Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 22:41
Static task
static1
Behavioral task
behavioral1
Sample
IMG91021606.pif.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
IMG91021606.pif.exe
Resource
win10v2004-20220812-en
General
-
Target
IMG91021606.pif.exe
-
Size
2.0MB
-
MD5
7c150864ebcad18d185a492b6a9163b0
-
SHA1
449dc047b26d23874afe311261101cbb754cf2d7
-
SHA256
de0a8ea18835d2511b6f4345d62743bd7374ab294b9067fbed819e37cb1642c1
-
SHA512
2d14dd91b6eebd2000af0ed6d89cf2313fe93141a2edff978ddf5676f2320389381e3309567894be5bbc8230be2a59e1d7cf3ea387863addcb6857513b29dcc1
-
SSDEEP
49152:4ov0SawgSwDYo5Me034nJRxi0fT7SEfxmhnlyIgdDG6D:4oLUS7jcNvx4n8S6D
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
gst.exegtfwiwxp.exeakfng.exepid process 320 gst.exe 1888 gtfwiwxp.exe 1144 akfng.exe -
Drops startup file 3 IoCs
Processes:
gtfwiwxp.exeakfng.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk gtfwiwxp.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk gtfwiwxp.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk akfng.exe -
Loads dropped DLL 5 IoCs
Processes:
IMG91021606.pif.exeWScript.exeWScript.exepid process 1388 IMG91021606.pif.exe 1388 IMG91021606.pif.exe 1388 IMG91021606.pif.exe 1684 WScript.exe 828 WScript.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
gtfwiwxp.exeakfng.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\9_75 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_75\\start.vbs" gtfwiwxp.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce akfng.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\9_105 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\start.vbs" akfng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run gtfwiwxp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_75\\gtfwiwxp.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\9_75\\llrtku.jsg" gtfwiwxp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run akfng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\akfng.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\whofhgk.sos" akfng.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce gtfwiwxp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
IMG91021606.pif.exegst.exeWScript.exeWScript.exegtfwiwxp.exeakfng.exedescription pid process target process PID 1388 wrote to memory of 320 1388 IMG91021606.pif.exe gst.exe PID 1388 wrote to memory of 320 1388 IMG91021606.pif.exe gst.exe PID 1388 wrote to memory of 320 1388 IMG91021606.pif.exe gst.exe PID 1388 wrote to memory of 320 1388 IMG91021606.pif.exe gst.exe PID 1388 wrote to memory of 1684 1388 IMG91021606.pif.exe WScript.exe PID 1388 wrote to memory of 1684 1388 IMG91021606.pif.exe WScript.exe PID 1388 wrote to memory of 1684 1388 IMG91021606.pif.exe WScript.exe PID 1388 wrote to memory of 1684 1388 IMG91021606.pif.exe WScript.exe PID 320 wrote to memory of 828 320 gst.exe WScript.exe PID 320 wrote to memory of 828 320 gst.exe WScript.exe PID 320 wrote to memory of 828 320 gst.exe WScript.exe PID 320 wrote to memory of 828 320 gst.exe WScript.exe PID 1684 wrote to memory of 1888 1684 WScript.exe gtfwiwxp.exe PID 1684 wrote to memory of 1888 1684 WScript.exe gtfwiwxp.exe PID 1684 wrote to memory of 1888 1684 WScript.exe gtfwiwxp.exe PID 1684 wrote to memory of 1888 1684 WScript.exe gtfwiwxp.exe PID 828 wrote to memory of 1144 828 WScript.exe akfng.exe PID 828 wrote to memory of 1144 828 WScript.exe akfng.exe PID 828 wrote to memory of 1144 828 WScript.exe akfng.exe PID 828 wrote to memory of 1144 828 WScript.exe akfng.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1888 wrote to memory of 1140 1888 gtfwiwxp.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe PID 1144 wrote to memory of 1720 1144 akfng.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG91021606.pif.exe"C:\Users\Admin\AppData\Local\Temp\IMG91021606.pif.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\temp\9_75\gst.exe"C:\Users\Admin\AppData\Local\temp\9_75\gst.exe" Community portal – Bulletin board,2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe"C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe" whofhgk.sos4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵PID:1720
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_75\trcwwcfpq.vbe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe"C:\Users\Admin\AppData\Local\Temp\9_75\gtfwiwxp.exe" llrtku.jsg3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:1140
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
915KB
MD5303c86d5e26a663bdb09481f93be2e90
SHA1b269a394afcf82a26150a8e16daa933176c1d3b2
