Analysis
-
max time kernel
156s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe
Resource
win7-en-20211208
General
-
Target
64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe
-
Size
4.2MB
-
MD5
a09a299fe4a28990a8e2aa829d5c8813
-
SHA1
e95c651c539eaf73e142d1867a1a96098a5e219f
-
SHA256
64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335
-
SHA512
9adbda1c42ed28890acad6430938e05cdbcb75ac1d01438b047ea6ee3a322ec16106dc049cbc463ccc27d4882a39949745390a34b3a8a21a97ee52a3a5528f57
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
Processes:
winchk32.exewinchk32.exewinchk32.exewinchk32.exewinchk64.exeExplorer.EXErutserv.exerutserv.exerfusclient.exepid Process 832 winchk32.exe 1372 winchk32.exe 1984 winchk32.exe 828 winchk32.exe 2000 winchk64.exe 1396 Explorer.EXE 556 rutserv.exe 240 rutserv.exe 1640 rfusclient.exe -
Loads dropped DLL 9 IoCs
Processes:
64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exewinchk32.execmd.exewinchk32.execmd.execmd.exerutserv.exepid Process 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 832 winchk32.exe 1096 cmd.exe 1984 winchk32.exe 856 cmd.exe 960 cmd.exe 240 rutserv.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
winchk32.exewinchk32.exedescription pid Process procid_target PID 832 set thread context of 1372 832 winchk32.exe 28 PID 1984 set thread context of 828 1984 winchk32.exe 35 -
Drops file in Windows directory 1 IoCs
Processes:
Explorer.EXEdescription ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winchk32.exewinchk32.exewinchk64.exeExplorer.EXEpid Process 1372 winchk32.exe 1372 winchk32.exe 1372 winchk32.exe 1372 winchk32.exe 828 winchk32.exe 828 winchk32.exe 828 winchk32.exe 828 winchk32.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 1396 Explorer.EXE 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 828 winchk32.exe 2000 winchk64.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 828 winchk32.exe 2000 winchk64.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe 828 winchk32.exe 2000 winchk64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid Process 1164 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
winchk32.exewinchk32.exewinchk64.exerutserv.exerutserv.exeExplorer.EXEdescription pid Process Token: SeDebugPrivilege 1372 winchk32.exe Token: SeDebugPrivilege 828 winchk32.exe Token: SeDebugPrivilege 2000 winchk64.exe Token: SeDebugPrivilege 556 rutserv.exe Token: SeTakeOwnershipPrivilege 240 rutserv.exe Token: SeTcbPrivilege 240 rutserv.exe Token: SeTcbPrivilege 240 rutserv.exe Token: SeShutdownPrivilege 1396 Explorer.EXE Token: SeShutdownPrivilege 1396 Explorer.EXE Token: SeShutdownPrivilege 1396 Explorer.EXE Token: SeShutdownPrivilege 1396 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid Process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid Process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
rutserv.exerutserv.exeAcroRd32.exepid Process 556 rutserv.exe 240 rutserv.exe 1164 AcroRd32.exe 1164 AcroRd32.exe 1164 AcroRd32.exe 1164 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exewinchk32.exewinchk32.execmd.execmd.exewinchk32.exewinchk32.exedescription pid Process procid_target PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 1448 wrote to memory of 832 1448 64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe 27 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 832 wrote to memory of 1372 832 winchk32.exe 28 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1372 wrote to memory of 1048 1372 winchk32.exe 29 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1048 wrote to memory of 388 1048 cmd.exe 31 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1372 wrote to memory of 1096 1372 winchk32.exe 32 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1096 wrote to memory of 1984 1096 cmd.exe 34 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 1984 wrote to memory of 828 1984 winchk32.exe 35 PID 828 wrote to memory of 856 828 winchk32.exe 36 PID 828 wrote to memory of 856 828 winchk32.exe 36 PID 828 wrote to memory of 856 828 winchk32.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe"C:\Users\Admin\AppData\Local\Temp\64c9b9ded4fb595717bf9a0999f6cc2f92e7b7d4b7d06eaaa8e75ba6922e7335.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\winchk32.exe" /inst /xwait4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.execmd.exe /C xcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\5⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\xcopy.exexcopy /Y /E /Q * C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\6⤵
- Enumerates system info in registry
PID:388
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk32.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.execmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj8⤵
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\winchk64.exe /inj9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe8⤵
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:556 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rutserv.exe -second10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:240 -
C:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exeC:\Users\Admin\AppData\Roaming\29D451CF-3548-4486-8465-A23029B8F6FA\101\rfusclient.exe /tray /user11⤵
- Executes dropped EXE
PID:1640
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ZPDG.pdf"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1164
