Analysis
-
max time kernel
8s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-05-2021 20:02
Static task
static1
Behavioral task
behavioral1
Sample
f8779af577c68ff3add11db6f6e63e8e.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f8779af577c68ff3add11db6f6e63e8e.exe
Resource
win10v20210410
General
-
Target
f8779af577c68ff3add11db6f6e63e8e.exe
-
Size
6.8MB
-
MD5
f8779af577c68ff3add11db6f6e63e8e
-
SHA1
d687be4410485a26c766edb253aa6d572e322bc1
-
SHA256
cb3c387163302fbf8ddb4c13e9d786c1070a4185a74bdd3faebd1649d02b2b30
-
SHA512
0605a1b28e4d0ad2975167c613687c8933ab4b0f5c9388d3158a582a25824aaf1663544cdb6a9697cb82abc281c600092d51f07180812170289fcf99bc5aab84
Malware Config
Signatures
-
Executes dropped EXE 10 IoCs
Processes:
hjjgaa.exeRunWW.exeBarSetpFile.exeguihuali-game.exeLabPicV3.exelylal220.exejg7_7wjg.exeVersium.exelylal220.tmpVersium.tmppid process 1968 hjjgaa.exe 268 RunWW.exe 1156 BarSetpFile.exe 1492 guihuali-game.exe 1744 LabPicV3.exe 1704 lylal220.exe 1072 jg7_7wjg.exe 1200 Versium.exe 1548 lylal220.tmp 824 Versium.tmp -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx \Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule \Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe vmprotect C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe vmprotect behavioral1/memory/1968-81-0x0000000000CF0000-0x000000000134F000-memory.dmp vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect behavioral1/memory/1072-119-0x0000000000400000-0x000000000065D000-memory.dmp vmprotect \Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe vmprotect -
Loads dropped DLL 23 IoCs
Processes:
f8779af577c68ff3add11db6f6e63e8e.exeLabPicV3.exelylal220.exeVersium.exeVersium.tmplylal220.tmpWerFault.exepid process 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1036 f8779af577c68ff3add11db6f6e63e8e.exe 1744 LabPicV3.exe 1704 lylal220.exe 1200 Versium.exe 824 Versium.tmp 824 Versium.tmp 1548 lylal220.tmp 1548 lylal220.tmp 824 Versium.tmp 1548 lylal220.tmp 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ipinfo.io 6 ip-api.com 14 ipinfo.io -
Drops file in Program Files directory 10 IoCs
Processes:
f8779af577c68ff3add11db6f6e63e8e.exedescription ioc process File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe f8779af577c68ff3add11db6f6e63e8e.exe File created C:\Program Files (x86)\Data Finder\Versium Research\Uninstall.ini f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\Uninstall.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe f8779af577c68ff3add11db6f6e63e8e.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe f8779af577c68ff3add11db6f6e63e8e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2028 1072 WerFault.exe jg7_7wjg.exe 1880 268 WerFault.exe RunWW.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BarSetpFile.exedescription pid process Token: SeDebugPrivilege 1156 BarSetpFile.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Versium.tmppid process 824 Versium.