SHA2561f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f
SHA5127c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955
-
Filesize
915KB
MD5303c86d5e26a663bdb09481f93be2e90
SHA1b269a394afcf82a26150a8e16daa933176c1d3b2
SHA2561f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f
SHA5127c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955
-
Filesize
59KB
MD5aa511ad88b62774609eccded56fe6921
SHA1bc7995786dd2f464ca72e472588d0d2f8441cba5
SHA256e1411732032805d54c5c51af508764272d144bb559ca7e45dff1e036049c741d
SHA5127ec89454e2b09cb0d1dc2cfb8e97e9ca3c27ff552e206d5069ad117c961f607644e2512ff7eb76d78c3ee429c4a044f32c44931e710ba8f600ce36e2b516e960
-
Filesize
79.3MB
MD5111689a0b6b4f08522b7b577692c1001
SHA15e88d66c4e5d21676ed9f7117669efbda2e71778
SHA25692a969067cee6fa37cbe337baaebf53a2a1912975f09be78ef90384eeda6deda
SHA512f11d8d57295ddb7ae812abfb77cbea08227b1d4751e3d93a9e6c6af7e8d130a2621fc8b30a1bcd0a1a3c41220f89289c10591ab8a7a42b6e29657d377678fcf6
-
Filesize
405KB
MD581db3971acf8ec7739e75f8861885f89
SHA12f2b8a2302c29e72a28697afa6b7728819469c8e
SHA2564ce2fd6069f41e43443cc1666a24ebc9e02833b70ba407b6c343cd1c1a3acc3a
SHA512b237c9d227d69a8d3f42428040e6e162f7868a932272ef48ac92616281bb2ec8f28bc071e248de6b9ce4d762f5f673eef2c362cafac4badc54fc8e08e1abef13
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
917KB
MD5294044b55415687eb93af43bbeea21b5
SHA1f4e0a4775badd9e031cfb20bdf26be18236f709e
SHA256b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c
SHA512c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685
-
Filesize
917KB
MD5294044b55415687eb93af43bbeea21b5
SHA1f4e0a4775badd9e031cfb20bdf26be18236f709e
SHA256b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c
SHA512c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685
-
Filesize
436KB
MD504e718c34ae801f1bbed8599abf8dc80
SHA1fa4971bfd18bb7a35cc0c33b5e7acac79e3b453b
SHA2568297cad91c6bff0eb9fd14c337bdfcea06d6046f2bee1d390c13156cc454031c
SHA51283ce11fc3638025526146eb6e5d42ae7c4efeef7d660b8097d60701420fef346af1c9de7c1e1590e62c0ca2a3d18c57d4bdf49fc24fad2dbcdc8cf97da6655ad
-
Filesize
54KB
MD54d474bfb885fecce59ea66541622677c
SHA147aecd8f7aa2b6875fb8f40710c4920cdf6a7e7a
SHA256aeedd4965cbc15e60ca47bf7d0996bcd02860f75cf0608f0e37846abe736030b
SHA5123b8682437cc4332ca6c6c1183a6f6b0b91366086f5183be72450ec5c13563c25eca4326bacbc2bc0ee965cc2ab57f9df535de77d6d0ffd6a5ce776dd80f57fad
-
Filesize
81.2MB
MD51e2c4aed80160b63b0bf9039916fa59b
SHA1ad2391de4660ede0a7729002fd228f563e527f25
SHA2564f3b571fc9769efe5d49933e996fb1219b47f15b6b2ed897aa54ce6c4e0fd3f0
SHA51208e1d62402c7d23a9b88412b7e3b5ee8d9e41f3fb2e82cc60b0bfcc7c1df9f28fa259aac9de7ac81df324ba2afc1df00e96dc8649a927f0e8e09536e19248bfd
-
Filesize
32KB
MD5dbeb963635b0737ceca13c7f9bc566d7
SHA110b6334645131d81b311c71eca7a8f9ccde127d1
SHA25601299ecd0169896c320e2690a782a45a7e8f2d94cbc221dbe153ceb694febbe6
SHA512b48d909051ecbb73ab47c89fcfee3cbdb9a08c5a246e3e0ec4780e64e402e01d16ff2f2fa3025bc11f2efaaf28b47496aa83f1957db8d131e9ea8e7a20bef3d9
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
24KB
MD5362072d9c51ef2c35ee2b7cf24e79c50
SHA12f58231bafa0e38d14ad2fd85e963907ebee8c2f
SHA25692c885c8032dc63bb0e5e6db7d541d81a8ff451e0e7bba38ce6c04126e04c9ae
SHA5129efd9347e5ca1fc5465d7ac2d6c219ec19b43849ff7e95e98ddaa6aad1407d36493b762f0af4791cf2939f763b5bd5341183ad5a91161741fc19bee8498006dd
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
Filesize
1001B
MD50ead27b89568f8627efe3fdc49245aa8
SHA13e800e77b3e159c9c681dcd9b2c7b89c7da38b89
SHA256b8976adb79a99f6b5fc9e4029c2fed527ef814d1a49ad099793d4b65d3672958
SHA512808d792388522c90474dac416ba10a43a1012f3b21bcd1d81ed39354bc01147287c0fb7c65d18304678e83ba4e73d829b30707fcbdb96248c47f493f7362ac1d
-
Filesize
1006B
MD562573194f71e06972819b88a824a590c
SHA1c4b10c251e4b571932cc2517e7f14afab5751ce3
SHA256184e252b3e2fa190109898121cef3ae109b51e5ce6e4d9a80ca91e48245a2670
SHA5121450f4eebb9b6a547dc4d959e91bfd9c9eb9a5fcdf7704cbf7a96706ddef3c085ee19cede6fabcbfde3dbd51cffaa7a7a38b2d393c4aec31aa38c345ce60b980
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
915KB
MD5303c86d5e26a663bdb09481f93be2e90
SHA1b269a394afcf82a26150a8e16daa933176c1d3b2
SHA2561f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f
SHA5127c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
917KB
MD5294044b55415687eb93af43bbeea21b5
SHA1f4e0a4775badd9e031cfb20bdf26be18236f709e
SHA256b39c57ca4d501bdcb98b4e410e8f8d8fd7054fc96353db168e70d2a5ce77ba0c
SHA512c7e787a65c6adf2c719836ca0b7866c4d99811cf22de014e6fe7b7229c111f46cae3585babe578d4916850237154941bb969b2e41ed1f505f58170a18a89b685