Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2022 09:13
Behavioral task
behavioral1
Sample
Ref671005018.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Ref671005018.xls
Resource
win10v2004-20220812-en
General
-
Target
Ref671005018.xls
-
Size
232KB
-
MD5
169f284d5cb718718ef756d97e962d66
-
SHA1
f83c9e72f5d03e30e8d99b8ac3a7ea9e3ab98960
-
SHA256
f9068e24dc32b9314c21966284886537051e1ea8b7044772489a99c4906925af
-
SHA512
fd82a9a0044be3eb01b95dd5de63b0ac57072cf67fc2959ac1180f22f7ed5375ba9178e37b2fe3c2ddabe883aadb90e85d77c19406af1c5c41861d2d4bd34c26
-
SSDEEP
6144:yk3hOdsylKlgryzc4bNhZF+E+W2knA1ADM/NuNNFNNXNNuNNdNNPNNaNNbNNWNNb:GAcNuNNFNNXNNuNNdNNPNNaNNbNNWNNb
Malware Config
Extracted
nanocore
1.2.2.0
37.139.128.94:6000
407839af-e81b-4512-9071-482887f971db
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-08-07T10:00:20.190590236Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
6000
-
default_group
client
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
407839af-e81b-4512-9071-482887f971db
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
37.139.128.94
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
svchost.exegst.exeddkvmcjj.exeakfng.exepid process 4384 svchost.exe 4936 gst.exe 1936 ddkvmcjj.exe 2796 akfng.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svchost.exegst.exeWScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation gst.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 3 IoCs
Processes:
akfng.exeddkvmcjj.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk akfng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk akfng.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk ddkvmcjj.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
ddkvmcjj.exeakfng.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ddkvmcjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_910\\ddkvmcjj.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6_910\\cjnm.edm" ddkvmcjj.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ddkvmcjj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\6_910 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6_910\\start.vbs" ddkvmcjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run akfng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\akfng.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\whofhgk.sos" akfng.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce akfng.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\9_105 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9_105\\start.vbs" akfng.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
akfng.exeddkvmcjj.exedescription pid process target process PID 2796 set thread context of 4680 2796 akfng.exe RegSvcs.exe PID 1936 set thread context of 4720 1936 ddkvmcjj.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 4 IoCs
Processes:
svchost.exeWScript.exegst.exeWScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings gst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1268 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
RegSvcs.exeRegSvcs.exepid process 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4680 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe 4720 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4680 RegSvcs.exe Token: SeDebugPrivilege 4720 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE 1268 EXCEL.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
