Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 14:56
Static task
static1
Behavioral task
behavioral1
Sample
8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe
Resource
win7-20220414-en
General
-
Target
8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe
-
Size
4.2MB
-
MD5
222ed21454fe20b7b03ddfdea73f38af
-
SHA1
a96bcb7230d6b1898047a0b39a6dc6d2654d0a42
-
SHA256
8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6
-
SHA512
f2221af308723a0ecdc85196733bed7c52d5d2369b9ec11c095c96f82875521856c0e402814240467da8df0bf1b40ef7e7d5faae27f58a83d66cd9fd98dd81f0
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
Processes:
done.sfx.exedone.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 1864 done.sfx.exe 1652 done.exe 576 rutserv.exe 1828 rutserv.exe 1692 rutserv.exe 1260 rutserv.exe 844 rfusclient.exe 1752 rfusclient.exe 752 rfusclient.exe -
Processes:
resource yara_rule C:\Program Files (x86)\Skype\Skype\rfusclient.exe upx C:\Program Files (x86)\Skype\Skype\rutserv.exe upx C:\Program Files\rtsd\rutserv.exe upx C:\Program Files\rtsd\rfusclient.exe upx C:\Program Files\rtsd\rutserv.exe upx \Program Files\rtsd\rutserv.exe upx C:\Program Files\rtsd\rutserv.exe upx C:\Program Files\rtsd\rutserv.exe upx C:\Program Files\rtsd\rutserv.exe upx \Program Files\rtsd\rfusclient.exe upx \Program Files\rtsd\rfusclient.exe upx C:\Program Files\rtsd\rfusclient.exe upx C:\Program Files\rtsd\rfusclient.exe upx C:\Program Files\rtsd\rfusclient.exe upx -
Loads dropped DLL 8 IoCs
Processes:
cmd.exedone.sfx.execmd.exerutserv.exepid process 1220 cmd.exe 1864 done.sfx.exe 1864 done.sfx.exe 1864 done.sfx.exe 1864 done.sfx.exe 1608 cmd.exe 1260 rutserv.exe 1260 rutserv.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 20 IoCs
Processes:
done.execmd.exeattrib.exedescription ioc process File opened for modification C:\Program Files (x86)\Skype\Skype\regedit.reg done.exe File opened for modification C:\Program Files (x86)\Skype\Skype\rutserv.exe done.exe File created C:\Program Files\rtsd\rutserv.exe cmd.exe File opened for modification C:\Program Files\rtsd\vp8encoder.dll attrib.exe File opened for modification C:\Program Files (x86)\Skype\Skype\install.bat done.exe File created C:\Program Files (x86)\Skype\Skype\Uninstall.ini done.exe File opened for modification C:\Program Files\rtsd\rutserv.exe attrib.exe File opened for modification C:\Program Files (x86)\Skype\Skype\rfusclient.exe done.exe File opened for modification C:\Program Files (x86)\Skype\Skype\vp8decoder.dll done.exe File opened for modification C:\Program Files (x86)\Skype\Skype\Uninstall.exe done.exe File created C:\Program Files\rtsd\rfusclient.exe cmd.exe File created C:\Program Files\rtsd\vp8encoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\vp8encoder.dll cmd.exe File opened for modification C:\Program Files (x86)\Skype\Skype\vp8encoder.dll done.exe File opened for modification C:\Program Files\rtsd\rfusclient.exe cmd.exe File opened for modification C:\Program Files\rtsd\rutserv.exe cmd.exe File created C:\Program Files\rtsd\vp8decoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\vp8decoder.dll cmd.exe File opened for modification C:\Program Files\rtsd\rfusclient.exe attrib.exe File opened for modification C:\Program Files\rtsd\vp8decoder.dll attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2028 taskkill.exe 864 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 1816 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 576 rutserv.exe 576 rutserv.exe 576 rutserv.exe 576 rutserv.exe 1828 rutserv.exe 1828 rutserv.exe 1692 rutserv.exe 1692 rutserv.exe 1260 rutserv.exe 1260 rutserv.exe 1260 rutserv.exe 1260 rutserv.exe 844 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 752 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 2028 taskkill.exe Token: SeDebugPrivilege 864 taskkill.exe Token: SeDebugPrivilege 576 rutserv.exe Token: SeDebugPrivilege 1692 rutserv.exe Token: SeTakeOwnershipPrivilege 1260 rutserv.exe Token: SeTcbPrivilege 1260 rutserv.exe Token: SeTcbPrivilege 1260 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 576 rutserv.exe 1828 rutserv.exe 1692 rutserv.exe 1260 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.execmd.exedone.sfx.exedone.execmd.exerutserv.exerfusclient.exedescription pid process target process PID 1192 wrote to memory of 1220 1192 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe cmd.exe PID 1192 wrote to memory of 1220 1192 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe cmd.exe PID 1192 wrote to memory of 1220 1192 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe cmd.exe PID 1192 wrote to memory of 1220 1192 8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe cmd.exe PID 1220 wrote to memory of 1864 1220 cmd.exe done.sfx.exe PID 1220 wrote to memory of 1864 1220 cmd.exe done.sfx.exe PID 1220 wrote to memory of 1864 1220 cmd.exe done.sfx.exe PID 1220 wrote to memory of 1864 1220 cmd.exe done.sfx.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1864 wrote to memory of 1652 1864 done.sfx.exe done.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1652 wrote to memory of 1608 1652 done.exe cmd.exe PID 1608 wrote to memory of 2028 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 2028 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 2028 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 2028 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 864 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 864 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 864 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 864 1608 cmd.exe taskkill.exe PID 1608 wrote to memory of 1092 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1092 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1092 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1092 1608 cmd.exe reg.exe PID 1608 wrote to memory of 1816 1608 cmd.exe regedit.exe PID 1608 wrote to memory of 1816 