0a1d7cabf354d61da6303c33ddefd81538214b585ede69d, sha1=b148d766e795f194d3edb2d22795cf0af9a21598, md5=ffdbcc15aa6915d3f44d3602474df144, - sha1=0da537b2c1465e32b4a21faf9ec2a8bc917b7869, md5=698f6861fa0c0e66f5360ccaa249c3ef, sha256=a2543bfae84cf9be0a3951edda8cf4c5df31be24445a3d6e96e33d0b2799b737, - sha1=b3b3a0e7854a9873ea6568c358f2bd86d42ff43e, sha256=1b823b42fe680328ca55d1e9fdd49a96ee2c11c7d829791ff9fe0f7e29dfde88, md5=9f3c6011d03619f0dc6de422b37fa0e2, - md5=c7d7e6da575689828021c59edc910fca, sha1=70e52e4b792d8f9e445cf2aeca85ebeb9bfed38b, sha256=2e888393913d17f52cdf8aebb23db04b262579f956a4dd16fb8f534c0a657a5d, - md5=d36abc047da1afa573e6b4235051a15c, sha1=60139d034ffc5378d22ac75c8c4305120fcfa0cb, sha256=eecadf0d4699f7fb53f7ad0ef783a80ec52bc0afe97eff1d64a9634b847d606a, - sha1=96f619675c0bf3045c01545e0b8cd4769d1e2550, sha256=18e2db45563229f2545d8d8c04103d87abb2c4c19f7429048e8912f24d8146a9, md5=fb97a19ad8cffcf36fbb1f3afd46947d, - md5=5c8e6073aabdc20655cdd1fecc48d488, sha256=44230f805420ee56f28d6d20ca982dcdcd90f76901b989dd314b2b9958a69fe0, sha1=06e85c1269275956b07bd381001a9804901f271f, - sha1=1fd8d8dddf6bc1518fdc27515de790c1b1e43e3a, md5=4707531dccd330ba45b7ab92ada7f1ec, sha256=c81498928ca3bea5839eede7f1f2f92db59bcd91d95ce4e5ba4130bc83b9ed1c, - sha1=4bab80c3f041171ba9057f664e8f4cbccfb1e624, md5=938aa9008c4883b9ddc6ba04b54e113f, sha256=3ddb7d4771a1b73d578457bb13096994949fbea3f9ebc8c6887f81912dc6ea65, - md5=c7665f96024e7385153bb10bb3c6720b, sha1=3b3a276e3f6d2e63f52c4bc77ee9a7fd68feab72, sha256=4eee369199f6a8e5c03957a5c0d156873ae893057ce9f35a5d428d458874a7fd, - sha256=64e3b5bc412e502c4aea2ff4fba56e9b575a5de09b3c7130015ce37e329a5739, md5=8987cdb78358227903ac805abf0b7e29, sha1=27a75f960fe463e2e8cd462a338786ead98b9fef, - sha1=0ef26f8b793b5f64ed0cd23b6bb0e4ac7a975707, md5=57823f26806b7d0bd97ce6037bab3afa, sha256=af292bea723b80890fb02b674abb35e9efe491323fe4d7d1f16019ec837fb195, - sha1=a174c1fe327562ca975ae7d19bf41802ff0e760b, sha256=4b1162aeca52ca5bd8c5b16460ec74e82d69c55712490a840e9c8a6a09f51f77, md5=9cbb9c5c897f8e5dacfe1f78e61aeb95, - sha1=a436399ac18a9985428e2e5365e4acf1dad3552e, sha256=a9f648b5180522f96bcbc63350188d68c19d5a1d1164e65b833935bcc3386090, md5=ba3796ac7e0f833888be85d73275e41f, - sha256=4f13775086f8150ee957bc1a0aa640e33dbebaa9b32c075faa5b9e832bec8a9f, sha1=3f3a8affdb43d8afff8bbdc90ae5b59524e51098, md5=aaf4a6857baeab637ff895e0c032d2d7, - sha256=217db5019e6476c0a9b82086f7293472855310fc497b450bf593b7f4d74ef5f2, sha1=beea21fd929a213a70d0fd5779d5e73ce82d66d1, md5=1a891a84baf037f7376c1d62901f66c3, - sha1=e4961156fc3fc45ecd98fc6c3ae5ee8e5f3fdd40, md5=db68f317719999e99390a61384487e9b, sha256=2237fa0edf4d29fa10696480f45923989e0b982805e03abadd1716cd6715328e, - sha1=fb993b6dd3faed1462b0a980bc4feafa55f85df5, sha256=660a570fd4e2ac53b1477cbc49516445c8f8e198679088e510c4b5f32a29c056, md5=3a554c325e903d2bacabb121c7279b94, - sha1=24bca1e109aa2ac5d487f2cb53caefc1df154532, md5=fd284abc939c69ccf5d1bd4c9494fc40, sha256=6a1013ebf5467a41fd32e5c935443822eba5bfefb82009e33f437b42a265a751, - md5=ba9dedcf922a060768bf56b861f66ea6, sha1=5d9806c50948c2e07c1c2ac4fa1af1b704c7c35b, sha256=bb6e1fe56cad370ab92cd522fe7ba4e78f358a3d1cbdf9af70ac5fe0fe11926a, - md5=fdf53429b3f038b092b471fa6fdc3d76, sha256=c678964d1fbb962a9d7e5466c5029fb87656f58a48ceb6805fa399731389a61a, sha1=84858cab099a98bb771d16939a471346edab2058, - sha1=4a18422eb00a337335ae4d5ae06afcc1cee9061d, sha256=e22a4526c73f0e4fc91c9a1dc8dbcc6ca10d3fe865b940b63018ffe03d516598, md5=143055e26a664fa4b2bc1b98c98e1b26, - sha1=3b54ea4394300361265e79f0569621b5d795be29, md5=3f76953ac1c1d8c58b8cf5ca683cc38b, sha256=09c04a4a5f3c628632a9e99ad9449f5a430524d5d9d7f57d00632b5895257814, - md5=18f25a2feaeb92474ddac8573a59aacc, sha256=58b538b5bd3f7b212245333a48e5f6edd32203ec8dd16fc65e8e0835cc48aca5, sha1=e5508e40070cb36c48016fdbc55dc1f1679d89ce, - md5=aaf7e10410733758ba1d9d8f5c43ff13, sha1=904253fc6c1518f5c398211819e9d0f17cef3b40, sha256=70561feb5e42d03a64ca8905d659c16af1ec2506427c7ea823fb91be0bcf5303, - sha256=7754dac6347266b8dc8b54e9a4c87d95622205addb06236f40415439c729575a, md5=afb52f4012ab367e08a195471610a09b, sha1=dd6b7df24fd0b435fec9bb44fb031dcd750da1eb, - md5=9f9f4bffe07774e9839f4267bf4a578e, sha256=60193837a90da0047412ba53e3ae4afddc4f472ef2454fb55ec76ba8ba9615a3, sha1=ace5886574167f03db04fa0723313a109354bdc4, - md5=534c9f55dc304f9d468ed2e670c33792, sha256=b70f20cb2db345cf3a73ae781e95637470ad76077d7792656051d26351ea048e, sha1=5b158660914c790d8a5c5842318e87789249f464, - md5=89646f561fbd52a54494599b75b33c92, sha1=113536a8e8d0ac10674511e0f986cf4104848810, sha256=c23a0dfa8023af434633816358a6d4658bf97ffd27063fe7e43be034d0b9ff1c, - md5=b9bb2bbba421abcc4931a629670ec47c, sha1=adb93c0e8d2c12b23ed1d7bded91b7654d442c2a, sha256=54f3b61c43749b80353d73ccc3624a31ed4006058f41a0150ca4474a00ae1e55, - sha1=a0dcfa72f66fe8c04459608a09e478e1778ca3f3, md5=16f1145775f7a34190f081903ebb40b1, sha256=a4fa31d559aa5b8494b7b01ceac343f60d8bca6eeb730e41c08862bfb38de55f, - sha1=45a61074d8eac429f797408a4d08086b40504818, sha256=874a0b62bb08534e1eed7d0338f36f4bb8e3f1b200e402cbb6bd625cde81f7e4, md5=bb2f14cb342e3021d12c357ddbd5444c, - md5=cd4a7eb424ec03389e3750ce8e6aac4f, sha1=bbbdaa38656a9dd4e6392954da4f5f111f0751aa, sha256=f3e1c1ed19477f4d26f9588f5663776540e2a5e38996c5ac35bebfe35ee3d922, - md5=3570a8658f415a6ab61b271f5d4f0b87, sha256=f77f4aec9a226e9196669fad67f6d5f52df3dda21a8c60bf3ea3bd66109ec449, sha1=bf6952d758d632484ae1a0510ed3e5f4b6c6ee7e, - sha1=84016b02d11834df5735d4a8c10f444236e88cf8, sha256=531bc740040ace5d3ef29548715f40541ed072858c5455b39b53e82a70cd65f3, md5=e900060fb4b73837a0b6b0677313868b, - sha1=5aa3547c3f4946af37c3dc89c0457258e0755f70, sha256=60913a94ea89659cb9ec70ac990cb6553fe4df85eba1c6bc711e4ed3224364af, md5=2393e71acfca98a13a2654a7b1a242fd, - sha1=d54cbcb1032972bb39ca6c075df30ad718c1668e, md5=a72b64526e25775a8da12f03499db8d1, sha256=476eee34689e6d08cd195136fd2f640c1a202fd83a960793683e6812a24e48ca, - sha1=bf1ff2e12fbda707