Analysis
-
max time kernel
14s -
max time network
293s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
15/01/2024, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
Resource
win10-20231220-en
General
-
Target
bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
-
Size
817KB
-
MD5
14a5973627a876bdbafb029a26084f64
-
SHA1
5514e9a9d8806406ff9921c9be25bd1e314b0b9b
-
SHA256
bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5
-
SHA512
e6cefb5181f6bfef6c17afc961e5d8186115ce01e06160a4c08b88933f314f9e64010c04936e2511af543e49218fc4186bc59239e5d4254b10b3d517ca644808
-
SSDEEP
12288:zesZm5MEXDLUudx8Qp5+C6+gNfGtQaUkyUExxald2R6I6RR1nPK6AuVW:E5MOeQp5NgNfTkyUExxalYQNjZP0uVW
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdpo
-
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw
Signatures
-
Detect Vidar Stealer 9 IoCs
resource yara_rule behavioral2/memory/1428-47-0x00000000005F0000-0x000000000063B000-memory.dmp family_vidar_v6 behavioral2/memory/64-51-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/64-52-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/64-48-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/64-66-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/5052-76-0x0000000000B80000-0x0000000000C80000-memory.dmp family_vidar_v6 behavioral2/memory/1592-99-0x0000000000B20000-0x0000000000C20000-memory.dmp family_vidar_v6 behavioral2/memory/4172-124-0x0000000000B70000-0x0000000000C70000-memory.dmp family_vidar_v6 behavioral2/memory/3472-150-0x0000000000930000-0x0000000000A30000-memory.dmp family_vidar_v6 -
Detected Djvu ransomware 18 IoCs
resource yara_rule behavioral2/memory/216-3-0x0000000002680000-0x000000000279B000-memory.dmp family_djvu behavioral2/memory/520-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/520-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/520-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/520-2-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/520-17-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-23-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-24-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-21-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-29-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-36-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-37-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1428-46-0x0000000000690000-0x0000000000790000-memory.dmp family_djvu behavioral2/memory/1900-53-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1900-63-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1924-67-0x0000000002420000-0x00000000024BC000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4084 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1775739321-368907234-981748298-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\50a55700-73a8-4958-b97e-431298acd57a\\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe\" --AutoStart" bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.2ip.ua 3 api.2ip.ua 10 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 216 set thread context of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 1924 set thread context of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1960 64 WerFault.exe 79 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1984 schtasks.exe 3628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 216 wrote to memory of 520 216 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 74 PID 520 wrote to memory of 4084 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 75 PID 520 wrote to memory of 4084 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 75 PID 520 wrote to memory of 4084 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 75 PID 520 wrote to memory of 1924 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 77 PID 520 wrote to memory of 1924 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 77 PID 520 wrote to memory of 1924 520 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 77 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78 PID 1924 wrote to memory of 1900 1924 bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\50a55700-73a8-4958-b97e-431298acd57a" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe"C:\Users\Admin\AppData\Local\Temp\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:1900