1608 cmd.exe regedit.exe PID 1608 wrote to memory of 1816 1608 cmd.exe regedit.exe PID 1608 wrote to memory of 1816 1608 cmd.exe regedit.exe PID 1608 wrote to memory of 340 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 340 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 340 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 340 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 576 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 576 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 576 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 576 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1828 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1828 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1828 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1828 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1692 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1692 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1692 1608 cmd.exe rutserv.exe PID 1608 wrote to memory of 1692 1608 cmd.exe rutserv.exe PID 1260 wrote to memory of 844 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 1752 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 844 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 1752 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 844 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 844 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 1752 1260 rutserv.exe rfusclient.exe PID 1260 wrote to memory of 1752 1260 rutserv.exe rfusclient.exe PID 844 wrote to memory of 752 844 rfusclient.exe rfusclient.exe PID 844 wrote to memory of 752 844 rfusclient.exe rfusclient.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"C:\Users\Admin\AppData\Local\Temp\8cc23b0aaa5df43e2bfd85ba9d8e5ac83f1070a96aeb09f533b7b6be50602ac6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\start.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\done.sfx.exedone.sfx.exe -p12345 -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\done.exe"C:\Users\Admin\AppData\Local\Temp\done.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\Skype\Skype\install.bat" "5⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 4t4t56⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im g4rgt6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
C:\Windows\SysWOW64\reg.exereg delete "70t9j" /f6⤵PID:1092
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"6⤵
- Runs .reg file with regedit
PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\rtsd\*.*"6⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:340
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /silentinstall6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:576
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /firewall6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Program Files\rtsd\rutserv.exerutserv.exe /start6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1692
-
-
-
-
-
-
C:\Program Files\rtsd\rutserv.exe"C:\Program Files\rtsd\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:752
-
-
-
C:\Program Files\rtsd\rfusclient.exe"C:\Program Files\rtsd\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:1752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
884B
MD5fd6bef56a5dc776691926eb3aa7b5279
SHA1da94eb0f6ca09850decb74326fe7894253dfec6c
SHA256db1602d244bad54475174194204f4604804094c8156b8ea2b1dc81879be8ac92
SHA5123694350a2efaece3664c96327f0fc6cb77a87d68313a3011824953650b9afc40d19b2db1743dbbd317a223d5463c7a8eae1518a9b1e417226e930a941c7f830c
-
Filesize
12KB
MD5be9eab82e90b682ee82da98a7c77fede
SHA1d1ac691345dc42dc253c441e92f4e54e74135451
SHA25649525765484a492bdc74a26bf2baf5f2dda6907dc1866ca80bd3d97c1177fd4d
SHA512047aa0866e1c4c64ddbda3621741a117f6ce3f2cfb25dee275af26ac398d1af2148d4f068ddb84105215b52bd44932d72b6469c06a1c390a35edbd1768718204
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
29B
MD55c2579116c93e93aa51120f9e5c7832f
SHA18716bb82b326d4c4d1d0d459591e34cebe7452bf
SHA25633a1a9c8075a826cf9af1bea7bbde3bcdc359a59104556df73004d31e6e81510
SHA512272943f8efe1e93761d5d063bf5c92a15dbc34621df19bb679daf18f0ece66ee2844385a9b95283ebbbafce9f5d5ba7012792393eb886b704f123a4d65c74360
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
4.1MB
MD51a3a5f5e74c490dd51ecee0e99443006
SHA1d428523078df559a41138ba14a1c2371ed85cfb2
SHA25609093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA51258931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7
-
Filesize
4.1MB
MD51a3a5f5e74c490dd51ecee0e99443006
SHA1d428523078df559a41138ba14a1c2371ed85cfb2
SHA25609093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA51258931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.5MB
MD5f2e9b5c7de59ec84d6c066336030be1a
SHA190248d5428a8bf497a1557e1bd39c4e30d251b7f
SHA2561e1ae9fdf6c9ee34d42fb2e65790bbbf4d4ef1cc9a474925f77991d323f91896
SHA51248550543c7f4a4739fd70cb8da8882cfbadeea885853f174552655fca9554deab3db4480a8a021cd3ae5e6f7872ba9fcddd396c3feccdbfcc511d83074dc43ff
-
Filesize
1.8MB
MD51a200526e310fc51317804a0781ff47f
SHA12f586b57dad7f40cdb822acff9ba081671716235
SHA256cd80744e9965b3cc76acd0ea5062a2eca70a69f8a93a0eeea5bd4c47f53a5d96
SHA512ad38c5eab8d8e642f3d19e7a2926e5dbfbb63a67c73a27b3bd31cbc27de10d3f1731ce650333b75222fb371de07849aa3d65a8c787e9408b0b628ff6d8b839ad
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
3.9MB
MD500d9268a9d3afca847690635acccfee1
SHA1b4d2249a60a0ddfc4da75396a43b61c028509da8
SHA256eeaaae1af00f3ea508729324c617fe4e07333f29edb7405adfda9aacff4bf3c8
SHA5120b3e56f89fc9d87c3c28485b5023310e37c4d0bd46ba742d2b30d8595be087aae9d470a4c65512b6935e5b506576e6374ee37974363b161da2fffdc9def19096
-
Filesize
4.1MB
MD51a3a5f5e74c490dd51ecee0e99443006
SHA1d428523078df559a41138ba14a1c2371ed85cfb2
SHA25609093128167ba929e88b21458c2b019d62ea427d2c953431ed18bd36eeb58afa
SHA51258931690810de79f2c2a02561393ac00354a24345751d874cb3c59a28b4a839268655ce5200177a45d4a9d5eeb0095bbded9c259d86337e06dd880ec2f3b36e7