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ab1e92ef682a01e3ff9c98497f5b8972
SHA1400438eb302886fd064274188647e6653e455eed
SHA25633beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00
-
MD5
2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA25638bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA5122911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5
-
MD5
69e8ec9bdccd6ed33fcad2fa19602b2f
SHA19f48e109675cdb0a53400358c27853db48fcd156
SHA256cff2de4c828e78febfb2eb8b4780092d395016608b641e126e67e27058415759
SHA512b22b948aec9b58dca27481e5d638dd53c99e4f9ed4f7f2270ae1a60b36567ac9c02635d33e528d82dd77157e62107616bba199cf6f34078bd1ecdb7ebe424773
-
MD5
ba9dbe65381759bb06d3dc6a2d0089c8
SHA137a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA5122471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf
-
MD5
abdbcc091c67fd748cbbf0bf257f6712
SHA18f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA5129a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
8ee5ab32edced6eb38819b7674bfb0cd
SHA1030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA51282f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9
-
MD5
df73a0ee624fa95fb96a4125c15c0420
SHA1a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA5121d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e
-
MD5
42bb69a180bf12f972d10aed9ce02861
SHA1c2f9ffdf518da9e037f76902746de89c2e2821e8
SHA2569086824882cd7c64e3d43a6597e657c5f0290dfcacffc3d0f1faba15a61761ba
SHA5125ccbb47a79d3372c3edf074d09e82d7fce149cdaaa7f5b615226c247628b5fccec9980c44642ef36738b05f706f15984a4dd984b156fb103af2a20ff63917013
-
MD5
cfcdf13096177dd4ae41cba719a41a8f
SHA1a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA5128fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614
-
MD5
ab1e92ef682a01e3ff9c98497f5b8972
SHA1400438eb302886fd064274188647e6653e455eed
SHA25633beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00
-
MD5
ab1e92ef682a01e3ff9c98497f5b8972
SHA1400438eb302886fd064274188647e6653e455eed
SHA25633beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00
-
MD5
2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA25638bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA5122911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5
-
MD5
2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA25638bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA5122911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5
-
MD5
2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA25638bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA5122911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5
-
MD5
ba9dbe65381759bb06d3dc6a2d0089c8
SHA137a2a15c52caa7d63af86778c2dd1d2d81d4a270
SHA256ff102c6601d2252ed19a1db07f4786813cca2797d404533c33fa0a065ab5a173
SHA5122471e3df6f15646aa06cdea9cc2388addffec85dfde9343dfee3b2f083d98d7e8a314d1cb51b07689a9529f035bd551fd16d3cc899f5e57f9c35fd778e8258cf
-
MD5
abdbcc091c67fd748cbbf0bf257f6712
SHA18f85738534158db9c600a29b9ded8ac85c3de8c1
SHA256821cc916a326adc1decdf565a1c9f5c08868aa070722f11ecd48e617deb37a39
SHA5129a7421a5c69695896b64c8e90c2ba6f6957a81c37ff32096a0fdad1a348fd921305d077a6a19302ef2a270f52dab6e9e2b03f9f6264550f325e68ffc2569f5fa
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
8ee5ab32edced6eb38819b7674bfb0cd
SHA1030dc8c3832f664fa10efa3105dff0a9b6d48911
SHA256a4de66b79f1d129e3da059ca93d62cf2f88e08fa06a5c492ca154ee25e321f9b
SHA51282f4ccbb53c2ecb71c3dcd2c0d7d15ce5cc0a66f92f9f661cfc9ee98df093c481cbbb8888a854d359a388e28ab1085ec7e02452bffed030c118226caf70a6bf9
-
MD5
df73a0ee624fa95fb96a4125c15c0420
SHA1a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA5121d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e
-
MD5
cfcdf13096177dd4ae41cba719a41a8f
SHA1a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA5128fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
ab1e92ef682a01e3ff9c98497f5b8972
SHA1400438eb302886fd064274188647e6653e455eed
SHA25633beb5aa6feb6cda81908eaeb9f511388c236938937cdc9d02a39616dc7a0c45
SHA512526a988d12983d87a8f4155720ff335ed1c73cb80eb7b42f3813c9c36c64ff31af5409473634429031d6ba62568a16f8a06de7f2f061c28170ff2a7a18a7bc00
-
MD5
2cf7e5dbe01ea0bb608758fa07d03b7a
SHA1e56189fe86c9537c28099518d4f4ea2e42ef9eee
SHA25638bd6e45c43ca61f4de58a371c3699abe10c08a2d1663571cb140146b3dfb441
SHA5122911880542aca6c8d1414df87596d0a172f579531370804bd47545b41230adf761f87b561c7f6dab178c8e616ab0acdb4503f769cdedc7ad16fb11c612e2bfc5
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
aff05aa5f2c03cb85b7c854a5d682d60
SHA1e00c309e3fe09248b8afcff29fc1a79445c913da
SHA256a3ae0d68144ae488422cb42ecc5e14d961406ae8e3eb66ca68b40df83bdd8836
SHA512016c0b209e960e8a33006d219cca5cd723c6fa3327c9c3606d20960f13984da574df6f084dd6e9fe105a52eecd753c3e23d127b6e54a6bc38240d9f344984132
-
MD5
df73a0ee624fa95fb96a4125c15c0420
SHA1a5ace8f90c33cbdb12d398c0f227ec48f99551bf
SHA256e9d81266f9ba09aff6e9d98f8c18a95bac7695ac2ad3f41f19f13a77d559838e
SHA5121d43552b432479accccb7bd0c4b8c428c62a907828e13f5022cb690b767451b1b3b407d873258dd1439c9ca76e828fb70beebc58644ed86513b7d94fbdf1aa6e
-
MD5
cfcdf13096177dd4ae41cba719a41a8f
SHA1a56a299a8eef9f4ff082184f66fad1b76c7cacb8
SHA256be809419f4b8f4fb16c3bc35d2a387c5aa3c440d10951064262df7a67ad26db1
SHA5128fef50620704e3d374a0fac1f610a18d315835bbc928e30da8b573a72aecfc5454ddecc3f42af95aa63d8f94e4317439b0e9b6056046d815f44f3ab5107a1614