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f8779af577c68ff3add11db6f6e63e8e.exeLabPicV3.exelylal220.exeVersium.exejg7_7wjg.exedescription pid process target process PID 1036 wrote to memory of 1968 1036 f8779af577c68ff3add11db6f6e63e8e.exe hjjgaa.exe PID 1036 wrote to memory of 1968 1036 f8779af577c68ff3add11db6f6e63e8e.exe hjjgaa.exe PID 1036 wrote to memory of 1968 1036 f8779af577c68ff3add11db6f6e63e8e.exe hjjgaa.exe PID 1036 wrote to memory of 1968 1036 f8779af577c68ff3add11db6f6e63e8e.exe hjjgaa.exe PID 1036 wrote to memory of 268 1036 f8779af577c68ff3add11db6f6e63e8e.exe RunWW.exe PID 1036 wrote to memory of 268 1036 f8779af577c68ff3add11db6f6e63e8e.exe RunWW.exe PID 1036 wrote to memory of 268 1036 f8779af577c68ff3add11db6f6e63e8e.exe RunWW.exe PID 1036 wrote to memory of 268 1036 f8779af577c68ff3add11db6f6e63e8e.exe RunWW.exe PID 1036 wrote to memory of 1156 1036 f8779af577c68ff3add11db6f6e63e8e.exe BarSetpFile.exe PID 1036 wrote to memory of 1156 1036 f8779af577c68ff3add11db6f6e63e8e.exe BarSetpFile.exe PID 1036 wrote to memory of 1156 1036 f8779af577c68ff3add11db6f6e63e8e.exe BarSetpFile.exe PID 1036 wrote to memory of 1156 1036 f8779af577c68ff3add11db6f6e63e8e.exe BarSetpFile.exe PID 1036 wrote to memory of 1492 1036 f8779af577c68ff3add11db6f6e63e8e.exe guihuali-game.exe PID 1036 wrote to memory of 1492 1036 f8779af577c68ff3add11db6f6e63e8e.exe guihuali-game.exe PID 1036 wrote to memory of 1492 1036 f8779af577c68ff3add11db6f6e63e8e.exe guihuali-game.exe PID 1036 wrote to memory of 1492 1036 f8779af577c68ff3add11db6f6e63e8e.exe guihuali-game.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1744 1036 f8779af577c68ff3add11db6f6e63e8e.exe LabPicV3.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1704 1036 f8779af577c68ff3add11db6f6e63e8e.exe lylal220.exe PID 1036 wrote to memory of 1072 1036 f8779af577c68ff3add11db6f6e63e8e.exe jg7_7wjg.exe PID 1036 wrote to memory of 1072 1036 f8779af577c68ff3add11db6f6e63e8e.exe jg7_7wjg.exe PID 1036 wrote to memory of 1072 1036 f8779af577c68ff3add11db6f6e63e8e.exe jg7_7wjg.exe PID 1036 wrote to memory of 1072 1036 f8779af577c68ff3add11db6f6e63e8e.exe jg7_7wjg.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1036 wrote to memory of 1200 1036 f8779af577c68ff3add11db6f6e63e8e.exe Versium.exe PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1744 wrote to memory of 608 1744 LabPicV3.exe LabPicV3.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1704 wrote to memory of 1548 1704 lylal220.exe lylal220.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1200 wrote to memory of 824 1200 Versium.exe Versium.tmp PID 1072 wrote to memory of 2028 1072 jg7_7wjg.exe WerFault.exe PID 1072 wrote to memory of 2028 1072 jg7_7wjg.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8779af577c68ff3add11db6f6e63e8e.exe"C:\Users\Admin\AppData\Local\Temp\f8779af577c68ff3add11db6f6e63e8e.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"2⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:1408
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"2⤵
- Executes dropped EXE
PID:268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 7643⤵
- Program crash
PID:1880 -
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"2⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install3⤵PID:652
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\is-O6DBI.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-O6DBI.tmp\LabPicV3.tmp" /SL5="$50122,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"3⤵PID:608
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\is-1BRTR.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-1BRTR.tmp\lylal220.tmp" /SL5="$300E0,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 2003⤵