EXCEL.EXEsvchost.exegst.exeWScript.exeWScript.exeakfng.exeddkvmcjj.exedescription pid process target process PID 1268 wrote to memory of 4384 1268 EXCEL.EXE svchost.exe PID 1268 wrote to memory of 4384 1268 EXCEL.EXE svchost.exe PID 1268 wrote to memory of 4384 1268 EXCEL.EXE svchost.exe PID 4384 wrote to memory of 4936 4384 svchost.exe gst.exe PID 4384 wrote to memory of 4936 4384 svchost.exe gst.exe PID 4384 wrote to memory of 4936 4384 svchost.exe gst.exe PID 4384 wrote to memory of 1324 4384 svchost.exe WScript.exe PID 4384 wrote to memory of 1324 4384 svchost.exe WScript.exe PID 4384 wrote to memory of 1324 4384 svchost.exe WScript.exe PID 4936 wrote to memory of 3292 4936 gst.exe WScript.exe PID 4936 wrote to memory of 3292 4936 gst.exe WScript.exe PID 4936 wrote to memory of 3292 4936 gst.exe WScript.exe PID 1324 wrote to memory of 1936 1324 WScript.exe ddkvmcjj.exe PID 1324 wrote to memory of 1936 1324 WScript.exe ddkvmcjj.exe PID 1324 wrote to memory of 1936 1324 WScript.exe ddkvmcjj.exe PID 3292 wrote to memory of 2796 3292 WScript.exe akfng.exe PID 3292 wrote to memory of 2796 3292 WScript.exe akfng.exe PID 3292 wrote to memory of 2796 3292 WScript.exe akfng.exe PID 2796 wrote to memory of 4680 2796 akfng.exe RegSvcs.exe PID 2796 wrote to memory of 4680 2796 akfng.exe RegSvcs.exe PID 2796 wrote to memory of 4680 2796 akfng.exe RegSvcs.exe PID 2796 wrote to memory of 4680 2796 akfng.exe RegSvcs.exe PID 2796 wrote to memory of 4680 2796 akfng.exe RegSvcs.exe PID 1936 wrote to memory of 4720 1936 ddkvmcjj.exe RegSvcs.exe PID 1936 wrote to memory of 4720 1936 ddkvmcjj.exe RegSvcs.exe PID 1936 wrote to memory of 4720 1936 ddkvmcjj.exe RegSvcs.exe PID 1936 wrote to memory of 4720 1936 ddkvmcjj.exe RegSvcs.exe PID 1936 wrote to memory of 4720 1936 ddkvmcjj.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Ref671005018.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\temp\6_910\gst.exe"C:\Users\Admin\AppData\Local\temp\6_910\gst.exe" Saint-Étienne-du-Mont is a church located on the Montagne Sainte-Geneviève3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe"4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe"C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe" whofhgk.sos5⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\6_910\npssxoovaq.vbe"3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe"C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe" cjnm.edm4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5783d3de8de9f375875e62b690541c6fc
SHA1bd76af531029b646f383f24095ddbb327877abde
SHA2561529dda9873dbc7882fde74f145d8aba3c63091e573968c294e6a6187fc709f2
SHA512af3875fe94118c774edc6e7de9ba3ec0368d6c1959ba3c40478751e94dc87197d0bdd2a4bb34eeebb2647df743c18419e16738647c68e25076e9a6b2fb87b8d6
-
Filesize
144.9MB
MD5cbbc308c7a75e37ed4135bfbecbdfbbc
SHA16205245d1ce6b0682aef9079aeeee096b99ccb9d
SHA25617770d3cec381de78db80be431bb5450ed477b99a1ed288ee3f6c7048f0563f5
SHA5128991da2bc43747d1079fa18162d0f5a6e87009c8161c701750ebbb9592b6b81242b75e6f412cc47d9a6edd390735bbe55a183811ffaf3322e47758eae29ffdfa
-
Filesize
911KB
MD581221edd11b5995e95e971646d9653c0
SHA1f1b09d14995f24270af8d67050b4e5a38de074f3
SHA256c809f3429bcc2c666d4b6135c720c8df30ff1ede2f76e73308b82202bd904a6f
SHA5126780988267df3368e3aec9d1a58c7a9700117b6439bf9545291417cc490ed069ef6068d682138fe870093dab6c8a389a1b5f1256e21c103eb4681b1ac236248a
-
Filesize
911KB
MD581221edd11b5995e95e971646d9653c0
SHA1f1b09d14995f24270af8d67050b4e5a38de074f3
SHA256c809f3429bcc2c666d4b6135c720c8df30ff1ede2f76e73308b82202bd904a6f
SHA5126780988267df3368e3aec9d1a58c7a9700117b6439bf9545291417cc490ed069ef6068d682138fe870093dab6c8a389a1b5f1256e21c103eb4681b1ac236248a
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
436KB
MD5dd9aaeff1f2e6f7572b0a59c68e5f0dc
SHA1e32da5f93c5c94f8b4b12ccb4069a0e8e94dd038
SHA256b3dff265c8ec050020c7213d027ca1e5aaad1d9895dafedaaf58cd98ba1e7861
SHA5125d8ae10375edce231721368e5d8a6ceef3d7475d0286aeaace11514e0f9c2c2694b2c7b637bc7712dc7ed894430081ce5370142c3eade4becca9034cfbabf6a8
-
Filesize
915KB
