Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 03:37
Static task
static1
Behavioral task
behavioral1
Sample
81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe
Resource
win7-20220414-en
General
-
Target
81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe
-
Size
5.3MB
-
MD5
1dcb867334b4730911d6eb729bce78bf
-
SHA1
5912be93c7427a40634b8fb9895459092e039662
-
SHA256
81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db
-
SHA512
f7e7707d9164861a67d0b5b54ada0e4b6876bc516e002dbba4bd7110465e2f6a3a1652d2c6493fa1b59fdc4f758229f170dddc4cf5ee10ae86b68032f583c893
Malware Config
Signatures
-
Executes dropped EXE 14 IoCs
Processes:
WinDevInstall.exestart1.exestart.exeBuilder.exeBuilder2.exeWinUpdate.exeWinUpdate1.exeCDevice.exeCDevice.exeCDevice.exeCDevice.exesysdevices.exesysdevices.exesysdevices.exepid process 4072 WinDevInstall.exe 2676 start1.exe 2680 start.exe 1032 Builder.exe 3272 Builder2.exe 4344 WinUpdate.exe 3448 WinUpdate1.exe 3172 CDevice.exe 4496 CDevice.exe 3836 CDevice.exe 3848 CDevice.exe 4532 sysdevices.exe 3132 sysdevices.exe 372 sysdevices.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exeWinDevInstall.exestart1.exestart.exeWinUpdate.exeWinUpdate1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation WinDevInstall.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation start1.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation start.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation WinUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation WinUpdate1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 3120 taskkill.exe 4768 taskkill.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 4000 regedit.exe 4384 regedit.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
CDevice.exeCDevice.exeCDevice.exeCDevice.exesysdevices.exepid process 3172 CDevice.exe 3172 CDevice.exe 3172 CDevice.exe 3172 CDevice.exe 3172 CDevice.exe 3172 CDevice.exe 4496 CDevice.exe 4496 CDevice.exe 3836 CDevice.exe 3836 CDevice.exe 3848 CDevice.exe 3848 CDevice.exe 3848 CDevice.exe 3848 CDevice.exe 3848 CDevice.exe 3848 CDevice.exe 3132 sysdevices.exe 3132 sysdevices.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
sysdevices.exepid process 372 sysdevices.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskkill.exetaskkill.exeCDevice.exeCDevice.exeCDevice.exedescription pid process Token: SeDebugPrivilege 3120 taskkill.exe Token: SeDebugPrivilege 4768 taskkill.exe Token: SeDebugPrivilege 3172 CDevice.exe Token: SeDebugPrivilege 3836 CDevice.exe Token: SeTakeOwnershipPrivilege 3848 CDevice.exe Token: SeTcbPrivilege 3848 CDevice.exe Token: SeTcbPrivilege 3848 CDevice.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
start1.exestart.exeBuilder.exeBuilder2.exeWinUpdate.exeWinUpdate1.execmd.exeCDevice.exeCDevice.exeCDevice.exeCDevice.exepid process 2676 start1.exe 2680 start.exe 1032 Builder.exe 3272 Builder2.exe 4344 WinUpdate.exe 3448 WinUpdate1.exe 4724 cmd.exe 3172 CDevice.exe 3172 CDevice.exe 4496 CDevice.exe 4496 CDevice.exe 3836 CDevice.exe 3836 CDevice.exe 3848 CDevice.