- Loads dropped DLL
- Program crash
PID:2028 -
C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe"C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe" /Verysilent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\is-BNKOG.tmp\Versium.tmp"C:\Users\Admin\AppData\Local\Temp\is-BNKOG.tmp\Versium.tmp" /SL5="$30104,138429,56832,C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe" /Verysilent3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:1712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
96a80d0e7aafd552c6857ef310d64c7d
SHA1b4f308a47c85a76e22b01cc6291c70a4e459ebe2
SHA2561e706fc40379884d40b62ab4f6b26cd576447d93fc429123a2eae1b9c26892db
SHA512f2671402c7eee989b62a0367eeba766ae7ac1dddfbbb45c4c62799112b8638fc798c79bb1772aa3a7a51e404239feb633ba2a03aebb84dd04a69adc47e2954b4
-
MD5
96a80d0e7aafd552c6857ef310d64c7d
SHA1b4f308a47c85a76e22b01cc6291c70a4e459ebe2
SHA2561e706fc40379884d40b62ab4f6b26cd576447d93fc429123a2eae1b9c26892db
SHA512f2671402c7eee989b62a0367eeba766ae7ac1dddfbbb45c4c62799112b8638fc798c79bb1772aa3a7a51e404239feb633ba2a03aebb84dd04a69adc47e2954b4
-
MD5
1e09b73afa67d8bfe8591eb605cef0e3
SHA1147fdec45342a0e069dd1aeea2c109440894bef9
SHA256431c13d939d7460db6ec5f524145a93fae7711d61344fbf1898cea7895480286
SHA512b74516b1f3d241790537aaaaf9c8b90bd2edbcf2e7693c166b11c260d6689b9e0f2a9c25b5e6787d6c717eb9ad64605b783bdd1ac09a9b50f211112007c27a49
-
MD5
1e09b73afa67d8bfe8591eb605cef0e3
SHA1147fdec45342a0e069dd1aeea2c109440894bef9
SHA256431c13d939d7460db6ec5f524145a93fae7711d61344fbf1898cea7895480286
SHA512b74516b1f3d241790537aaaaf9c8b90bd2edbcf2e7693c166b11c260d6689b9e0f2a9c25b5e6787d6c717eb9ad64605b783bdd1ac09a9b50f211112007c27a49
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
f6e70fbfe1d53b8d9d6d0b273542a7f7
SHA11f962079e158b2b0b27a02e6985a14e5f739d368
SHA256ba0da2f848a7beeb8109b7a4baa6f79434be60a47a3ae9a980b29568d53eb8aa
SHA5122a951950502ec835bea6ef875b519941d05f00a96dd0b6b9aef59b40723d32a5a6d546e4ba39650e046bc7dd1e23eba383fc41b8f96cf5ffe406a2f17fdb5b61
-
MD5
f6e70fbfe1d53b8d9d6d0b273542a7f7
SHA11f962079e158b2b0b27a02e6985a14e5f739d368
SHA256ba0da2f848a7beeb8109b7a4baa6f79434be60a47a3ae9a980b29568d53eb8aa
SHA5122a951950502ec835bea6ef875b519941d05f00a96dd0b6b9aef59b40723d32a5a6d546e4ba39650e046bc7dd1e23eba383fc41b8f96cf5ffe406a2f17fdb5b61
-
MD5
a30bdf843d0961c11e78fed101764f74
SHA10c421c3d2d007a09b9b968ac485464844fa8ca9d
SHA2562c709b91decabb0daca10556e5cdd3a5efc6422ee1e27d9914475a26fa7cf219
SHA512fea2281da0325f27e78483117356776400f01760c13bd3fab7c2f6ac91d5eb64300b820dedc9b55c84ecdeb7132b700a366046789b30b7ad7c9d0b9f577847bf
-
MD5
a30bdf843d0961c11e78fed101764f74
SHA10c421c3d2d007a09b9b968ac485464844fa8ca9d
SHA2562c709b91decabb0daca10556e5cdd3a5efc6422ee1e27d9914475a26fa7cf219
SHA512fea2281da0325f27e78483117356776400f01760c13bd3fab7c2f6ac91d5eb64300b820dedc9b55c84ecdeb7132b700a366046789b30b7ad7c9d0b9f577847bf
-
MD5
6bd341bfca324b52dfa4f696c7978025
SHA109029b634ff31a7e2cc903f2e1580bc6f554558d
SHA256faae49fcc25f6c53f5b94d7d878b4babffcc2fbcb79f4f3183c68b465b1c33c6
SHA512d848b7ddd7b10be177c805f4ec9d8976ee2de9bf154512e1367c2d8c448ecdee505e53542e7ee84de3d4850cde7a2f3b0ae5890f1d9f9375ad47c1f328a3e216
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
1cb9c1b506a1a0e472ba4ed650b84f68