-
C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"5⤵PID:1428
-
-
C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"5⤵PID:5052
-
C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build3.exe"6⤵PID:384
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"C:\Users\Admin\AppData\Local\a112e782-9e7b-46ed-aaa1-2cbaa287fef2\build2.exe"1⤵PID:64
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 19122⤵
- Program crash
PID:1960
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
PID:1984
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:1592
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:4436
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
PID:3628
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:4172
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:4084
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:3472
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:4780
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:4292
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:3836
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:3028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5b7470a9aa569b259d4c2bb3b80ae3aa3
SHA1093290296b7f1e402ef96e4b33a88f064aa401eb
SHA256ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6
SHA5124da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5b53c8c6885abed41527cb077397f49c8
SHA16632c25865d784c107038f7963d720c92640a767
SHA2561883c062dbf55ca4b52b71622efb8127acd9d56a2b5db1c7888ed5737f2345f8
SHA512035232100350f76b2f9241037248ab6696e45fbbbb18856ca04b8282129ec492ab345b419247d9e65c0d96528b0d92ba91d60f658fcc8921c44cf1b8c4473c2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5bfe924ae20700a8dba37bdd0677ea45c
SHA10fa2d210bdb511100054c5315c12c2f43cf334f1
SHA256074688d41f4e9fb7f2c480f6fc2b9cea49a739c9870b0494902983bbc653f358
SHA512a6b02c4ca493e068c3c2874fce05effc0d648503c08648cf742d22649d9a623259bb119affa757395ed10257fcca19ba3ffa3a5b94dd8d809c33562bceaf730d
-
C:\Users\Admin\AppData\Local\50a55700-73a8-4958-b97e-431298acd57a\bd2b3bc973155b2f6b0866245d933619550d127f292cb912e9cea106fb8392a5.exe
Filesize88KB
MD594f84927d4e355c5b599a2a972635903
SHA14943750c862ed4d6dd2ab799ec4662684b6adea4
SHA2567ceb08abf45d7784d9bd9915d212381af9b0ead357c4f96382b63335497f1dfc
SHA512e91709be7222cb053609189407c0e328b3056630d08ad9cd08f3e8dc87dcbb649506bc32f0315a0895a4d686164ab832eb199614ec620672fd5ad54adc735cbb
-
Filesize
46KB
MD5566f8ba884fedc599037867b5fed567e
SHA159927264e8d4316a6133727381aa8de1afe618ce
SHA256482fd2f6a2f0d7126e1cbd51c139891f3b9fd1bad52a10e6cc7e58327b3de4d6
SHA512beca9510603ea1804d9211d79e3d7139f50b7db4927bd13b6debfb4b78345b383c0efe38ab49dcd31484fd8f9c4427d24d987d8d7685e92f2247b67e80a2df43
-
Filesize
33KB
MD5c0161fb5fa5b00daf54656649c61a548
SHA1c368e2e929423fcb406bded2ba2a01aaa0485b30
SHA256dc8118a7ae2a604d138651c4abb65c908bfd8878ad554bf57aa14d3539547674
SHA5121cc3235012514a6f6a5646e0a9d07b1bcb2dc123ec7b6a2e8e406799c14380bb3126b5f3589c78ad2b2ef1e6d5774c721b5d4b491764577587efaf8491bbacf5
-
Filesize
46KB
MD5dd347e4a9eed3f1a684c19b9b0dfe98d
SHA1eb1385312bf570229e612e0d905b51743ba7442e
SHA25662b9e22ca2ca9c4ee7e9dcdea5bd25209ff189c16a3673e6e0d11a431b820028
SHA512a99b59f754bda2ea3bfcc639210aa73f169325be03524305ede04f3c1fa8a140e9405546e86d633992f50df5c2f9a8bce6ed589ed7c415e99652c5f25df29ddc
-
Filesize
49KB
MD57655a8ab6ad65f8b0c06e7d6ef573694
SHA19c8b88729fe4cda48a7801839f6dc008ead4e50e