MD5303c86d5e26a663bdb09481f93be2e90
SHA1b269a394afcf82a26150a8e16daa933176c1d3b2
SHA2561f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f
SHA5127c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955
-
Filesize
915KB
MD5303c86d5e26a663bdb09481f93be2e90
SHA1b269a394afcf82a26150a8e16daa933176c1d3b2
SHA2561f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f
SHA5127c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955
-
Filesize
59KB
MD5aa511ad88b62774609eccded56fe6921
SHA1bc7995786dd2f464ca72e472588d0d2f8441cba5
SHA256e1411732032805d54c5c51af508764272d144bb559ca7e45dff1e036049c741d
SHA5127ec89454e2b09cb0d1dc2cfb8e97e9ca3c27ff552e206d5069ad117c961f607644e2512ff7eb76d78c3ee429c4a044f32c44931e710ba8f600ce36e2b516e960
-
Filesize
79.3MB
MD5111689a0b6b4f08522b7b577692c1001
SHA15e88d66c4e5d21676ed9f7117669efbda2e71778
SHA25692a969067cee6fa37cbe337baaebf53a2a1912975f09be78ef90384eeda6deda
SHA512f11d8d57295ddb7ae812abfb77cbea08227b1d4751e3d93a9e6c6af7e8d130a2621fc8b30a1bcd0a1a3c41220f89289c10591ab8a7a42b6e29657d377678fcf6
-
Filesize
405KB
MD581db3971acf8ec7739e75f8861885f89
SHA12f2b8a2302c29e72a28697afa6b7728819469c8e
SHA2564ce2fd6069f41e43443cc1666a24ebc9e02833b70ba407b6c343cd1c1a3acc3a
SHA512b237c9d227d69a8d3f42428040e6e162f7868a932272ef48ac92616281bb2ec8f28bc071e248de6b9ce4d762f5f673eef2c362cafac4badc54fc8e08e1abef13
-
Filesize
2.1MB
MD571bc3a380454c4bf0c29f7ce462f5a44
SHA113d0575bffee9c37a4bd83f9636b1f0cd028f975
SHA256c3b54b1b12f48682ca31c77c5783db4c235268c52fcf11f2f7a3ee0364c9f8df
SHA51203da38432163c1c5f4b063eae32933492b9f60e21f6016c0a1c5c27d46d447672002fe0b82fbb648f497c35549497c999a6f8f68dc2567d350f30bf1eb6db5aa
-
Filesize
2.1MB
MD571bc3a380454c4bf0c29f7ce462f5a44
SHA113d0575bffee9c37a4bd83f9636b1f0cd028f975
SHA256c3b54b1b12f48682ca31c77c5783db4c235268c52fcf11f2f7a3ee0364c9f8df
SHA51203da38432163c1c5f4b063eae32933492b9f60e21f6016c0a1c5c27d46d447672002fe0b82fbb648f497c35549497c999a6f8f68dc2567d350f30bf1eb6db5aa
-
Filesize
1.1MB
MD5110281413953d3f0417e6444b0004644
SHA1236630dbc2635dbcb704a78278892948ea224c5d
SHA256046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2
SHA512a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84
-
Filesize
28KB
MD5e84f87dacfb7eb1b00eeec1aaac1d4cf
SHA1b263f4462b1d3ecb6e0dfeae04ef6dadd96f608c
SHA256c91dc9fae6dbf85acddcba2c0966de01d6a48e56a779488fec5731e6fda2e242
SHA512a0449c4648f2e7356c9334fc0d7b6c201e7e646661e444d53961b6c9b847e7b53a772e06fb7be25f26019b70b78f51d67120fb2ee70ff7eee561526d2b3917c9
-
Filesize
32KB
MD5dbeb963635b0737ceca13c7f9bc566d7
SHA110b6334645131d81b311c71eca7a8f9ccde127d1
SHA25601299ecd0169896c320e2690a782a45a7e8f2d94cbc221dbe153ceb694febbe6
SHA512b48d909051ecbb73ab47c89fcfee3cbdb9a08c5a246e3e0ec4780e64e402e01d16ff2f2fa3025bc11f2efaaf28b47496aa83f1957db8d131e9ea8e7a20bef3d9
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD555f596ebfed69c8819860eaaa02049fa
SHA1a30ac1a04169ed5799f4c4239a3a61bfea1a43e8
SHA256d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110
SHA5123802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336
-
Filesize
1KB
MD589604977a3449d5d1e458518f73306d9
SHA1de73b25a11a6026afa6513f22ee34aace245a231
SHA2568a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af
SHA512dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c
-
Filesize
1KB
MD5a9885e99c860cea1bf6f924f3b96d0c1
SHA1943c83be9248834ee3877c2e647bea9fc486bc9b
SHA256cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1
SHA512f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd
-
Filesize
1KB
MD589b5e137d46fa7efbf09d1c259ac4a40
SHA17b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569
SHA256b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858
SHA512a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c