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exeWinDevInstall.exestart1.exestart.exeWinUpdate.exeWinUpdate1.execmd.exedescription pid process target process PID 3124 wrote to memory of 4072 3124 81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe WinDevInstall.exe PID 3124 wrote to memory of 4072 3124 81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe WinDevInstall.exe PID 3124 wrote to memory of 4072 3124 81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe WinDevInstall.exe PID 4072 wrote to memory of 2676 4072 WinDevInstall.exe start1.exe PID 4072 wrote to memory of 2676 4072 WinDevInstall.exe start1.exe PID 4072 wrote to memory of 2676 4072 WinDevInstall.exe start1.exe PID 2676 wrote to memory of 2680 2676 start1.exe start.exe PID 2676 wrote to memory of 2680 2676 start1.exe start.exe PID 2676 wrote to memory of 2680 2676 start1.exe start.exe PID 2680 wrote to memory of 1032 2680 start.exe Builder.exe PID 2680 wrote to memory of 1032 2680 start.exe Builder.exe PID 2680 wrote to memory of 1032 2680 start.exe Builder.exe PID 2680 wrote to memory of 3272 2680 start.exe Builder2.exe PID 2680 wrote to memory of 3272 2680 start.exe Builder2.exe PID 2680 wrote to memory of 3272 2680 start.exe Builder2.exe PID 2680 wrote to memory of 4344 2680 start.exe WinUpdate.exe PID 2680 wrote to memory of 4344 2680 start.exe WinUpdate.exe PID 2680 wrote to memory of 4344 2680 start.exe WinUpdate.exe PID 4344 wrote to memory of 3448 4344 WinUpdate.exe WinUpdate1.exe PID 4344 wrote to memory of 3448 4344 WinUpdate.exe WinUpdate1.exe PID 4344 wrote to memory of 3448 4344 WinUpdate.exe WinUpdate1.exe PID 3448 wrote to memory of 4724 3448 WinUpdate1.exe cmd.exe PID 3448 wrote to memory of 4724 3448 WinUpdate1.exe cmd.exe PID 3448 wrote to memory of 4724 3448 WinUpdate1.exe cmd.exe PID 4724 wrote to memory of 5096 4724 cmd.exe attrib.exe PID 4724 wrote to memory of 5096 4724 cmd.exe attrib.exe PID 4724 wrote to memory of 5096 4724 cmd.exe attrib.exe PID 4724 wrote to memory of 2376 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2376 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2376 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2116 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2116 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2116 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2224 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2224 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2224 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1708 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1708 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1708 4724 cmd.exe sc.exe PID 4724 wrote to memory of 3328 4724 cmd.exe sc.exe PID 4724 wrote to memory of 3328 4724 cmd.exe sc.exe PID 4724 wrote to memory of 3328 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2412 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2412 4724 cmd.exe sc.exe PID 4724 wrote to memory of 2412 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4272 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4272 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4272 4724 cmd.exe sc.exe PID 4724 wrote to memory of 816 4724 cmd.exe sc.exe PID 4724 wrote to memory of 816 4724 cmd.exe sc.exe PID 4724 wrote to memory of 816 4724 cmd.exe sc.exe PID 4724 wrote to memory of 748 4724 cmd.exe sc.exe PID 4724 wrote to memory of 748 4724 cmd.exe sc.exe PID 4724 wrote to memory of 748 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4784 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4784 4724 cmd.exe sc.exe PID 4724 wrote to memory of 4784 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1828 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1828 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1828 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1144 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1144 4724 cmd.exe sc.exe PID 4724 wrote to memory of 1144 4724 cmd.exe sc.exe PID 4724 wrote to memory of 3120 4724 cmd.exe taskkill.