c86abeae619be693447d81ec, md5=9468b34e3a62233d6a35ff32269d6cc4, sha256=59f1ce0cbdf57e801817d1937daf8f26b829ae98b429c5bdfa998615e9c505e0, - sha1=317c132ac651488dda5c420c1ecc42cecde856ba, md5=ea15c58161c2fe7050f5e812538c5522, sha256=ca6a8a728a2b599df422964be3a580c616f4240dc4e09e65e424f7281c5c1b2e, - md5=fa01a2aa4a0fa3843ee53fd6257c99cb, sha256=542bea61e4657205844904a87262ee33404765ecbf7faa35f973c9447f65452c, sha1=e8b23360e535cd86a3d6f405f64ed46b78f7eef9, - md5=73d88e17dc11854a8acaee32b3b22ab9, sha1=efc130037e7cbee8067a9d50158c7a11ef92252a, sha256=c7076175c665af5ec6dd84c74e6beebd0e9f96dea32fb889255f956716fb9bcd, - md5=49f12e7aa23e8e25fcf5ca810113e7f0, sha1=ff38ed38f54f4f70e66ed57d47f9dcc30735eb5f, sha256=33e51ea771b00d679cd6901870c1bc7968d5b32cf0b6f0519707ca617feb788a, - md5=fcdf48d22177c3769713cf2cbaa49b35, sha256=5e7bbab4d78cd948c402b1a616574dd6111f4ba1568b4256d703abd3deed4916, sha1=0d86f062be872f654da049404e9324bb3f5f312e, - sha256=7934746ecb64aa4e5f69d2197a3eb8ed7164e21e2ec0c7e1c726707be23fca3c, sha1=e0e9f4083c71836619147a7f0a8e7d09c3dc0327, md5=d71c493189a40db512fceaf4e7d2330c, - sha1=68db4643b4642b9289faaf18597f2083e19c87e8, md5=06a4a53360131d6bee87ace9c7f37503, sha256=0575b344cae60366192cc126448967fbdfeb7db895315f86bda584bc32a203cc, - md5=ae54265ffb04a170169e6388cf5961b7, sha256=fee5a8b8885707851e24603d70a6536c9165a804a277b575d709cad6189b2868, sha1=8407b1995f1978615ca5fd56178902407d88f0b8, - sha1=5e1cb8e00ef471558e9426dcbf9adb128391e1f6, md5=b6d096cbef60263a080a6139de3f1550, sha256=3754ee76891dbac8e8d7507c61f5967fd036096482138d513788c34fb289b500, - sha1=825a0cb6af70936abdb3163e71444cc1cef92b91, md5=1c9442b09212f39fb21d2fc23f9e0d4e, sha256=02cf8c8aee9285ab4a5dfb41e00d366b04c594bd9dace9c50d45ea5c53078bfe, - md5=95eb2025553cd6c840e4ede0e3b05151, sha256=94fef62d0738647a45ef67183fc37e5dad6e083d7212409b74611bcfedf21081, sha1=6c27196317c340e2bbf03aa047aa72f7faba6a02, - md5=4cb1e55410bc454b30d0725603458d5e, sha1=ab7e6ce24884eb9cbca322e2c4caec1f6071b553, sha256=1ba7787d79595832377de30fe2af18bbbd3cbbd258af8e69fa9d75004ce7ab67, - md5=d2c9c1582e05b5fb1a2ff9ed2ad8c48f, sha256=bb839c2fc7b9c41b60c6c18f64ac37b59a80dbfbffc4687c2963d41ea50d025e, sha1=f8689fcd10418d1c25c178d4c9dc4100d178874e, - sha256=9c2f70656908aa2a7d48167e9c9907c849a8e0b299c1cc7ceda6678866aa51f8, sha1=37eb46e4e3709fae7351b55ab898b104d7d7a1a6, md5=eb68b080d29ce4a7244254b4e0489d61, - sha256=c6150579a9208a1a276639799cc9c6b6021f6cca3b30c2d2d1c67fd4ffd353a9, md5=25efc0ddf66616f5848ea55bec0290bb, sha1=1607037714f3ffafedba7939977eccf0213de00c, - sha256=95eca6f30b455a8832b9d04686461d30e12db0a4261344e9e26569a3ba766d94, md5=6958ed0cf5177e72251b115077d5a6bd, sha1=13f80d584480a7ff95fcbee66ea6cb7b206cc627, - sha1=ab6affd69b4ae7d41286d075cc16c7b54b0a4c54, md5=cadf218e66388db03c14caeacd5ce18b, sha256=75b5c0918991e3a52c2cbb1e119a441c3fa86783d4e23860cbc621354b3b7c9b, - sha256=3f2bfc1de05e2fe4dcd0ee353ac2cf2ea6821429297d95a18dd9071500e2bd65, md5=c798af662e6e6def6dc00218586edff6, sha1=4bfb36c4af4a88eda43b03487cd708d34f6953c2, - sha256=004afe51cc00b21ab437120fab5aab8af28ca8e3e651850cb122db04a6e83597, md5=2bf033bebb81326c9857399271a8fc68, sha1=347caf7de4d64674675da57675db5b98c588a5ca, - sha1=0cec5e31fa476de9f91e91e1bb3060b32b9a5e96, sha256=1c215e83c5fbc7604cd40b95966f33d05a693907ca6d3f3451e88f1947ef634e, md5=83d558e3c1ceee415626a174f433bdb6, - sha1=d5c03ea03704cff1287e558ce6a625d40c777f28, md5=d4a1979deb2048672b6aa148d2ad1489, sha256=19bdaed336f64329c2e3a9cdba82a02b05a0f5f50ffbc1f8a5b0c4f27bf60351, - sha1=1ae93ee5c95e36fec1f995103ab9704ff5e98189, md5=4227c4cbdc9f9f95f080537a005791a4, sha256=839aebf52a04878c29ae59e63ad8909296412133788ddfe43c777bdda58cd36b, - sha1=1952788eba7486a50dafec2f8492cfe34d4f3fb7, md5=cb6a821d321be74e5a47820f07a750b0, sha256=b27e8a0fa3d0bfe66acf192097e69275c850fb611f08ba005cbb23aa2991a6e6, - md5=aaf6dad72d0010a0a527b217343bf9d6, sha1=39a36c0fde5104fda23dbcd58173835cc7fd378d, sha256=324986febf9846f4287d1e77d9310064a9ae6ef80a67836c04118b9e2891041b, - sha1=8ecba0449a57789983991650fd76d1473ba66531, sha256=25916fe2a9159da926ce687bf46b1fd62d3d6a5b6df63562334835dc23e1bfce, md5=274e9031aa87b23641edeadb3af10a19, - md5=76da9656358683fc6d66e740ce6ad852, sha256=083bac3d6e2d43fb3175b14e1f6a078bb380b0ca9dcf7d2bef1a40ad7dfeec0b, sha1=a42e7fb0610b590e8d2802068852d3d0bd626338, - md5=99e3361bfe916110838ddc21ce2e4f63, sha1=1da17d14d125c1e44bd537f6710448a740dbc4ca, sha256=8051fb501a25e767c529adbcf719acd9601dacfe0efdfadb0cc7a0d3d058ef2b, - md5=d9f451ea0a86e0186a0df4e5352a2ecd, sha1=169d7a25f24e0d685ac6dd3f73a3a85a843d843e, sha256=4208b6002a9e16c3763062cf4166c0d9b8c0fe8b23e289b58abf40dd7c3a64c6, - sha1=963725f1b3ac07358cf0733cb60915126e706366, md5=5fea699730896311a662036308a34684, sha256=76bac058392f7efb1580488c53c2cd80b4d4134a860bbbd95026a9cb48345e0c, - sha1=405e372ad8484b32ec7a89e60a3bbf4283342401, md5=2e87147fb794d208d3371a665a3a0114, sha256=0ba7d0346eb1531123afb41997ec2cb1d29dbdae150b5a159946392c1190174b, - sha256=5e6933bf5451314976415c4292fa52cc74331b7515a376d31f5301109f37bf3c, md5=9636336907ea0f3c21bb555d4158f665, sha1=024325b43cbb52251024ff1217962d67ddaf8cc0, - md5=02b77f62e14308599ea99706b8cbe646, sha256=2d4c6e8d106f8eafae076cbbced5e35389606ad9c1879f750d52395dc8f92221, sha1=42dbfb918795491e8b8c74063c86238d3ab66114, - md5=7809c8f885f6919e790cfe52acf856b3, sha256=47f4a6b9bec2065608ceae01522ce7a5bc4b187179e913894c6c58855d2eb171, sha1=788d0a71b77ce8af35b7096a6176a3b039edc6cd, - sha256=55c494bf8dfad3b18a17fb4945679fcd263ca0b2cbef9575bf57667f18cf2146, md5=09e87ded4ded607f2916b19f380abe42, sha1=2d5d6e8dd6913a0b94cecd42bee5b59ab3e47c8d, - md5=8c5adfff3f2a938e9320f21ea4737fec, sha256=301a7d06c0238c955696237f1e7901abd8b25775221811363e3e1b11d836f4a4, sha1=613729d6d32fdb9d19f8649929bf7cb53e06080f, - md5=ea4346b8da06b10a00e18a941f09043d, sha256=903c5cd0781993448bfaa1ff68dbebfcf70c5a4cf167f371eb0db419ec5836a5, sha1=72971f73ad0eadc493f488d356005ed2202fa699, - sha1=1d1a2a4e244