SHA1967034fcd28bcf9650b4fb55cc3eee487d56bd7b
SHA256c16b2b130f8099f72465ea300b41f14efa56ee8d76e8da80f048203aff69b1e4
SHA5125df9c7b9ae0fa91209e92967034336f0ed8c5e884df3e89cdba59ca0d566d7419975cc8154cff41d6a71596b929ac48e4719ced06dd347f342db4eef796e6f9a
-
MD5
1cb9c1b506a1a0e472ba4ed650b84f68
SHA1967034fcd28bcf9650b4fb55cc3eee487d56bd7b
SHA256c16b2b130f8099f72465ea300b41f14efa56ee8d76e8da80f048203aff69b1e4
SHA5125df9c7b9ae0fa91209e92967034336f0ed8c5e884df3e89cdba59ca0d566d7419975cc8154cff41d6a71596b929ac48e4719ced06dd347f342db4eef796e6f9a
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
MD5
77038c199399d4830a6bf570d46c4edb
SHA16158a9e03e797535e4438bf2f995c4904ed16079
SHA2569051a4489a9fa483934b8df5146cc5cb6c55a6f74fd58b266f731dffa4a3271e
SHA512191f8cf61672b2c1fd23cfe7fad6b9341181f593f5c2dcef5f7db07918572b596ff8c078800ed4d4ea9e143ddbce99a8a445137a3737684f7e06aa6fc25d8b3d
-
MD5
5e6df381ce1c9102799350b7033e41df
SHA1f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA25601808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
SHA512a27ca6d1643fbbbb13e46f35d06fe8a5414a8ddaedd9e417cbb1636ad96228ccadee928d5204123f2221a20fe7c416587d78967b47ffcbcf3c6ac4b7a1ca887d
-
MD5
93839f8c15234e4c8f1f9d0f285400a0
SHA1afedb5526c9962a6257dbd0b805ed76f9f26b093
SHA256449895149bf2a3864240e6ce912b90023cbf391adea2e35bcad7c73cb169b1a6
SHA51269e77f62d27f1466576725d0c802437813bbff1af010b7460dfcd3f6cfa79de808f166bae437258cafbfcefb8d9de6ab658cdedb2e63d98a77f571b5e4ae77e7
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
96a80d0e7aafd552c6857ef310d64c7d
SHA1b4f308a47c85a76e22b01cc6291c70a4e459ebe2
SHA2561e706fc40379884d40b62ab4f6b26cd576447d93fc429123a2eae1b9c26892db
SHA512f2671402c7eee989b62a0367eeba766ae7ac1dddfbbb45c4c62799112b8638fc798c79bb1772aa3a7a51e404239feb633ba2a03aebb84dd04a69adc47e2954b4
-
MD5
1e09b73afa67d8bfe8591eb605cef0e3
SHA1147fdec45342a0e069dd1aeea2c109440894bef9
SHA256431c13d939d7460db6ec5f524145a93fae7711d61344fbf1898cea7895480286
SHA512b74516b1f3d241790537aaaaf9c8b90bd2edbcf2e7693c166b11c260d6689b9e0f2a9c25b5e6787d6c717eb9ad64605b783bdd1ac09a9b50f211112007c27a49
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
1757f447661fdd9a96df09e47098c5cb
SHA1f6eb4dae2cfea18ddabf120a2a12886d558e56a2
SHA256a4904600ca5c08db5e7949480af9693d7fa0dd3bcebcad59c0c0808df8704a98
SHA5126a533dc9cc3d9d19a63aa95eb85496d5c59f0ba9929c6482a7f49a25381e9c92a11c68b0fc3167cfe2154272db28968e37ae2e48b61d53e1a7f96d71efd5c741
-
MD5
f6e70fbfe1d53b8d9d6d0b273542a7f7
SHA11f962079e158b2b0b27a02e6985a14e5f739d368
SHA256ba0da2f848a7beeb8109b7a4baa6f79434be60a47a3ae9a980b29568d53eb8aa
SHA5122a951950502ec835bea6ef875b519941d05f00a96dd0b6b9aef59b40723d32a5a6d546e4ba39650e046bc7dd1e23eba383fc41b8f96cf5ffe406a2f17fdb5b61
-
MD5
a30bdf843d0961c11e78fed101764f74
SHA10c421c3d2d007a09b9b968ac485464844fa8ca9d
SHA2562c709b91decabb0daca10556e5cdd3a5efc6422ee1e27d9914475a26fa7cf219
SHA512fea2281da0325f27e78483117356776400f01760c13bd3fab7c2f6ac91d5eb64300b820dedc9b55c84ecdeb7132b700a366046789b30b7ad7c9d0b9f577847bf
-
MD5
a30bdf843d0961c11e78fed101764f74
SHA10c421c3d2d007a09b9b968ac485464844fa8ca9d
SHA2562c709b91decabb0daca10556e5cdd3a5efc6422ee1e27d9914475a26fa7cf219
SHA512fea2281da0325f27e78483117356776400f01760c13bd3fab7c2f6ac91d5eb64300b820dedc9b55c84ecdeb7132b700a366046789b30b7ad7c9d0b9f577847bf
