Analysis
-
max time kernel
148s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 14:21
Static task
static1
Behavioral task
behavioral1
Sample
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe
Resource
win7-20220414-en
General
-
Target
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe
-
Size
5.0MB
-
MD5
1bb13a8dc3f7047507644e2554a3ed1c
-
SHA1
01f11194e7c1bd6895213da9d3424b31994cb016
-
SHA256
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
-
SHA512
57bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe1rfusclient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System64\\1rfusclient.exe, explorer.exe" 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe" 1rfusclient.exe -
Executes dropped EXE 8 IoCs
Processes:
1rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 1904 1rfusclient.exe 784 rutserv.exe 1168 rutserv.exe 844 rutserv.exe 1936 rutserv.exe 1888 rfusclient.exe 1132 rfusclient.exe 1624 rfusclient.exe -
Processes:
resource yara_rule C:\Windows\System64\rfusclient.exe upx \Windows\System64\rutserv.exe upx C:\Windows\System64\rutserv.exe upx C:\Windows\System64\rutserv.exe upx C:\Windows\System64\rutserv.exe upx C:\Windows\System64\rutserv.exe upx C:\Windows\System64\rutserv.exe upx \Windows\System64\rfusclient.exe upx \Windows\System64\rfusclient.exe upx C:\Windows\System64\rfusclient.exe upx C:\Windows\System64\rfusclient.exe upx C:\Windows\System64\rfusclient.exe upx -
Loads dropped DLL 6 IoCs
Processes:
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe1rfusclient.execmd.exerutserv.exepid process 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1904 1rfusclient.exe 1976 cmd.exe 1936 rutserv.exe 1936 rutserv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1rfusclient.exe7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run 1rfusclient.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe -
Drops file in Windows directory 21 IoCs
Processes:
1rfusclient.exeattrib.exe7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exerutserv.exeattrib.exedescription ioc process File created C:\Windows\System64\rutserv.exe 1rfusclient.exe File created C:\Windows\System64\vp8decoder.dll 1rfusclient.exe File opened for modification C:\Windows\System64\1rfusclient.exe attrib.exe File opened for modification C:\Windows\System64\vp8decoder.dll attrib.exe File opened for modification C:\Windows\System64\1rfusclient.exe 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe File created C:\Windows\Zont911\Regedit.reg 1rfusclient.exe File created C:\Windows\Zont911\hostbb.zip 1rfusclient.exe File created C:\Windows\System64\rfusclient.exe 1rfusclient.exe File opened for modification C:\Windows\System64\Logs\rms_log_2022-04.html rutserv.exe File created C:\Windows\Zont911\Tupe.bat 1rfusclient.exe File created C:\Windows\System64\Logs\rms_log_2022-04.html rutserv.exe File opened for modification C:\Windows\System64 attrib.exe File opened for modification C:\Windows\System64\rfusclient.exe 1rfusclient.exe File opened for modification C:\Windows\System64\rutserv.exe attrib.exe File opened for modification C:\Windows\System64\vp8encoder.dll attrib.exe File opened for modification C:\Windows\System64\vp8encoder.dll 1rfusclient.exe File opened for modification C:\Windows\System64\rfusclient.exe attrib.exe File created C:\Windows\System64\1rfusclient.exe 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe File opened for modification C:\Windows\System64\rutserv.exe 1rfusclient.exe File opened for modification C:\Windows\System64\vp8decoder.dll 1rfusclient.exe File created C:\Windows\System64\vp8encoder.dll 1rfusclient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2008 regedit.exe -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe1rfusclient.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 1904 1rfusclient.exe 784 rutserv.exe 784 rutserv.exe 784 rutserv.exe 784 rutserv.exe 1168 rutserv.exe 1168 rutserv.exe 844 rutserv.exe 844 rutserv.exe 1936 rutserv.exe 1936 rutserv.exe 1936 rutserv.exe 1936 rutserv.exe 1888 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 1624 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 784 rutserv.exe Token: SeDebugPrivilege 844 rutserv.exe Token: SeTakeOwnershipPrivilege 1936 rutserv.exe Token: SeTcbPrivilege 1936 rutserv.exe Token: SeTcbPrivilege 1936 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 784 rutserv.exe 1168 rutserv.exe 844 rutserv.exe 1936 rutserv.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe1rfusclient.execmd.exerutserv.exerfusclient.exedescription pid process target process PID 1700 wrote to memory of 1904 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1rfusclient.exe PID 1700 wrote to memory of 1904 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1rfusclient.exe PID 1700 wrote to memory of 1904 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1rfusclient.exe PID 1700 wrote to memory of 1904 1700 7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe 1rfusclient.exe PID 1904 wrote to memory of 2008 1904 1rfusclient.exe regedit.exe PID 1904 wrote to memory of 2008 1904 1rfusclient.exe regedit.exe PID 1904 wrote to memory of 2008 1904 1rfusclient.exe regedit.exe PID 1904 wrote to memory of 2008 1904 1rfusclient.exe regedit.exe PID 1904 wrote to memory of 1976 1904 1rfusclient.exe cmd.exe PID 1904 wrote to memory of 1976 1904 1rfusclient.exe cmd.exe PID 1904 wrote to memory of 1976 1904 1rfusclient.exe cmd.exe PID 1904 wrote to memory of 1976 1904 1rfusclient.exe cmd.exe PID 1976 wrote to memory of 896 1976 cmd.exe chcp.com PID 1976 wrote to memory of 896 1976 cmd.exe chcp.com PID 1976 wrote to memory of 896 1976 cmd.exe chcp.com PID 1976 wrote to memory of 896 1976 cmd.exe