394262110b5e2e23b6e25f2bdfa72, md5=d77601a31e4934699e9f8cfd68e5b00f, sha256=7845163fcc90028b54485100f82e5cd3cd7491de537f27fbd295635c3264b24d, - sha1=10205ef2c0ed16cabe06002aa8e50f75977d574e, sha256=169274fd75ae99e0a72fb1c17a15b411aabbd8d9efaabda5778e9f26e2a2df58, md5=ca6ae12550880f2b5ee57eecb38d17b7, - md5=e81d37c712c22a0ca133519119c1ac4b, sha1=40fcdcfd1a15c3068324ed9787a52f85547c1eed, sha256=de3283836f72ff53462805a88501105625a65076731f2ac1a4bce01d6f4357a9, - sha256=9d59600f6ff39c8cd79760efc393af224f5488f4f61c479cc9057f40ccd05d11, md5=e9750a67eafc2dacb0098d44abc27ffc, sha1=3c20f9e95ddc9ba5c133087cb9007a1d2c043b06, - sha256=e6d9011d7a7e135951f53ccfeae890c1003436e71c078bcb12bb76c79e17b56a, md5=e112d59b8b9f8b1952d0c8d5bd562893, sha1=5046b84b13247c36a26400a38ba18b6df2e061dd, - sha1=885baca362961311b89931ceeef398301d3c23be, sha256=a71e4d8b237314d9b358c91c3e607d3eb7a1e968d59e76059348a47bfbc5bf91, md5=e5ff988562cb9377f5cab38a4294df63, - sha256=d1621f13887a75938be4975dc26155f7c3852131d5025b76f62e9499bdacb1a2, md5=d17f45c4defd38e366c387d3336efde8, sha1=421c45c51d9a6d5eb606823e814a0619d87d4ea7, - md5=4dea2451f0401c0b615342d85fca8855, sha256=3116b4c3a4948377b1a14c4e56b7ae94c87b0f4e7d76c2396a5b3e4e25baf5f4, sha1=ef3632896688880fb6c8bbd6c977fbe82c85e813, - sha1=af50e075a389f0d71c5144614aed4e90f2732808, sha256=fd23ff05cb0c9f32c6a7a2655673ae87a35cf2202d5e249d3e5810b37f23dac2, md5=92aeed037a55feb89d35c4e80c03508d, - sha1=c3d81cca56a3bfd0c7f5cfafe8be12df95e24358, md5=28bdd501573a66ef4d05ab40eb9f91f6, sha256=64d976a933e1c0c8511a0755fd0ca53fa48ae60d9ad21a3fb970a241d63f4c11, - md5=1032254ac9e3d3ac123139c861da4505, sha256=76abc2e6afe6098c30c86a5cada0c9501c706f7163f45747782a509dabaea7be, sha1=ea62af135b513d9bd6fb816b3d6c391b965329a2, - md5=a9d98122c4c24a7877720ab0080a06f0, sha1=71b1e5c5d90ee5251689ec4bb0b52fa815d444be, sha256=b84bee0960fc32f534f0cf66375acfa87418ff88bbdddee5c55fd843c6490914, - md5=70bf85e3d2322a8d9df1057f9b979b5f, sha1=1eac74061d074b2f145ddbd86319addfd32d8846, sha256=9b22dbfc6c69c7b3fff47aded7262d6691ff5cdb19aa719176203679a3c6a9b6, - sha256=7c76901281ac035cd82de23b8b1e4576471f81441520559a35ae2d17ef05b02c, md5=5969d08926b51e542e7185de34801839, sha1=8c96a4519af202af7ac8e2dba5db592fd4d4d6a3, - sha256=517adb8580c6af41fbe3471f558e003990356f5f6c9003461d48b05217e56ad9, md5=8ca753c92ff731777d745e1271d20bf5, sha1=dd4c608def6bdb2c981a4081f57f150c53652771, - md5=36a126c29383795267a9820874ebf797, sha1=3785f4dc7135fd2569b81e7aa24f2c72105c8139, sha256=7742ad1556e4623bf3b35e3533c954ecc470e44a7f34692b7e7dc21a11e31a23, - sha256=35885da36ac3d3a79ba142b2b701dd9eff09053c48d32399ffed1c130d4e6aa9, md5=1b2d75ad3b58f6aec88e51a370eeaf04, sha1=99782f298491f16dd88bf6626d698af671ea75fa, - sha1=931b996cddcffac938a54c3497b55d1b5588a573, sha256=70882dd81a35083d38b07f4ae8b0e25cdb87890366f9bd1dba0443cf49124481, md5=3bc912cf56631a57711cf2c5a6cbab64, - sha256=06c2d712c028208d0bab4016a55c052faf19e3790b8f2b6f0c769a648aaf46bc, sha1=1e2f54e9589f6b53d2a80d2c54e7aa9010dee719, md5=da7d9eed0039318d90d92f759a99fc9a, - sha1=6af55caec6d280f2716f21a5c3a2bff74c33eee0, sha256=e2bdd4d081faee71cd9fcf034d48aca3b7e0285d234da79e1ee600eb0e7f5630, md5=d4025d75ae3d35b42e189cfd15894387, - md5=85d07ff0e74c1b063bb296520183e160, sha256=760854df61174d5caa355893b7f19825b2315ffd3a17f05a08988740b27c22d1, sha1=a61143b2d7be72018894e5cb862bad7116fba948, - md5=9bf804d0e9db98739b72de2707080ea8, sha1=50b0dee1114e040f3772f3cd971b547f5020a4f0, sha256=a4affc453bdb917033db881df8e0663a31d5bdf925055a8a7e6fca89a638689c, - sha1=b02b306f9c785c088c630e026f2383c24799bd42, md5=80e4b0b90f14fdd824f18c9b4bd99550, sha256=f0d7cb068d25925cd8a491e276ead2d867d48b662c1902a345903336dcf32125, - md5=475d34ede7b82621c2effe2fa4e1035b, sha256=cad498df5eefe0668124fc87ee55acfb6b2da990d5ec7ea2e7d76ec116584509, sha1=ab00c40057808522293de28542818dad195cf47a, - sha1=933d296499dfe0b20414047b728b4415edd0cfa1, md5=83d0608ab8789c071195d52585d518e0, sha256=ba9e967ef09394dc2b49e096a6cae35e3c9ad24f3263eb80d8c6142b55ebcf37, - md5=26302dacffbc711e06f76e4f7ae8eb86, sha256=6c4713b56aecb88bfc98d1d903c359db6080b3aebf3bc701068add20bb3834c0, sha1=10077e343d2ee27711775450639cd4a43292ed07, - sha1=0a7587cef4d43f21db2796e8082fa6f64315b1c1, sha256=c4d289654d8de466086724dd5519648cb9e79c3fb5bd691ebbe02e76253d8bbc, md5=7dd3a1e4520d8db06dafff49bbbecba7, - sha1=48725803ab13fa2da848d255c4d6c2bc60c1b0f1, sha256=926549a7087e96ad8311926c18767ec4cb559c4162957b30cbbf11369e29963e, md5=4cf4f27395c3e40f551058e03c815e68, - sha256=07ac8696dccdf64050ae1551905e474d27d5b2ee66570af6ad6f874c9f4b9b09, md5=8ce632b868472c0943fdf085dce0d9e0, sha1=867df6ed08a274b7d84c98c583b6b9156d59cd3f, - sha1=88c6dbc1e3c2b7522f2c840081c8a78d3ab6e2bb, md5=0aee3e18737cb2b63815f0f1d9b9161a, sha256=8ac647c6255ceaef8dcb4d22e0e4ee334c0c6ded5cd389a2c31faa3e15bb6867, - sha1=553d307acbe19e27669cab1666dc753c92957921, md5=852008287410cad00a60892f9a5e0ee1, sha256=30b10bd3c785ec6d23dc7f9cefbbc0a6a63a9b2860527c8d4de03d2231a97738, - sha1=24e2979acc2b4546b6b6a673d2cdfc3003b43d5b, sha256=d9216ccec4c1b99898208cb4c677977ed9dc980a04fa681378ab70dcd07506b6, md5=e47f06cd04eff4a2404358b2745d185b, - md5=961897cd6c0a42fb42bab4140ff53fd3, sha256=f6cd6a3d65006e298fd8cfea0aae2ff1bcd98e3ae7ecbfcc7f489b63bf83aeb2, sha1=c76db9342a6b7e4b1fc936ed5adbc3cf8fd0de5c, - sha1=bc43f5a10e1aca492c45c1638b61eb59c22f1f06, md5=723b33aa06440acbb071d79950517c81, sha256=d843cebf110c78ba10acf90027424b999dab7bf4397c2f83e82ced77a70b6ddb, - sha1=dc80e851fd02e7a1a1951fb9faabf6c2089c40dc, sha256=1b1feebcb01bf8718046731fdbf66a3265dd77148b3721f6226819e1fe75f814, md5=979b1a7a4efa65109aae19383875e97d, - sha1=ee0902dd22fe9a52aeb93dda4ba3a28517cb8a61, sha256=ca47f1796545b44967f7ea73f15bf77f572e89aea2ee8996294d12169792d581, md5=e5275befa67439cdda2f5d5ad09b49d1, - sha256=2028d3be1831218ec1860b3b9dc303309448ff3b5ed3fd8f9565ace3e7b89599, md5=071bba8d43cf441b19f677a593d4d409, sha1=195475718eb9e18cb82dad98bc42d9c796864532, - md5=62022be7fa123ee145ea8ad1cd497778, sha1=79832d9f910ce37784ca0c55f4f3eb7bcc50486f, sha256=66a35164957a89a54c8fa9206db40fcb5c4d72608a71a3c4f9652501d575716b, - sha1=194bbf49bbfa584af42839444bd01c81494befd1, sha256=6ee966f48ba8b3f78e2153e7da016bede8e7aa554a273a196a7691b95e472867, md5=8c75349ba2f8810d632814b61fdb6bf3, - sha256=0b9cb97b4de4aa84af86796a5b9a1fa07cae34f709f3e052a50cc78f3ef89d83, sha1=15694136ec83383af194aa88df4b68cd086814f9, md5=b284e6fc981ed507c8ca47a95fa2a07d, - sha1=6c0da171a131c6a262b41c7331d2c04750a44baa, sha256=0493ec1d953767fa2a137a1aa229c3ead617736d133e5229d947a5a074a93d1c, md5=87fccd3b7bbd63e7c60d6e467a9dd55a, - sha256=0d83cf8d64e8bd9124768828cf54fd2a802cd4e192cc8a410b7e4a6a9f60d0c2, md5=efa73efca375de1b486997864d16e5f3, sha1=1dbe6f91ba3b501650cc91f35a544758bb266d91, - md5=942fef1101461f7b3e8f9808f6599b6a, sha256=b962e6e5b385288bf7e18fca0aef66bc0652556036eb7af1464d90edc3c0afbc, sha1=ea3a0b796cc55ef6016c4ce703bda27072ba58ba, - sha1=0b8426b9bac9a4593a73faf8b8b00e72286fcf75, sha256=381b39718253618933e2a167ba7c6c36ee26c7671a470b33b98b350c66444753, md5=4428e2a75e2889bc69cb3c7613b738d3, - sha256=47861fb20844a1dd41fb0bfb3f6bafbe04897d316901f5eee1ecf221b3b1401d, md5=8c96bcad916b3481ca58dbf8d93d6a0b, sha1=52c3bf95396826d266c6618836320d5763ef46d4, - md5=6937c5b33ce4fcbfc2f0780a5da40ff1, sha1=8237c54a0e1aaaa1f313c71abe58d4e522fa39d4, sha256=78975455d0a4ae87ecf5dc849637cad7250a34c847507099df5abe39327d6768, - md5=9b01798c6ba20526437f48969250e8a9, sha256=17031a45ef5461b320223496000a02833f6c803c29aa4b2ba3b92ce496b120a7, sha1=88afbc6a42620dea52ed48f3896b0ff210081fed, - sha256=b193056b46e3b500c2257dd61cb77bfd02cecd5a59aced7dd8f108ca0f2838c5, sha1=27b76c84136585957e8df1b96512696d4174355b, md5=20db17a84355029521f60dca8e129cde, - sha256=e74ee189c9291e8271de3817ba0622db4370900ff216d4129676e8377957b39d, md5=0308211690adabc471907323b3528668, sha1=841e8aec9bf7b8ca348f84006fb45d7fa37fa2ca, - sha1=1524975d51e24c77018deb09b1af5cee7cb8eccd, md5=a3b87bf2afee35243351e92a57db6120, sha256=0804d301b3142d2e12d21d0c680f18bd73bf440fc33769c72673bbcaea94f7a6, - sha256=3a82f38d3ac6e8d5570ad3063ca8a9e613213668d7378c025adf548394545e96, sha1=52045df58e6d60a88085e3e9f405c42fca1f0e90, md5=1b7c2848a847eb0408d13276ee49a390, - md5=c1f2379d9ef57d95ef8c69ac6076f28e, sha1=c864aedb6b183be28e21d0ea1ffad2d47cbd06dd, sha256=9dbe9cecb9790815890395ad5cfda26f0b0c6ae7595db67d10fd713c4af64625, - sha1=b37c934b1d1f21290ee06977fe41b75287e15df9, md5=224e52a5f09f0ce3692a8b704b280148, sha256=a6c6ee235f9701e422408d6c69d26cd8c38c71a978ff3372b232ba3c420af517, - sha256=0f9398b1b81d976673e7c6464b8f8f9b58eabab4c6752291e275446f353037c9, md5=9d88f5a6ba7d071db950a4bd38489f3f, sha1=e28aad667c8b063baf3ff2e2cc03e72dad98381f, - sha1=ea71050491898e0e0f8b2a1622691c997e64cb85, md5=1bc7efa9663c770cac61a55c20419763, sha256=537d46ba27ad64eda54372893887e159cb57dd7165921c4bd4d734efaea53814, - sha1=6900ca8b633c7fdf176947603b5f0040d21e9999, sha256=9f487beb83cbb91431d5e25233984bc21aa3dc228d4024143c3357d81c9365cd, md5=4aecd9c7973c9fa7b7f7437c2f0b35c6, - md5=55fef2610a6757fc26c287fa33978ed0, sha256=ee3bb2119e2dcb54730714feb6a4f0345731793ae27ec3bf32cae0ab31f1a3ef, sha1=e95a7fef18a0107b32b0d047533e42248c1d44dc, - sha256=0bb632f29bf6dbbd0cfb3b2c65d00d18a7fa90155caf24a1d508a4650ce7eb12, sha1=671ddb21d1fe1879115c9c3ba82df94fe5f065a9, md5=39b2ff57f2c7926c780988c2077ca61c, - sha1=e98370ad0c4419b0a08e46863c501787f3278c70, sha256=918c1036458656390b7abe2d3ea61dc174c4f572dae597394e3fa96a540e66fa, md5=e0a9920aff38a564e76b10cf48540f20, - md5=95feb6debb6307dbea4a41ee2fd2f96a, sha1=40feff83c8df7c0403a690446a823644ec2c522b, sha256=e1de5492672a34eba95e6cb83f149097d1c9083ebb69e36fbc3b5066d07a7188, - sha1=a706537ce789885d300a1fcbcb71e2f837924d2f, md5=7d405efe8fdc3148cc2e09be58c45ae7, sha256=de26b57f80bd142ba4e321e8df64cfecd03373377a598a13e7f419979c2137d6, - md5=1ad2d0797656367daf16249ba7488e37, sha1=a70ae75e4841e9b08b8937ce0a335b567c2d7062, sha256=5747c0ce563628ea10222b0d373759b4cc1d286c8ce09fb4eddfb91954bbf9bc, - md5=0429746a6801caa66c918c1d53aac5a8, sha1=9ebc6c680f2d49517f334d5d0c0d4be772c9145c, sha256=5990cb4852fd735517fa2d243806dc139458e8a122bbda6b7d49857d1817c412, - sha256=4e211c02113b1ac5588814ec006c851b8ce2949c5866070074676d13925f186b, md5=ebe478a27315b4f71af793839b5812ce, sha1=4ff4d58c0f76b68d056c985d525358ef7c30793d, - md5=d518a9f0257ff668f1382eef0e168575, sha1=46ceccad4e73922fb7386730306ec82546ef207a, sha256=887a8178b8170f58f8ed233f06024b6765daa6f686fe57a6704899b9deb13d58, - md5=a7a90386013a8a7b1eb1d1dc95ed0f6a, sha1=eed5755563bf17be511a61a48b50c536e3dc75e9, sha256=5783285342ba2abbdfe7f1dbc9f3ff8a1748f85c6aa776f595532f6802fe5e64, - sha1=2566ea92855acc2b810a7a19f2cce36e56c8bfdf, md5=23d1f6189d6f5fdf07c03df437e906d2, sha256=94613de77ef53c27e9c50de265a5d796ba178ea02c0dcf3d1778047a8d4ace38, - sha1=cd7784e67eeb594f989b017164316dbaa59fb3e2, md5=96c247942db0ba3cb70f87a4386c7a64, sha256=fc399a0931a05929bf1cf725ece39d36e5c2a34bb210e349691f942fbdef1c7a, - md5=d2169992b21783729d221f755ba10e23, sha1=af14936d87ea99e69189daa07ac3c3bb469085d3, sha256=92fdcce796746eeddb3d862d2ec5c817544ad225982173975af5660f457e4cd3, - md5=a54f20ff42a95709b177973ed59fe9f8, sha1=c73402dc93fcb905d6739de5cd5abc064c50c513, sha256=519b7f310505c072f9890576862d305f378f488517b95c86efad93a891ad5818, - md5=c10525fb1f591c283e9f83be1bcea525, sha1=226b16ac7f7aff2fe8c9c338692bc9d41f6e2832, sha256=e1158ef99887c83b25537781ae5f12973512addc9812071db2fe06c92eaf916a, - sha1=77df82729017fac47baa277eb202f1dc13df1b08, sha256=f3cedf426de804ec9c0adcb67973573ebac1304498c930e46d7802ae1987b681, md5=47d445c17658c27c58df43ab0f2500c1, - sha1=f62847e5a48e3611d450e9751cff0c7821aac0e8, sha256=dc3a453b86102f44419b3c7ac27aa7585de8748578f4e2042ada32898cbb80ec, md5=ce61050162985ed2667e8cdc31a1ada0, - sha1=6d1edbe48ac2e238609d1a37f536f657ade39783, md5=b22e7b958a8d1b06e89ca86544e76668, sha256=5f9c869645e52d3b361312d45c7830a0cf1e3bbd02f10a63b708e4e00c5ae780, - md5=1ab95