-
MD5
6bd341bfca324b52dfa4f696c7978025
SHA109029b634ff31a7e2cc903f2e1580bc6f554558d
SHA256faae49fcc25f6c53f5b94d7d878b4babffcc2fbcb79f4f3183c68b465b1c33c6
SHA512d848b7ddd7b10be177c805f4ec9d8976ee2de9bf154512e1367c2d8c448ecdee505e53542e7ee84de3d4850cde7a2f3b0ae5890f1d9f9375ad47c1f328a3e216
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
b72ca731ce917c0cf7893702be1e30af
SHA1d77a405a51e88c75b3bee2ab29662101ffb3e0a3
SHA256783d47c446d1e482c19fbc6ded572ea16d5784dc775073662827c31f32d9a0ef
SHA512a2f5ab9c3b846a115fec99aa0eb3ee9cfb8bd4daec5d95a69f29441db81f7137d78bddbd2dbd7cf4690581d43147d43300196f24add334fd6db5d53213d33158
-
MD5
1cb9c1b506a1a0e472ba4ed650b84f68
SHA1967034fcd28bcf9650b4fb55cc3eee487d56bd7b
SHA256c16b2b130f8099f72465ea300b41f14efa56ee8d76e8da80f048203aff69b1e4
SHA5125df9c7b9ae0fa91209e92967034336f0ed8c5e884df3e89cdba59ca0d566d7419975cc8154cff41d6a71596b929ac48e4719ced06dd347f342db4eef796e6f9a
-
MD5
b64b269a2a96faec9fc04a060596fae8
SHA13272dbf84c1ac61d910bb5cbcb8bbef64191820d
SHA2562808fe3aaf8e1048e4807076b04b17b976727677313e1e76a44ef1ecf3c7f188
SHA5121fcd0d9b0cf1f500ec5355bfc7675caa4e7c70d95edbb6ce1f4df53010d08c27086f48cc623bfaaa232c6bfccbc6c1c8fe2ecf8e04c21912c2f5c87999a7bf69
-
MD5
5e6df381ce1c9102799350b7033e41df
SHA1f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA25601808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
SHA512a27ca6d1643fbbbb13e46f35d06fe8a5414a8ddaedd9e417cbb1636ad96228ccadee928d5204123f2221a20fe7c416587d78967b47ffcbcf3c6ac4b7a1ca887d
-
MD5
5e6df381ce1c9102799350b7033e41df
SHA1f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA25601808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
SHA512a27ca6d1643fbbbb13e46f35d06fe8a5414a8ddaedd9e417cbb1636ad96228ccadee928d5204123f2221a20fe7c416587d78967b47ffcbcf3c6ac4b7a1ca887d
-
MD5
5e6df381ce1c9102799350b7033e41df
SHA1f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA25601808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
SHA512a27ca6d1643fbbbb13e46f35d06fe8a5414a8ddaedd9e417cbb1636ad96228ccadee928d5204123f2221a20fe7c416587d78967b47ffcbcf3c6ac4b7a1ca887d
-
MD5
5e6df381ce1c9102799350b7033e41df
SHA1f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA25601808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
SHA512a27ca6d1643fbbbb13e46f35d06fe8a5414a8ddaedd9e417cbb1636ad96228ccadee928d5204123f2221a20fe7c416587d78967b47ffcbcf3c6ac4b7a1ca887d
-
MD5
93839f8c15234e4c8f1f9d0f285400a0
SHA1afedb5526c9962a6257dbd0b805ed76f9f26b093
SHA256449895149bf2a3864240e6ce912b90023cbf391adea2e35bcad7c73cb169b1a6
SHA51269e77f62d27f1466576725d0c802437813bbff1af010b7460dfcd3f6cfa79de808f166bae437258cafbfcefb8d9de6ab658cdedb2e63d98a77f571b5e4ae77e7
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
MD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
MD5
dda84ebcc3c9968655702f7a6da23e1f
SHA18514f2e9eab129bd8288d5f13cf0030cae2e7fc5
SHA256743dcd957b3b1f5401d1812cbae0e546a31eff23507b5238198f8f0e7b65682b
SHA512e54f70e0876b7f566b9889874c20b75eb7c264184a2e2e7067f6b5b5940331818c1bcf4e263b32e3d71c62f5f0c2880c07dabeb1d9742a3990231f6e459a61e8
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
92dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
MD5
d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
MD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c