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 5096 attrib.exe 3656 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe"C:\Users\Admin\AppData\Local\Temp\81b4c8939929fd7098ebbbed373e56da265398a1f42e9da1dfcc239f1e8f77db.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\ProgramData\CardWindows\WinDevInstall.exe"C:\ProgramData\CardWindows\WinDevInstall.exe" -p78324893543785892356435434562⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\ProgramData\CardWindows\start1.exe"C:\ProgramData\CardWindows\start1.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\ProgramData\CardWindows\start.exe"C:\ProgramData\CardWindows\start.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\ProgramData\CardWindows\Builder.exe"C:\ProgramData\CardWindows\Builder.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1032
-
-
C:\ProgramData\CardWindows\Builder2.exe"C:\ProgramData\CardWindows\Builder2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3272
-
-
C:\ProgramData\CardWindows\WinUpdate.exe"C:\ProgramData\CardWindows\WinUpdate.exe" -p53876876453786745245123453897212285⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\ProgramData\CardWindows\WinUpdate1.exe"C:\ProgramData\CardWindows\WinUpdate1.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\CardWindows\SysInstall.bat" "7⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\ProgramData\CardWindows"8⤵
- Views/modifies file attributes
PID:5096
-
-
C:\Windows\SysWOW64\sc.exesc delete NPackStereo8⤵PID:748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im rfusclient.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\SysWOW64\sc.exesc delete AMIHardware8⤵PID:1144
-
-
C:\Windows\SysWOW64\sc.exesc delete IntelDriver8⤵PID:1828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im rutserv.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
C:\Windows\SysWOW64\sc.exesc delete ServiceWork8⤵PID:4784
-
-
C:\Windows\SysWOW64\sc.exesc delete VDeviceCard8⤵PID:816
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\ProgramData\CardWindows\config_set.reg"8⤵
- Runs .reg file with regedit
PID:4000
-
-
C:\ProgramData\CardWindows\CDevice.exe"C:\ProgramData\CardWindows\CDevice.exe" /silentinstall8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3172
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Nvidia\Toolbar\DeviceCard" /f8⤵PID:3200
-
-
C:\Windows\SysWOW64\sc.exesc delete RManService8⤵PID:4272
-
-
C:\Windows\SysWOW64\sc.exesc stop AMIHardware8⤵PID:2412
-
-
C:\ProgramData\CardWindows\CDevice.exe"C:\ProgramData\CardWindows\CDevice.exe" /firewall8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
C:\Windows\SysWOW64\sc.exesc stop IntelDriver8⤵PID:3328
-
-
C:\Windows\SysWOW64\sc.exesc stop ServiceWork8⤵PID:1708
-
-
C:\Windows\SysWOW64\sc.exesc stop NPackStereo8⤵PID:2224
-
-
C:\Windows\SysWOW64\sc.exesc stop VDeviceCard8⤵PID:2116