SHA2561a5f238fbb82d782f9022af75c69d02d0a6b02a20e96c45b417d19380b56fcb9
SHA512fc12524fb4ea6e241e6b902f9f8387336a8c8c27f8fff10493fe0bc1ecbb86ecc21b646319fc423e9a4a578b167b2a5d9cf7b21c1c821a3d7b2e16789c536809
-
Filesize
49KB
MD5b9ff3f154c8d97ad58641b02d7e1c750
SHA16f5a0ae803618bc9dc5b052db093b5376a166435
SHA25628c1869ee2522018be4e6f32f81deb8312b25196724bc8548ccbaefaf139ef9a
SHA5124397ef4e178423ab55409f7aa668c9d63d5e10432457aa4ace1dc90a09313be3bbac55b6c888667a1242dd918b0fb53b2ccc3edbf6b873cc945ffd254ee9747b
-
Filesize
29KB
MD513bef8579f96b08d065dc71343b9332c
SHA18cc44aee8fe03a996fb4ec171be00a70775912d0
SHA25633087e53fd814c39a30e5b9d55e158a75191f45bf7883c0e25bbd5cc9f6c9af3
SHA512988d63570f84242966a2c7f0fb7bc71d43201fe4f5308fc8ed2e5be2363a5b6dfe233447b4ce537f640aabc3293224e462461dc6f69b859c0ce1455c2aaf0fdb
-
Filesize
49KB
MD5ffa1fceb3d7fafa3757d48a64fa93f5f
SHA13d85f27c84ba62fc3c6195bb7762a177daa0e6e3
SHA25653b469ba0d446e1ccb9aa596b5a98935cd22d0c37b5d8e9ea39c1bbe948fe2ae
SHA512c447d7db3d70f3acb7a99d57d355466f29d55b23412737fdbd1020b5ba9512fd4c7f3b8d3a783ec1c38cc4e5153a47e46728355fde81e3a2360a3a3d03dcc9ba
-
Filesize
12KB
MD5e240a6468baf4a67a503853cbed40581
SHA180a64abc42c63b3c9657eb37a4202759423ec2b7
SHA256a4c0bf4b878ee9797b65b0eba70d9c901a23929565dd8cda0c3b5d658f19a891
SHA512f1a0a711babcd43c724dc684a10e50f9d3c6358e9b05341fab11487daa6828cac46eb40a781c199ee660254734f8ab24ba3f737368d3cb450aa69ade836a174f
-
Filesize
57KB
MD574ae9689cb04bde426e036319feeb49b
SHA1b932fd3571f6113cacf1e5eb2b3453a05887963c
SHA256b59f5c8dc70d0092f4257c3e13745f67e6324edeee709eff32336d3c93bca180
SHA512642d69ab7ef11418b9d97cfa8882ba38ba5c08fcec428a8a758b9de8ee1d576b4d1fe1a2ca93dc4f1f5e6a8eba8c21f7309975c0c43033350d51e5efe7fcafca
-
Filesize
98KB
MD595b079f9b83988b2253843dede4b3b19
SHA113104dd654365715d64cf2ca083c5fa4c6458f3e
SHA256df0e29c690158bf6943ef9fac22b10be7a3b590eaee291ea4fcc67d59c8501ca
SHA512587ba3171d80122efc86b418582e922a61131ee55d015feb58661e560f9bb24fa7ef6eba5053f88aaddaeb21c05e15e420774db430b9850fa55b743acdb7afb0
-
Filesize
37KB
MD5e36cf7b8863ed683e3bb596d28d9582a
SHA1769283b659f5581b8d8cd5c1ddcf80bdfdede5fb
SHA25636d0ed0156e857587423d0b364dd7aa6ffc33db524466c02a3dc30242aad4c0d
SHA5126e759fc12a3c75c33aaee2eccb6bf58cd5e7084e208b1eb5d5000c41df43dc6581e4e2638073cd41604c69a445de9aaa3f66b4e6dd8856ed05b673b09e339373
-
Filesize
64KB
MD58b6a819c6926597dfa7529b692d7a6cc
SHA150c535e9cca464afd3a589d2231d87ce417d4312
SHA256b9cb5501cc2d257e049e1757062523c7f9ee5a85d57d46538fe492125befd26c
SHA512dfd28b270d99ad89f8ce1df9750b92ff558f73fe2448bf182b5c1c05c7b180bb29175eeaf5a7c918791d64b36167fc1a6044f1aaff838e02e878782f5f6c0ba9
-
Filesize
26KB
MD53bb3d56a18eec9b79c287cf1e1b41f1c
SHA1d37dcf4f1349e3f8ab13b1d859b0533066fbffe9
SHA256574b4e621aea47f875c1edb98fbfc71d4d302bb568137fbb12a304df0b782c9f
SHA512a07dede517a571da1f1925cd9ae63fa38b5e5c0dd20458b47198ecf3d1bd862c74a5eef17e3a5192819a796faf7a8b84b59a60837ccbc51dd748b453d8fe2d8c
-
Filesize
16KB
MD55169d2a060a54d0bbbd3027fc19a4417
SHA12342990e51952aabf570794ababcf643507e4f4d
SHA2567167395afd26254c61eb9fe58564f01409b402108ffb17564508064e09cc29ff
SHA512c70d02ce8b59807e1da70d95deec3af679ed05f4a7171771bb1fb767a1812ebcbdf2afd2ce72c7f685f33248ea7f1b55f5cbcccdd4743685df2a97edf88f6489
-
Filesize
45KB
MD55c2b090f6e218209c9c7f4fa935265d5
SHA14a8d96c4f25b9912306d3ef178f9b62ca6018286
SHA2563264a8f122706de1bfb1001716d7fc3388f1f083832d25aa5c8fc6ca83d3eada
SHA5121dbd88ce19403aeb8dc0973e2bf08627d49e7dec715cea196135366e1c3979add3c9545b975149cf25d99b89606d81f5d26e0f23368202ac431eb7fc35e86e82
-
Filesize
92KB
MD54b3fc3105731c7ff3a7e3966416912a2
SHA10e792bf25e8795158074fa6bd2ee87ad16675124
SHA256c0f698bcc4324958848de5d8e1b1bdaed5e01632d8c827a5a95356eb04a2c443
SHA5126ed5ee0139d9d9a676232a6c5d6e9a8528f880025a11fccf8a1a32a999ae5fac41f993c384fabec788e4e47da714d67f1def0348da6b0f4392e7fc7ff1098c28