bb937fb130d21dae689dd39d199, sha1=61525d2c4a0ada0b7a4dfa280ad58f441af98d63, sha256=730584be06a0294ae9b63d1ef3c4abc083cfb72fd7e33f88354fcb3d4253d003, - sha1=e00c7d033905e793b7a10477ad3659badf3afb00, md5=7fc9d0c06223ce4f2b4521ddee8edac7, sha256=5df6c23c15ca31b7753784ed97313fc656289d4a7dff2931c615307717414f3b, - md5=c52c0547b103080efd98455a602839b3, sha1=e07f05ba0921c443cd07a71f56b6eae4515a7a8a, sha256=da7d18d4a1d6f6f287c116526c18162c44e62c3d907399a421b2b652b9e983e5, - sha256=d36bb07da108e2ae3e26f3e7a7057e1445a876dea921a9cb23d6b8e6bacd25bc, sha1=3c54f09b8278520c1f71dbbe2eb97fd0b69b29ad, md5=f0dac46afe6b40cc0450cd898eecaaed, - sha256=d25930365356752e298b44400fa46e7eb1946851c65e0ea1de764c6d25b3f00c, sha1=2638955d9f19731266250f63ad58f10928cd1d04, md5=de0a72e7e3d440707b400d6f0f483fdb, - sha1=4bb1ee066165cda393322ba8b2d1920119748ce2, md5=db7312701566fe9940c0aa55ca669654, sha256=33eae2d7c91e5237a29e0383e0fc87287b05cc05d233961d1f4ba8435baebf18, - sha256=5ea14183665099577ee8c891a34330ac523dfa9d278b5b365f960b2a08f00fb7, sha1=f66112d42f916b1df7a8a9810f5553452187f1af, md5=87866662d3d91b710c9c5ec94b305190, - sha256=60aac19cdd6cfa73bf1a250919b33f755a5c6983ce1bdc6cc9308e6c3c19d97a, md5=230eb41db9d26ee8da19af13c02d946a, sha1=7ce73fcb7155debb29a3fe92576d36dafc362392, - sha1=9875d8ac2f1c1c9a851ab33fa0af461737b0e5ee, sha256=80874a9182d92d907288e544bbc86856975045ea4287578f8540abc3caf9088f, md5=29d233fdba4343f2c87716346f2ce08e, - sha1=5132da45cbddf2469cecb54c3274ccca3b6385c6, md5=71599569169c9224389b5d27906cca50, sha256=348e8d2ea0ca970866c2e41975bf0c00a473bc3b0c22f1daf378cc67742ca4a6, - md5=d02860f18bf2b3f8ae5ee3dfff0ea03b, sha1=65f9f239ad2b3c4dc305f54e9047596cebc44452, sha256=a6c5cf0605c0e861d812c29566bb325b03705014ee641d6971629f981094c6b0, - sha256=e825fa0348a3e17941c01a861df3107b7aa4ec3b7e60d2abc782ad903affe90d, md5=d193670e7ccc229ce1bebbbb946ad5d0, sha1=46d330c56c415dcaecba88e24d9e0f56847ed3ae, - md5=f7bb33d5a97855c3f304f02edacd934b, sha256=07f63076892095c7dbc252982a6f95fec8c49e16f9f5f565e227903e8c2e6542, sha1=7c71f94f46f1ab8ed7f04b3af6d8cc7657d90d36, - sha1=3397b5158f689de59c9c81c65b54480fce5fa5af, sha256=47f973e69215700b38d0ea2df8262ad2816794be9d70a678498b75adb4a4b8be, md5=5613897795d52a868d4801d54fb25908, - sha1=ea84744b3a36a162d0564b1dd45a0a12f4a959a3, md5=0710c15b83f48da1b973b2614e79ae60, sha256=7202d8d6ff353d073092388a89ca7f8cce3fdda7a6cc2677cb6e936c8231711d, - md5=2d73311bada391d959e67dd8d8c1ceb3, sha256=ab1fa5d873899e6b9a19675adf23c7fc7aeb8b5f0d73dd58bf57ffd6cb4a2752, sha1=797005d92c09f9f37d33d0590132c6a3b6e0eaaf, - md5=7b471e95b47793c50bf61f9e5b5d4b34, sha256=cc7904fe2ea9d77373bfc1d45053b0498dd9fe984a7fab875ceb46dc2bb7c2f4, sha1=32526a184c744299e52b37c85add8683d4ce04c1, - sha1=6a03408602e017a56d502e5e19492f30042afb5c, sha256=166a89468e728e75617a690298aa5e0183c6472e11cf6f76fd8661ac4b8aed8f, md5=cb4214baafc421dab87cc64513cca45d, - sha256=57a96eae3c8be0b42ecc8f8cdd8998e23bfdc400f5ecbaee49965e3f19ecadaf, md5=e4b3fe40e316223441b06f8e7a605006, sha1=b2d416d8e6a81ed56acfbdd59ce016ca41b60c53, - md5=1e35f0562b47f179b81d1c7a5ebda2f3, sha1=ec36b43c99a10dbebc9c8494e8f7b0ead74265fa, sha256=7fab4ccee9ba9e7b1917b984f1ae041a2a463ada54ed71cb8a93e4d6afe08baa, - md5=c4b06b6cc4492e64d9163676eed6aba8, sha256=20210e259b074b2d77d28d7cfb347eddcef58ed82ead423b1e0bb075828afacc, sha1=c26553b6d332ff072cfd7a2f478212d44b2dd9aa, - sha1=70ce3d40e9a0b57736d0162b12e177737e44849c, md5=b5eaa58ebdec5878961670bf402b35c1, sha256=017b325994c44b517c68b34cb8f8b21a8ae8f5059d0efc7c263529f9bc91fc17, - sha1=4ca064ada3a0eeaedeff039daededf55d912b5a5, sha256=660e127f0878d65a724ebaf6073198e2160eae84351b561007fdff3adad71592, md5=82f96db6c6514b7332c84c046047af3e, - sha1=d1f61593b86705731afb3eff0c4abb4fabba7721, sha256=def5c82bd0abbfbc23cbbca70f7ee94421436f6bc63a148df6a4fa3fb4c316c7, md5=f1503c13902ffdb535b27a53caaabe2a, - sha1=083ab881a94166c576d6adaad1dbebafd656427e, sha256=d5513f1d4e600043e038e30a0872b152dacc7e023122061c9b5cd02d19727374, md5=c429b176b8f8668a9f8b59e6d6050eda, - sha1=672f8cb3c55251c1e6e2af7856e087edaa717c23, sha256=fa65b50065c7abb7f00a2112255ae57623d839fa0828fb9176690082390c7afe, md5=7a27eeec3e87d643478da991124b4cd3, - md5=3ba8dd93d17ddd1e317616ad826e024f, sha1=854e2b2b77a9f6d9bd466c0a2d91bf38c8b484a1, sha256=0b75f86bd7c01f5273a67caa8d0fae6ddba35a6d51d041e51586dec3b1c46c74, - md5=7d4ec46b9cdf0d401fab905ed3413b08, sha1=1bcd0e01767c908798d7f4624cb74209e943ddd2, sha256=30841c226ce7239a0c6a3bb8eab0e089e4c3973edfc6e43e493031a7acd0b923, - sha1=211e3c08e19667f6198c4644b2dea58f6273a985, sha256=b6c70f237c65d865c302b9290d55e661349609a5d6b134366bbcf2258cf1abd6, md5=6d44b6a35de2c548ac2d1d1cf0f0cf4b, - md5=49aebf8cbd62d92ac215b2923fb1b9f5, sha256=b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f, sha1=1723be06719828dda65ad804298d0431f6aff976, - sha256=b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78, sha1=3c425f16e8267186061dd48ac1c77c122962456e, md5=753df6889fd7410a2e9fe333da83a429, - sha1=b0fe2b1abddb97837ea0195be70ab2ff14d43198, sha256=c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d, md5=ac05d27423a85adc1622c714f2cb6184, - sha1=8bd5ded46d9d316045764265c7c3c28659b27f2d, md5=27a46943168f2613b1bee78ad679eda2, sha256=7e2d46fc2610f44d13ebdd0839276354efd9a34a00657591a89b8943f515a40a, - md5=d84c51df7aff69b0838f52efa37268b5, sha1=51bfb8bc514b6e90a29b161505191c07bfaf7b58, sha256=a6b5e6ccc16bfa6c5888c5f87eb82d8e9467a4862123aa1591524fd70ccd84a2, - md5=238b4e246af27e9c8fa0c910b2f1ea79, sha256=c16022e4806278c56de433dd465d6f7be279aed78f56b329429041997347ea94, sha1=d77857173c6882d87ed9f33725204cbf0f81b8d7, - sha256=756ecdaf66cc3db8750f6ead83f97777e1d22061905df24a38b3a7288da8f169, sha1=e0cfa9dc6718904b4db128da9e839422a76cbe3e, md5=700024bd78d4652bc6e82ac4cf1b7b97, - sha1=0906bcea8491e071f64bb8b93c05b8a0ba9f7fbf, sha256=13e3c8b527164ea261accf8528e6daa03ef31206e8c22490658bb92d7b876aa4, md5=d1b8d9ae9a9023af97110f0bebb4c646, - sha256=949bcf7f327d37833da086e6