-
-
C:\Windows\SysWOW64\sc.exesc stop RManService8⤵PID:2376
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\ProgramData\CardWindows\config_set.reg"8⤵
- Runs .reg file with regedit
PID:4384
-
-
C:\Windows\SysWOW64\sc.exesc failure VDeviceCard reset= 0 actions= restart/500/restart/500/restart/5008⤵PID:3776
-
-
C:\ProgramData\CardWindows\CDevice.exe"C:\ProgramData\CardWindows\CDevice.exe" /start8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3836
-
-
C:\Windows\SysWOW64\sc.exesc config VDeviceCard obj= LocalSystem type= interact type= own8⤵PID:1932
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\ProgramData\CardWindows\*.*"8⤵
- Views/modifies file attributes
PID:3656
-
-
-
-
-
-
-
-
C:\ProgramData\CardWindows\CDevice.exeC:\ProgramData\CardWindows\CDevice.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3848 -
C:\ProgramData\CardWindows\sysdevices.exeC:\ProgramData\CardWindows\sysdevices.exe /tray2⤵
- Executes dropped EXE
PID:4532
-
-
C:\ProgramData\CardWindows\sysdevices.exeC:\ProgramData\CardWindows\sysdevices.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3132 -
C:\ProgramData\CardWindows\sysdevices.exeC:\ProgramData\CardWindows\sysdevices.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:372
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
997KB
MD52f92eed4e2061af0961f379e9ded70d6
SHA18b58dcd428759d3633a14bcfc62a8cb6deb66de5
SHA25652cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
SHA512909561ad25f5a4af7360004a6b259bdb70dfad4ced7fe0f39a72ed61f421bc943dce9c7215634ed12284811f36d9a5bae8d1f439412a94bbbd4c24cb4f4962ac
-
Filesize
997KB
MD52f92eed4e2061af0961f379e9ded70d6
SHA18b58dcd428759d3633a14bcfc62a8cb6deb66de5
SHA25652cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
SHA512909561ad25f5a4af7360004a6b259bdb70dfad4ced7fe0f39a72ed61f421bc943dce9c7215634ed12284811f36d9a5bae8d1f439412a94bbbd4c24cb4f4962ac
-
Filesize
368KB
MD55bc1cdb63ab6345843d7254ee51eb3cd
SHA154b5ec6185bbb3d33c17fd24c6143cf9372168b2
SHA2565e0c07ccca39ab7e0d5a59d7f71b79a6c786a9ef65e3c53f1934016bf490d2ae
SHA5126768769a22e4075eb3c2bbe8784e3eea79f0d2b709f43627742adc9b6610ed0f3d4f7327e6d10f898f68e7bf808c540c76ae2098b803ff784a829066151b980d
-
Filesize
368KB
MD55bc1cdb63ab6345843d7254ee51eb3cd
SHA154b5ec6185bbb3d33c17fd24c6143cf9372168b2
SHA2565e0c07ccca39ab7e0d5a59d7f71b79a6c786a9ef65e3c53f1934016bf490d2ae
SHA5126768769a22e4075eb3c2bbe8784e3eea79f0d2b709f43627742adc9b6610ed0f3d4f7327e6d10f898f68e7bf808c540c76ae2098b803ff784a829066151b980d
-
Filesize
6.0MB
MD560478b65ab22e759c71f1923edb1bbab
SHA14268fc2bf9ff27ec280416b12bb0de96e9ae718d
SHA256047274a242de93573a5f83fb152554a68dfa12ac877f5f9919dec5e62b70ada0
SHA5122921917b17de2ef41e10619d86a5a4a34fe9da8d05870135781342a7c6b171827e868f351d9961fa4844bb37a29ab2278d6d38ce231022f820a7310e97669580
-
Filesize
6.0MB
MD560478b65ab22e759c71f1923edb1bbab
SHA14268fc2bf9ff27ec280416b12bb0de96e9ae718d
SHA256047274a242de93573a5f83fb152554a68dfa12ac877f5f9919dec5e62b70ada0
SHA5122921917b17de2ef41e10619d86a5a4a34fe9da8d05870135781342a7c6b171827e868f351d9961fa4844bb37a29ab2278d6d38ce231022f820a7310e97669580
-
Filesize
6.0MB
MD560478b65ab22e759c71f1923edb1bbab
SHA14268fc2bf9ff27ec280416b12bb0de96e9ae718d
SHA256047274a242de93573a5f83fb152554a68dfa12ac877f5f9919dec5e62b70ada0
