Analysis
-
max time kernel
200s -
max time network
210s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-04-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe
Resource
win7-20220414-en
General
-
Target
1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe
-
Size
4.5MB
-
MD5
fd21e5aae8d898331b46b428986ad774
-
SHA1
4a8f9681e6ad126b9b0860af71021b65ea7e3e17
-
SHA256
1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c
-
SHA512
1a5405ff6fbecf4debe3556e1271c0a6b4e097c0f92d63b9bd6bbfc22ecb675ad7a1dd90590a46c43afae309cb33b5b6c2d2d43b4a1788de23941170ab17d371
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Program Files (x86)\System\vp8encoder.dll acprotect C:\Program Files (x86)\System\vp8decoder.dll acprotect -
Processes:
resource yara_rule C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 \Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 \Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 \Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 C:\Program Files (x86)\System\rutserv.exe aspack_v212_v242 \Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 C:\Program Files (x86)\System\rfusclient.exe aspack_v212_v242 -
Executes dropped EXE 7 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 1924 rutserv.exe 1916 rutserv.exe 832 rutserv.exe 964 rutserv.exe 1624 rfusclient.exe 568 rfusclient.exe 808 rfusclient.exe -
Processes:
resource yara_rule C:\Program Files (x86)\System\vp8encoder.dll upx C:\Program Files (x86)\System\vp8decoder.dll upx -
Loads dropped DLL 4 IoCs
Processes:
cmd.exerutserv.exepid process 1216 cmd.exe 1216 cmd.exe 1216 cmd.exe 964 rutserv.exe -
Drops file in Program Files directory 28 IoCs
Processes:
attrib.exe1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exeattrib.exedescription ioc process File opened for modification C:\Program Files (x86)\System\vp8decoder.dll attrib.exe File opened for modification C:\Program Files (x86)\System 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\Common Files\System attrib.exe File created C:\Program Files (x86)\System\vp8encoder.dll 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\rfusclient.exe attrib.exe File created C:\Program Files (x86)\System\rutserv.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\rutserv.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\regedit.reg attrib.exe File created C:\Program Files (x86)\System\rfusclient.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\install.vbs attrib.exe File opened for modification C:\Program Files (x86)\System\mailsend.exe attrib.exe File opened for modification C:\Program Files (x86)\System\rutserv.exe attrib.exe File created C:\Program Files (x86)\System\install.vbs 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\install.bat attrib.exe File opened for modification C:\Program Files (x86)\System\mailsend.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\vp8decoder.dll 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\vp8encoder.dll 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\rfusclient.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File created C:\Program Files (x86)\System\regedit.reg 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\regedit.reg 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File created C:\Program Files (x86)\System\mailsend.exe 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\install.vbs 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File created C:\Program Files (x86)\System\vp8decoder.dll 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System attrib.exe File opened for modification C:\Program Files (x86)\System\install.bat 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File opened for modification C:\Program Files (x86)\System\vp8encoder.dll attrib.exe File created C:\Program Files (x86)\System\__tmp_rar_sfx_access_check_7123879 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe File created C:\Program Files (x86)\System\install.bat 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 612 timeout.exe 1452 timeout.