fc57e23b8d6c2f6dd41702d22c580b38c0398223, md5=bacb8044a0aeff82fd2a64a846ae3cf8, sha1=152b7505ff53280aab7a226a1b3e7a43a61f6756, - sha1=e1ec3147d1dc35bdcae7b3b72cf324773aae37f2, md5=3d131d2e2234e5f81e3b29d4e8ebd0e5, sha256=fc7f56c3bc1f83123c633647cacaa4142cc5b8619914177cabf076c9bac5b87c, - sha1=fcbd13d49b65e2213670f7b886f2776853bd8cb7, md5=a42a6fda92099770ad4c5483c0aea3b3, sha256=bdf6c79c9e8674600e148d91e9cd76659cd08ab390657c71db72807c44b1d62b, - sha256=adf8bdb6feb25925a35aaff64df9924b548c65b0b6d3b11ea693cb453c338f52, md5=c03d115f6c9df9b1aad8385cd112cd6d, sha1=9d18eeffe24402d44d999b9bc5ab14852ef176c0, - sha256=793a07ac0cc4194061ac45f101a9ef1893d738db9dab77c2c4582b0987b83121, sha1=ef19a18939ce329324fda3eaef79afd73b90bb26, md5=c4c65f6b33da5d895ec95183b7416dc3, - sha256=ecd48b42e7196eb7f6901339ecbeafcb75d4a6ea9a3311cd619b94854a04d628, sha1=2101f40a005a5b926c2442922b5389f22b8a9580, md5=a89e374e2c40acdbc7e9db241cd4ea5a, - sha256=76aa79bfb63df634cacb46a2b1d35bb43bf755643a8bb0746804a5089f9e7465, sha1=f5cc1ddcb35915355ef6d1fccc170fd676c6e94f, md5=82b0c8687407a98bf6bb48723369e342, - sha256=c359657724ebd0d428b5ce2b1f85a95698f5bf8cfdaa04c2304e2ad937e48334, md5=72341cbb05a6f05b8ff1af789a4a7d90, sha1=b83d4d801b5766f5964589f2ccd8bcfa859c077c, - sha1=10d070560c3d4acf10071de10cf6edd836db0377, md5=28021d3df821eef963ff2bf79829351b, sha256=5c4eec13a94e39d37b27b9bfd4e2051846d6eaf8144143616634d6c9407fda4f, - md5=b722cef68ca8bf8a33fd1b64c336735a, sha1=1024b095a3885bcec67cd3f3f20f0f97b33d7d19, sha256=23d39e9a69bb05d0955e192eb9171ff340b79baadd3560600973c63ea7a6454a, - sha1=485d779bb0d41de005b0949a2dd9fe6a2090acc2, sha256=8175cc1f9900ac70cbd125677885c42106c0846852dfb265c0f82402e03bd3ad, md5=25d12406e4ba8d07d0a79109e6a00b26, - sha1=b2d696753483042f72cc4303ce9ddf2f85299dc8, sha256=4d07ec720a529f06de527b29511c327398e224a91391ebda0d517518838a0960, md5=1fa51c1d19f2e7696f8cb57c8925aee3, - md5=04fb88990c327e38cff1a405d74ad340, sha256=ce87f272af250a83dd34f464567aad9f2b76e7a33d3208fd291a68663576bee3, sha1=ef27f1dfcb620fc5bb306ce73dfe16a984654355, - sha1=04478683672763d5bd6b2a6b996e4204dc2dff2d, md5=94ecc5372286d3e4671eceb08bdcedec, sha256=410e6e8e5e5a86d0df05a3e2008e8fccadb41a61ac5af5b92fb6f332917d09ad, - md5=512778502398d4659f57de7bcaacaec1, sha1=ef42c0a62e102dc6c359dba18603b3f17ef2bca7, sha256=ffdbeb8067f8543f98b41fb03c34af8b5fde7701a1d5240b44c332e2c7dfa514, - sha1=f21bd5e50ba3e0fc45e1034118093ead5c82427a, md5=ad15fb34d60dca5d703b245b4207cde0, sha256=b9ac974318aab2bd4ffa29863afb1b9a47fe773f3d984cd7b2d550216526fcc9, - sha1=efdf8e9a017b0f493660f3855278afc5e2aa0025, sha256=674e3661bfa7ab70c8da130e7ee36341b55a6b1b11cd52e3fa08c8d8fe637051, md5=e2bf9a2a8ed8cd1dd10cc9ce4acb8f29, - md5=95e7728a0ed86a8efafc0275b9d1fd54, sha1=6dd2b9baf15437e5a5864c24094524113cef9287, sha256=31d5c555a99f02751d23977cc93ecc493053701ad6d66f9bbdbfe38d8ecd258d, - sha1=9bb2b9f7a1553b411215c2aaec136645c7aa38d0, md5=e51151191b0f7c7b81f4b19bc57a6653, sha256=579d15e937bfc1f9706d4f248b531db8d2305edd0f06a1ce56c86e748f726675, - sha256=ca8a8d298feca18a90bd5c0737357618c77c67a08bcb3abab4a2563b7fca017f, md5=7576a15c1976447f7ad99ca6b978ca52, sha1=df85ffe22b929c44c5b0cf0ce5b4f1e6bf50cfc2, - sha256=6aea9804d5a5844a0ef4a32300b6f278d9a4b31695ea46fc3d5e0264ef97a7c7, md5=2deca400cc90d6a0319c492a369dbfaa, sha1=e7bc58b733ff76d2105f88c4cae8afcf9b685442, - sha1=eeb9d1a3a70dd7d9efd49bc9848ebbc764c2e376, md5=d80d683f8ac8a707b45de02b7eaed287, sha256=fb20b0148cd18f0d8c25c2d4258113d0937be2cad82572c27675f3ec06737f9b, - sha256=7f3c5e4a4880f736cebf61db91f751c5c6e7e29306cf2705c86e0554aa4e2a13, sha1=17fb8d650de3bccc647ada89a1d2e8a17484ef29, md5=debb8e478711b4da34163f63d2f86e19, - sha256=89097617406a425e08998ba9c248c247f0b7fcd5fcaf77c5244de54c06416921, md5=9125f2721f58f9446c6fd7d5b0691f3f, sha1=acc0ba9eb5ce3a7eff9d5de315657b6e2f89f4a8, - md5=54ea42b3d2c890f04400bbeeed048527, sha256=d21b90d131873b4913f20620db7bc6aab572645a08b4747657a9fedf72d3efb9, sha1=497425847f981d582cb6359ba8be37a9c154c928, - sha1=9d29a5f3edaa7e724437c300c0fe0ed353874f2f, sha256=5489b50a095a61fcdb7ab80171ba24086f3d0b38fd20ae67e4e9245fef9b7d7b, md5=74a1295c01e6c32f1531b43b8d558995, - sha256=b5211e19b2cce74feae87531d7892917001159c9cf8724f70da3f2c206908f41, sha1=a2c12f18a2ccacfd246819093d9808f6cd46cbd2, md5=22cba8c79f806651e162a46e2fd4371f, - md5=c8713cd35af88d6ead38e20311422db0, sha1=1e6b17a7b7f809096632a4cf42bb1085736be926, sha256=be190866989781a69c2bce70ef351b94f2fb731854cfd1d01bbcf6a981437ab6, - md5=ee4175e13ee62ad3cfae87b2752286df, sha256=e17ec8498268de8456f7ba2eab7b0fe79677e720840da5ad7239c5756e5389c9, sha1=e6776b1a6725fc1a7efa365b4deba43662a8db60, - sha1=18f59785139c732e8e3e1abffbc013e8209f7801, md5=39a1a2d2c723bc5c3b7c3c800c7cf0b4, sha256=8c9fd1b271eaad995a3dabbf059863c6a2fc10a62941fa220c39f16d848e1d69, - md5=a6c82159d8c8b565f8fe916b6598ad7f, sha256=bc1a59d73d119c45a5201f5140103cee788c3b6adf62f6954687e2d0205da413, sha1=ad8137f1fe2e4d750b287cec1ccc67dfc11e49d6, - sha256=271bbba1b52547f6d379958045cdd82beecba17d99a30e19ff45bc4322884770, sha1=6839019d21563e248d66ba339fb244bf7678a4cd, md5=08bd6c158cd514d421277d31953728ad, - sha256=c5327ac879b833d7a4b68e7c5530b2040d31e1e17c7a139a1fdd3e33f6102810, md5=34504ed4414852e907ecc19528c2a9f0, sha1=0694ca8841b146adcaf21c84dedc1b14e0a70646, - md5=5318e862953ee286f5d26d575a0e0d58, sha256=36486739e1f0aac93962a9ed95733ee093c8cc545942841001fe05c441ab3324, sha1=bc3e8673dd1dd34494264eb0dddf7a26a57d71f1, - sha1=b01a280594d6534305a430b869c824416ad4e0f3, sha256=150db49859e45b16d4bb46607a7626a6a381cb82b9b9756868df0343b937770b, md5=c490e692a96e34f71c6ebd4dfb94f627, - md5=da30d97f4c051ebdbbd386f45b17c147, sha1=81dbec48b96b65a8a20bc72429f359686a92a410, sha256=b87bd1187fbae1c1731bd67901693a08ff846e8ff4349d5a9922f9f4c97f5fad, - sha1=dface644b6de220b7a460874d174ebd54bda2d71, sha256=2afd33d706a56af08385bc49b4ea3664806eefdab6d1c5537ff812a5c4dabf7c, md5=e750568501fa4cdf4f55b8d20de9828e, - sha1=2492a8f904f39e819e9cda65