SHA5122921917b17de2ef41e10619d86a5a4a34fe9da8d05870135781342a7c6b171827e868f351d9961fa4844bb37a29ab2278d6d38ce231022f820a7310e97669580
-
Filesize
6.0MB
MD560478b65ab22e759c71f1923edb1bbab
SHA14268fc2bf9ff27ec280416b12bb0de96e9ae718d
SHA256047274a242de93573a5f83fb152554a68dfa12ac877f5f9919dec5e62b70ada0
SHA5122921917b17de2ef41e10619d86a5a4a34fe9da8d05870135781342a7c6b171827e868f351d9961fa4844bb37a29ab2278d6d38ce231022f820a7310e97669580
-
Filesize
6.0MB
MD560478b65ab22e759c71f1923edb1bbab
SHA14268fc2bf9ff27ec280416b12bb0de96e9ae718d
SHA256047274a242de93573a5f83fb152554a68dfa12ac877f5f9919dec5e62b70ada0
SHA5122921917b17de2ef41e10619d86a5a4a34fe9da8d05870135781342a7c6b171827e868f351d9961fa4844bb37a29ab2278d6d38ce231022f820a7310e97669580
-
Filesize
48KB
MD5e44e34bc285b709f08f967325d9c8be1
SHA1e73f05c6a980ec9d006930c5343955f89579b409
SHA2561d99a7b5f7b3daa61fa773972b1e335aa09b92411484f6ddc99d2b2894455a5b
SHA512576b292b6e9cf022822443e050994462a6cbd9a3c60063bae9f54c78a84e75e17bb5eddf7e259a22a9d93f757cb6536c503762e2a30e75091e40c2756cde8727
-
Filesize
1KB
MD5a00d1b7d978dcd3728e14c3f0e2386df
SHA1596deee85bd6521c9d3fb7ffe3654aa0b386e9ed
SHA25600baf3f49d72d9ae56cd5dbfbcd0a3a87b88ae3e768cbfe8a77769fd443a1cd5
SHA512fe8a3752ba3bfddeb979f0a3cb8787218525057b873481f24169c6629851f862059ceb1cc52ed03f6b1bea87866833a107226b6a1a5ab969b959de0d56987c80
-
Filesize
269B
MD5ad964d1f40f1ab48e26d9ff0bdc01d06
SHA1073396d19000036396005d9ebf89f40fb481e1e5
SHA256632b75ab4857c964f8cf1f61efeff7a1bc7583fca3e9fbef9bca768ee227b9ff
SHA512f671e8bcb42f757d5384c8be7bde6abe18a1196834948ded0634152c4ef0608c972be417082035b7640178d26810fe8dc25b128c1e18d1d343e1b9f9c475d255
-
Filesize
647B
MD52db0f5ade581516ccd80880197a007ff
SHA19dd8379da351d1c8361169d0548a25ad13c14973
SHA2569b0e0a3cd2e3694bfa85335d8ec3b59a6e92bd37592604a65e32b310b61458d3
SHA5128fffa0271c81cfd37194e2b405c2b35e949b08eec08e93be5b49d268d9ec4b58aaa9c5038b316589c5ac6444fb969b37a17c71ed8b1665dc3ca56f30b857c103
-
Filesize
4.8MB
MD5b5c5f94914900ea67536aabfeb7b43d4
SHA1c528252e3419dafbe43699455d16f4f73143e0ad
SHA256accb85af56237053f2a159a7b52f22379609e10033a51e7d69cf106ce3df5962
SHA512541cc5a660199def0c7f69d717ceef36d94b9b640eca7f1516deb0beb67c576a80c2c8227266ed5c3ff774b1e947dbe4ab77fafd5736e6deef79392405e77b6f
-
Filesize
4.8MB
MD5b5c5f94914900ea67536aabfeb7b43d4
SHA1c528252e3419dafbe43699455d16f4f73143e0ad
SHA256accb85af56237053f2a159a7b52f22379609e10033a51e7d69cf106ce3df5962
SHA512541cc5a660199def0c7f69d717ceef36d94b9b640eca7f1516deb0beb67c576a80c2c8227266ed5c3ff774b1e947dbe4ab77fafd5736e6deef79392405e77b6f
-
Filesize
4.3MB
MD5436658cb9c13960ecdb332ec02cc1388
SHA133c6b18a1a0ef78fbc9496893dd32bbce7fd47ff
SHA256ba83d27a14161c57f58bed535843fc3cd64b39853e787b01e73517360e9923a7
SHA512231b82bb53ef894b1907a0c644dc9ec7a6267783193310f97200be37beb1805462fa834bc7e46b7e3c03e149602169373549c6e937744e9fdd9e56a34e731ab4
-
Filesize
4.3MB
MD5436658cb9c13960ecdb332ec02cc1388
SHA133c6b18a1a0ef78fbc9496893dd32bbce7fd47ff
SHA256ba83d27a14161c57f58bed535843fc3cd64b39853e787b01e73517360e9923a7
SHA512231b82bb53ef894b1907a0c644dc9ec7a6267783193310f97200be37beb1805462fa834bc7e46b7e3c03e149602169373549c6e937744e9fdd9e56a34e731ab4
-
Filesize
379KB
MD5a36f89d64e0de0fe14ba911713df29eb
SHA17d700fa255f32aa37b82dc59826cf35300b250d4
SHA256d1deecb8f672e32316a71444f1500be8381f64741445f138704876274e131a1c