chcp.com PID 1976 wrote to memory of 784 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 784 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 784 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 784 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 1168 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 1168 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 1168 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 1168 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 844 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 844 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 844 1976 cmd.exe rutserv.exe PID 1976 wrote to memory of 844 1976 cmd.exe rutserv.exe PID 1936 wrote to memory of 1888 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1888 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1888 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1888 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1132 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1132 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1132 1936 rutserv.exe rfusclient.exe PID 1936 wrote to memory of 1132 1936 rutserv.exe rfusclient.exe PID 1976 wrote to memory of 1444 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1444 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1444 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1444 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1116 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1116 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1116 1976 cmd.exe attrib.exe PID 1976 wrote to memory of 1116 1976 cmd.exe attrib.exe PID 1888 wrote to memory of 1624 1888 rfusclient.exe rfusclient.exe PID 1888 wrote to memory of 1624 1888 rfusclient.exe rfusclient.exe PID 1888 wrote to memory of 1624 1888 rfusclient.exe rfusclient.exe PID 1888 wrote to memory of 1624 1888 rfusclient.exe rfusclient.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1444 attrib.exe 1116 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe"C:\Users\Admin\AppData\Local\Temp\7a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\System64\1rfusclient.exe"C:\Windows\System64\1rfusclient.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" /s "C:\Windows\Zont911\Regedit.reg"3⤵
- Runs .reg file with regedit
PID:2008
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\Zont911\Tupe.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\chcp.comChcp 12514⤵PID:896
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Windows\System64\rutserv.exe"C:\Windows\System64\rutserv.exe" /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\System64\*.*" +s +h4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\System64" +s +h4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:1116
-
-
-
-
C:\Windows\System64\rutserv.exeC:\Windows\System64\rutserv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\System64\rfusclient.exeC:\Windows\System64\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System64\rfusclient.exeC:\Windows\System64\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1624
-
-
-
C:\Windows\System64\rfusclient.exeC:\Windows\System64\rfusclient.exe /tray2⤵
- Executes dropped EXE
PID:1132
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD51bb13a8dc3f7047507644e2554a3ed1c
SHA101f11194e7c1bd6895213da9d3424b31994cb016
SHA2567a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
SHA51257bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
-
Filesize
5.0MB
MD51bb13a8dc3f7047507644e2554a3ed1c
SHA101f11194e7c1bd6895213da9d3424b31994cb016
SHA2567a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
SHA51257bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
Filesize
11KB
MD5b8b5df7bd66996fb97cf2f80f866a7b1
SHA12fca802b31d0074f5ab68a45854fa3bbdf2603db
SHA256e7878603265c8d6d0fa092a5b5ee3755380ed33216a8836d80dc49cac92366d2
SHA512af6b9409b7a902f64073d0b39163d6d71cbe11f9063b2ea7dc926c235acb9a500fe7f3776b39d442e3e8817ecd1a8b1fdac3811c4e740c4125d52c47fd4d1546
-
Filesize
357B
MD510cb21f5d07a83f4c3d66974cbc2cf79
SHA108e325ec7e92c3e3b9b7eb605ff6a8d9e4596f57
SHA25658474de64432e063c41c427119b46d8aba84c13b067b52073f9e9863a963963a
SHA512689ff96b0561bfe5a72bbc83ca190394ab7e76d1280595c8233463c92218610f25c3223ce1bd52e14073ca9bb5d28d239119427b98da70bb32063eb223374b8c
-
Filesize
5.0MB
MD51bb13a8dc3f7047507644e2554a3ed1c
SHA101f11194e7c1bd6895213da9d3424b31994cb016
SHA2567a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
SHA51257bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
-
Filesize
5.0MB
MD51bb13a8dc3f7047507644e2554a3ed1c
SHA101f11194e7c1bd6895213da9d3424b31994cb016
SHA2567a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
SHA51257bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
-
Filesize
5.0MB
MD51bb13a8dc3f7047507644e2554a3ed1c
SHA101f11194e7c1bd6895213da9d3424b31994cb016
SHA2567a333a9533b7b791e250cb6c1b8888443067abc4f7753b3fe93a233f691941d8
SHA51257bace1d7b712aa21f49bf9958ace981e909976f9d9b1e9fd75d7a20741491d1ba2c2ce505ba63e66f2861b1584833c268a795aa54dde7ba670b4284248d93ca
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.5MB
MD5eac85a4a79a168cb47c0810e23e6d2fe
SHA10e053ed568dc2f07d76b0e006a9e19655797b89e
SHA25686b9593479937ca7dfe9ef6744cc321808c0585b63312cb50952f709c498096f
SHA512b424136d58d266ba045a2ad95efeb8cdc69d77a9442521bf196390b934a7752bf728daeaf2fb3df887abf9c719a2526a8179e368cb228603b9243e3c7148c8e0
-
Filesize
1.8MB
MD5fa4b26c53cfb2661ba072cf8da181b1a
SHA1295f19aad28e80c5e371078989815c612110229c
SHA2563a92288781a1f411f43e59ae32ea78b89997e7a5d1b6f12771f39fb6fa345db7
SHA512f6399c683c41f518a1096c87303758d50d6419e62317bfe2d362f66e5048f81583be12b32348dc095a34c0de0a79867376fdb8fc4677080d665e001b38cbfa64