a6e0fcf9ba393645, sha256=f4e10abed0fdcd5163df4bd8ceb6871825c572c13a5d37fc8ac5d839ee9ba65e, md5=47ea692771b52d1f17940d9029eee0ba, - sha256=d1763c5e7350363be6ac15ce51762a928800ee3d8b946304f490ca5e00127466, sha1=badbf6eca90a497544c6b81587e710743b0fcb4e, md5=2b37e117fd83b852349c683c9fef59ac, - sha256=ecbf5480262dfd01bb00c5cbf4e2764ca3352d8dc6fdfebd2ced3853cbaeba4e, md5=6b7d28d7b98277db5c96869459892074, sha1=03e19eaf80f5ef000a882d37829e528221ce9a24, - md5=105008df6af412c69886c362bd806b1a, sha1=6a7b85301e73261e45ffac2dff5b97f273905c4b, sha256=7cde96645787e0f239743ebe11e4f48358f7bbe841f6c4cb8c26168940e8a83a, - sha256=3693ca42b64a7050dd5f9c81733b6a47e23a56db28efbef80c0dac8e96813204, sha1=8f005accda35b20c14ea98bbe5cd2fe803014e41, md5=0d15ddb007baa86f06b2e8d2537c98ef, - sha1=55143cc5cd577dbe3fa317da70649ae4166b42f5, sha256=a673e4f5be54a860109c444356d57a5e68748bce5552fa002f10463a1392fc08, md5=4c813c763821c86dba78141dd2a82d27, - sha256=331c07f7290fcfa085e420fbaf2a30e35cd5123c303258fad6eff5e545e6b828, sha1=f2bd5b58e9949d88afb17a4fd81d09b7779877d2, md5=dc7559d9c2a8b048d12888f8d78f7e3c, - sha256=084656f90d0e4436ef861d8118bcfe94884f057141071d778fee1522dca04f97, md5=8ad96949d86ac680b09ca6ffffa4bc5e, sha1=e4abd67e479bc96a804aa9d430f92f8fd627ba5a, - sha256=71ea2b88b0e955eb25619826cb23548ca35b1dcc152a25add7dc936ff55b31f0, sha1=826683f12332de6dd5f61f70d47e34911d46b071, md5=bf71ab4a49ab2c8b1b30af26da03d702, - sha256=0794576b17d3c26a38a7cafb921ffc2b91a52f2b4c13ee00c6e18d646dac6142, sha1=4657077e95a6714a0f1f2b7f86f73d60ae9a39ec, md5=ef1f8d5f30c229da97a54f06bc7a9f7e, - sha256=70c199fdf496137c1b339fdaeff9298db05007632ea0a047d0110284b0e81f98, md5=375ec551d451ba154ab6aa6e9054a12a, sha1=aa3fe56cbce18e9b8991f2d6abac7ffe6ac4bc22, - sha256=c7ec36156c21036f4ce6885f3380d71a54a9103a79e550acfc8274430f3dc663, md5=6b38d5bea2fbeaa59a0c5d65b21ef805, sha1=25c4e71a86d180c154486b76a355db38628b8a08, - sha256=a6eb5d0e918eddd0ba6b7b6e22afad61f92f7975134be4eadd50457391c12fca, md5=ebbd2ea7f07bb990f612b7dfd42e7fda, sha1=817788711dfc93e59b7df2ca27b84025d81c90f2, - sha1=1bd87bf289fcc2d7aabb72275aa4cf5f2768e58f, md5=b276fcbc7410d281c024118296acd955, sha256=aa87d0ea212d167ceb8df7ba11b70a6087410759fd144056ab00302baac0edbc, - md5=675b519871012e95524acbc520b93f20, sha256=9bf0252e8f664473ee4a20298a9f8ddf39871f6c657c4cdd2ea168b0027a9058, sha1=2b06c6b2f1270ed53762f43754a97e94a7bacdae, - md5=064e1173cebb5e24e743862e7d87733c, sha256=37e704a8d37cdcdfcd9e55792d0f6470d29ae92c5caabfc0934680ae992616db, sha1=c218b6a602d2dcde1b68491b11a6daf23bf1de29, - sha1=e5d0d398135eee1e8fdbd78540f322d8e6e2c600, md5=63819db40a4c7bddfaebd3cb4ebc4dde, sha256=13affbb3f64da116732cf096c59ac2e066ffa81f9bfa9e3c8d9dbee53b028ddb, - sha1=1449789d7b006026d334e9f99bb90df07f8d1bc6, md5=c63ea7ab71e10869d8813dd47279b60a, sha256=0e234c832c293988384398c39bca54da5700fd990b259d068831aca4e4c67f86, - md5=9c2ad8a0a664f41f0ede3a03b9aaf531, sha1=ae9bee873cc1a13248002837de67081f626bfe28, sha256=be87c01cea8e3b9f99f9ab9e156bde6c7f856a516d99e24ee9399bf381677c7f, - sha256=ff1c1acb2e287283b4fcf0cd2c656d41c573b40cafce171ed239670385c2a427, sha1=29d3d0d42c2a2975367aed2a303f3a71d65a6328, md5=742a117f310d8d131cab75792472ab13, - md5=d23d21af251cb76f0c05cc2a8bd788e5, sha1=fdd779f4cfdbb2ff6e36b47e5e27d02871f7dd0a, sha256=8e72e8122693374be42efb4514f1b0717ff22a13d5125595e3d4953ee439bc7a, - md5=d8cdc4c4f280e13e3b68e4376031ec60, sha256=5dc6e0f9bce862ff345028e04009355ed7453937f9b068351a2095be5fad59f9, sha1=9784a212fb33b5e0d198174ead9ac4f26d6fa144, - md5=073ab7d869c499b13559576d1dd88800, sha256=9b797f91b1de64a1271bb33df52226fb6ed748414f56317b331999a03029dc6e, sha1=8500fbc733b9b271ad6dce52a09d5520f66b6611, - sha1=89000f661f947e3c4fc3d5edea8ed6c74e852a81, sha256=a392dd90d320d43e9cd13bbbfda42b72badd0802f57b1c016a4ee3df3544b7df, md5=c29858b27c89580de4044bc08f0eaf57email: nina[.]romanenko[.]1985@mail[.]ruTitle: Targeted supply chain attack against Chrome browser extensionsLink: https://blog.sekoia.io/targeted-supply-chain-attack-against-chrome-browser-extensionsSummary: On December 26, 2024, Cyberhaven disclosed a significant security compromise involving their Chrome browser extension, where attackers exploited a targeted phishing strategy to upload a malicious version of the extension to the Chrome Web Store. Investigations revealed that the attackers had compromised approximately a dozen Chrome extensions, potentially endangering hundreds of thousands of users by embedding code that harvested sensitive information such as API keys, session cookies, and authentication tokens from platforms including ChatGPT and Facebook for Business. Analysts traced the attackers' infrastructure back to phishing campaigns dating from at least 2023, indicating a persistent threat actor utilizing similar tactics throughout 2023 and 2024 to gain unauthorized permissions from extension developers and deploy malicious code through compromised extensions.Threats: supply_chain_technique cyberhaven_breach_campaign spear-phishing_technique seo_poisoning_techniqueIndicators of compromise:-------------------------ip: 136[.]244[.]115[.]219, 149[.]28[.]124[.]84, 45[.]76[.]225[.]148, 137[.]220[.]48[.]214, 149[.]248[.]44[.]88, 140[.]82[.]45[.]42, 155[.]138[.]253[.]165, 108[.]61[.]23[.]192, 149[.]248[.]2[.]160, 140[.]82[.]50[.]201, 45[.]77[.]5[.]196, 149[.]28[.]117[.]236, 65[.]20[.]99[.]178, 45[.]77[.]185[.]211, 149[.]248[.]56[.]63, 185[.]92[.]222[.]127, 136[.]244[.]113[.]231, 144[.]202[.]101[.]155, 149[.]28[.]117[.]236:5200, 149[.]248[.]2[.]160:1488domain: proxyswitchyomega[.]pro, graphqlnetwork[.]pro, yescaptcha[.]pro, castorus[.]info, uvoice[.]live, videodownloadhelper[.]pro, parrottalks[.]info, bookmarkfc[.]info, internxtvpn[.]pro, vidnozflex[.]live, cyberhavenext[.]pro, wayinai[.]live, readermodeext[.]info, primusext[.]pro, tinamind[.]info, vpncity[.]live, dearflip[.]pro, iobit[.]pro, ultrablock[.]pro, yujaverity[.]info, censortracker[.]pro, wakelet[.]ink, pieadblock[.]pro, locallyext[.]ink, moonsift[.]store, chromeforextension[.]com, supportchromestore[.]com, chromewebstore-noreply[.]com, extensionbuysell[.]com, app[.]checkpolicy[.]site, extensionpolicyprivacy[.]com, policyextension[.]info, extensionpolicy[.]net, checkpolicy[.]site, linewizeconnect[.]com, savgptforchrome[.]pro, gptdetector[.]live, bardaiforchrome[.]live, searchcopilot[.]co, chatgptextent[.]pro, youtubeadsblocker[.]live, geminiaigg[.]pro, chataiassistant[.]pro, aiforgemini[.]com, chatgptextension[.]site, blockforads[.]com, ytbadblocker[.]com, geminiforads[.]com, savegptforyou[.]live, searchgptchat[.]info, savechatgpt[.]site, adskiper[.]net, savegptforchrome[.]com, chatgptforsearch[.]com, searchaiassitant[.]info, goodenhancerblocker[.]site, internetdownloadmanager[.]pro, openaigptforgg[.]site, adsblockforyoutube[.]site, promptheusgpt[.]info, gpt4chrome[.]live, savegpt[.]pro, gptforads[.]info, gptforbusiness[.]siteurl: https://app[.]checkpolicy[.]site/extension-privacy-policy?e=victime@example[.]com, https://app[.]checkpolicy[.]site/accept-terms-policy?e=victim@example[.]com, https://graphqlnetwork[.]pro/ai-graphqlnetwork, https://app[.]checkpolicy[.]site/extension-privacy-policy, https://app[.]checkpolicy[.]site/accept-terms-policyhash: - sha256=b0827dc54349b10098a7370ada4ea44ba668b264ccca2db5676be1c32e6cc154, - sha256=d303047205dabec8e2d34431e920ebe3478ca80a18f57bf454da094aca0e10aaemail: chromewebstore-noreply@chromeforextension[.]com, chromewebstore-noreply@supportchromestore[.]comThis article was generated with the assistance of an artificial intelligence language model, ChatGPT.
Analysis Summary
This analysis synthesizes information available from the provided article summary, focusing on the identified threat activity. Note that the article does not explicitly name a specific threat actor, so the summary focuses on the modus operandi of the group responsible for the described campaign.
# Threat Actor: Unattributed Group (Supply Chain Extortion Campaign)
## Attribution & Identity
The threat actor or group responsible for this campaign remains unattributed by the provided context. The activity is characterized by the exploitation of the software supply chain, specifically targeting the Chrome Web Store ecosystem.
## Activity Summary
The campaign culminated around December 26, 2024, when it was publicly disclosed that the attackers had successfully poisoned the legitimate Chrome browser extension from Cyberhaven. The core mechanism involved executing a **targeted phishing strategy** to upload a malicious version of the extension to the official Chrome Web Store. Investigations indicated that approximately **a dozen different Chrome extensions** were compromised as part of this operation.
## Tactics, Techniques & Procedures
- **Supply Chain Compromise:** Injecting malicious code through legitimate software distribution channels (Chrome Web Store).
- **Targeted Phishing:** Utilizing sophisticated social engineering to gain access or upload malicious updates.
- **Information Harvesting:** Code embedded in the compromised extensions actively harvested sensitive user data.
- **MITRE ATT&CK Mapping (Inferred):**
- T1195.002: Supply Chain Compromise: Compromise Software Supply Chain
## Targeting
- **Sectors:** Undetermined, but the compromise of developer tools and collaboration platforms suggests targeting organizations utilizing these services.
- **Geography:** Not explicitly mentioned, though Chrome extension users globally are potentially impacted.
- **Victims:** **Hundreds of thousands of users** who utilized the compromised extensions. Specific targets included organizational users accessing **ChatGPT** and **Facebook for Business** platforms.
## Tools & Infrastructure
- **Malware Families Used:** Custom code embedded within legitimate Chrome extension updates designed for data exfiltration.
- **Infrastructure (C2, Domains, IPs):**
- **IPs:** 136.244.115.219, 149.28.124.84, 45.76.225.148, 137.220.48.214, 149.248.44.88, 108.61.23.192, 149.248.2.160, 140.82.50.201
- **Domains:** [proxyswitchyomega.pro], [graphqlnetwork.pro], [yescaptcha.pro], [castorus.info], [uvoice.live], [videodownloadhelper.pro], [parrottalks.info], [bookmarkfc.info], [internxtvpn.pro], [vidnozflex.live], [cyberhavenext.pro], [wayinai.live], [readermodeext.info], [primusext.pro], [tinamind.info], [vpncity.live]
- **Exfiltration URLs:** [https://app.checkpolicy.site/[email protected]>, [https://app.checkpolicy.site/[email protected]]
## Implications
This incident highlights a high-impact supply chain threat vector where adversaries successfully leverage trusted third-party software repositories (Chrome Web Store) to compromise a massive user base rapidly. The objective was clear: **Information Theft**, specifically targeting high-value tokens and secrets (API keys, session cookies) tied to platforms like OpenAI (ChatGPT) and Facebook Business accounts, suggesting potential financial fraud, credential stuffing, or espionage is the ultimate goal.
## Mitigations
- **Strict Extension Vetting:** Organizations should audit all installed Chrome extensions and limit permissions granted to non-essential or lesser-known browser add-ons.
- **Principle of Least Privilege (Browser Level):** Regularly review and restrict the data third-party extensions can access across known business-critical applications.
- **Token and Session Management:** Implement strict expiration policies and multi-factor authentication for high-value services (ChatGPT, Business Accounts) to mitigate the risk of stolen session cookies.
- **Monitor for Indicators of Compromise (IOCs):** Network defenses should monitor and block connections to the listed malicious IPs and domains.
- **Software Supply Chain Auditing:** For developers, ensure robust security practices surrounding the build and distribution process to prevent malicious code injection before submission.