SHA51255ac398815ce5e00e18a839f0d12984488e6ee4e1eb69396a6bc01e12a86bc3256308f164cd52d5b6c733c77cb18f008a03921c831c62fd0d4d0a7b7184a6e57
-
Filesize
379KB
MD5a36f89d64e0de0fe14ba911713df29eb
SHA17d700fa255f32aa37b82dc59826cf35300b250d4
SHA256d1deecb8f672e32316a71444f1500be8381f64741445f138704876274e131a1c
SHA51255ac398815ce5e00e18a839f0d12984488e6ee4e1eb69396a6bc01e12a86bc3256308f164cd52d5b6c733c77cb18f008a03921c831c62fd0d4d0a7b7184a6e57
-
Filesize
11KB
MD5864e25c17d596e0baf577189a9cf0295
SHA194e915da3e683faf54945b86939d2bfb2abd70c5
SHA25679ab503fa5c9a7e128f50c07e0dd1e1c078a0034d01956267f0040edae0295a5
SHA512d37489135043adf202be19df80c36c7429e7e00e9f39ec580063cc949390192b1ca494a7bee7b8aef4b0a2d205ea143b4c31ac9a6c9e1fe76d055bf8ddb84da5
-
Filesize
394KB
MD5483f4c651d50fa46af3cd4b0abb8a480
SHA11ccdb6d6b274b66cfe2ccfc3458bd9e0cd47151a
SHA256dd8a5dbd5fa017c4c77966617ca23bf6c1eca9131d8c56a09a3599f4617da24f
SHA5127ccb9c432c897c2ec589f73a895b77e89d5e87e9b7dbe718eec64e35c3adafe016b9a58c50b03b8f2519ee6eb77ba4c4513a32f2dcce5e09cab1def0c1930ee0
-
Filesize
394KB
MD5483f4c651d50fa46af3cd4b0abb8a480
SHA11ccdb6d6b274b66cfe2ccfc3458bd9e0cd47151a
SHA256dd8a5dbd5fa017c4c77966617ca23bf6c1eca9131d8c56a09a3599f4617da24f
SHA5127ccb9c432c897c2ec589f73a895b77e89d5e87e9b7dbe718eec64e35c3adafe016b9a58c50b03b8f2519ee6eb77ba4c4513a32f2dcce5e09cab1def0c1930ee0
-
Filesize
394KB
MD58c83dc3eb8124dd9cdaa95a0a1ad45d4
SHA19428c90a79281d5dc84205e435833f0c75f4ae3c
SHA25635c5a75bce725f0132ebd59c5c8f090df3f0fb70e8f0f83cad8f9983a58a887b
SHA512f2a1856ad6189fd189d64922e80201957f19601f05783a1b5543bb62f4e2921074a3dc522bf4b4307ea1ac2f1e2e18de9384d86a721073a332d75ac309c82d5d
-
Filesize
394KB
MD58c83dc3eb8124dd9cdaa95a0a1ad45d4
SHA19428c90a79281d5dc84205e435833f0c75f4ae3c
SHA25635c5a75bce725f0132ebd59c5c8f090df3f0fb70e8f0f83cad8f9983a58a887b
SHA512f2a1856ad6189fd189d64922e80201957f19601f05783a1b5543bb62f4e2921074a3dc522bf4b4307ea1ac2f1e2e18de9384d86a721073a332d75ac309c82d5d
-
Filesize
5.1MB
MD5271dc5107c866fd480b1256f0ce0e36c
SHA10d9c7e060b57a8177664233ad99049963b3fd83b
SHA256dfa101c21fba688512ef911988e1d72199c1ec5c3571f91da214faa0fac7cba4
SHA512fb23837f2c69c5f0a938ff3f44a8158321394117c9466a0fa6865fd85914f51970f4afe0873e440e4ad6d502d839cb57c07b502905641dceebeae5eb61143784
-
Filesize
5.1MB
MD5271dc5107c866fd480b1256f0ce0e36c
SHA10d9c7e060b57a8177664233ad99049963b3fd83b
SHA256dfa101c21fba688512ef911988e1d72199c1ec5c3571f91da214faa0fac7cba4
SHA512fb23837f2c69c5f0a938ff3f44a8158321394117c9466a0fa6865fd85914f51970f4afe0873e440e4ad6d502d839cb57c07b502905641dceebeae5eb61143784
-
Filesize
5.1MB
MD5271dc5107c866fd480b1256f0ce0e36c
SHA10d9c7e060b57a8177664233ad99049963b3fd83b
SHA256dfa101c21fba688512ef911988e1d72199c1ec5c3571f91da214faa0fac7cba4
SHA512fb23837f2c69c5f0a938ff3f44a8158321394117c9466a0fa6865fd85914f51970f4afe0873e440e4ad6d502d839cb57c07b502905641dceebeae5eb61143784
-
Filesize
5.1MB
MD5271dc5107c866fd480b1256f0ce0e36c
SHA10d9c7e060b57a8177664233ad99049963b3fd83b
SHA256dfa101c21fba688512ef911988e1d72199c1ec5c3571f91da214faa0fac7cba4
SHA512fb23837f2c69c5f0a938ff3f44a8158321394117c9466a0fa6865fd85914f51970f4afe0873e440e4ad6d502d839cb57c07b502905641dceebeae5eb61143784
-
Filesize
378KB
MD5d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
Filesize
1.6MB
MD5dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7