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1892 taskkill.exe 932 taskkill.exe 436 taskkill.exe 1140 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 1188 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1924 rutserv.exe 1916 rutserv.exe 1916 rutserv.exe 832 rutserv.exe 832 rutserv.exe 964 rutserv.exe 964 rutserv.exe 964 rutserv.exe 964 rutserv.exe 1624 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 808 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 1892 taskkill.exe Token: SeDebugPrivilege 932 taskkill.exe Token: SeDebugPrivilege 436 taskkill.exe Token: SeDebugPrivilege 1140 taskkill.exe Token: SeDebugPrivilege 1924 rutserv.exe Token: SeDebugPrivilege 832 rutserv.exe Token: SeTakeOwnershipPrivilege 964 rutserv.exe Token: SeTcbPrivilege 964 rutserv.exe Token: SeTcbPrivilege 964 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 1924 rutserv.exe 1916 rutserv.exe 832 rutserv.exe 964 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exeWScript.execmd.exedescription pid process target process PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1852 wrote to memory of 1360 1852 1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe WScript.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1360 wrote to memory of 1216 1360 WScript.exe cmd.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 2032 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1796 1216 cmd.exe attrib.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1892 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 932 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 436 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1140 1216 cmd.exe taskkill.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1036 1216 cmd.exe reg.exe PID 1216 wrote to memory of 1188 1216 cmd.exe regedit.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2032 attrib.exe 1796 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe"C:\Users\Admin\AppData\Local\Temp\1d2e684a62e870e6b0c6794d539502870b9314edd99ce777fde4ded6e103097c.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\System\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\System\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System" +H +S /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Program Files (x86)\System\*.*" +H +S /S /D4⤵
- Drops file in Program Files directory
- Views/modifies file attributes
PID:1796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1892
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im rutserv.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im rfusclient.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵PID:1036
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"4⤵
- Runs .reg file with regedit
PID:1188
-
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
PID:1452
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Program Files (x86)\System\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Windows\SysWOW64\sc.exesc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/10004⤵PID:1388
-
-
C:\Windows\SysWOW64\sc.exesc config RManService obj= LocalSystem type= interact type= own4⤵PID:1516
-
-
C:\Windows\SysWOW64\sc.exesc config RManService DisplayName= "Windows_Defender v6.3"4⤵PID:1924
-
-
C:\Windows\SysWOW64\timeout.exetimeout 1204⤵
- Delays execution with timeout.exe
PID:612
-
-
-
-
C:\Program Files (x86)\System\rutserv.exe"C:\Program Files (x86)\System\rutserv.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:964 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:808
-
-
-
C:\Program Files (x86)\System\rfusclient.exe"C:\Program Files (x86)\System\rfusclient.exe" /tray2⤵
- Executes dropped EXE
PID:568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59f46308a60d92aef5131243f7c1ecdf8
SHA1d26868c6c80d3dad7cb1f3891fa7a8ef2cf9700b
SHA256e6dd5d940dccce5e843c6addabf5bd28b533c2f286e555ac274c022cc5e55a54
SHA512f685e12f067838e913a94615f5742832ae9527e4aaf785188dfbf13f8c53ceceba5179187fc09e98909399f315b32414b52f81b3c6b9a0854ac070cf1ce82fd8
-
Filesize
120B
MD5c719a030434d3fa96d62868f27e904a6
SHA1f2f750a752dd1fda8915a47b082af7cf2d3e3655
SHA2562696ee4302a85c6b4101fc6d1ce8e38b94fd9c2bbd1acc73b553576b3aacb92f
SHA51247a9367f7596d19c0636766cd34ca3701d3b1239a284f2333fd04a48422f53b0df21002fd38a4f229f6a2f9f9e8163267e13ecb24d9ce6de1863d5f59ab04ff0
-
Filesize
1.2MB
MD5ac23b87f8ec60ddd3f555556f89a6af8
SHA13cea6f84757d15ee8d7fa19d3dfc4992c50aa90c
SHA25680a1d0a15066c7af67cf5377e59e450c2a96018505236f8f3352173282b27ae4
SHA51257e67eab9c2a3b94161500eb0091533a539454e9bfddd47c61477299de9455b7ca11c498c5d8a7d77f4763a2053acb4ff96868a9313fede29969edc16d35b167
-
Filesize
12KB
MD5251212852a073e6fc5fbe3af92f66adb
SHA16ee07cb20f57830325c11867e68fea49ae0e87ea
SHA256f2c83f4cc13b0cd28090dd128ec5ff221681118f6100eddaead88526070ceecb
SHA512f3853ece99edc6d39edbf1c7bca471e71aa034684a85358b033e50418ffa061f1e8724cba76065048901c20c9f9a6dbd86a17ee33756c0452d4d3358047296be
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
Filesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
Filesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
Filesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0