Analysis
-
max time kernel
21s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
15/01/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
Resource
win10-20231220-en
General
-
Target
ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
-
Size
794KB
-
MD5
b39217e76b21bf17052cd2abd00aef34
-
SHA1
31cf90601333cc6b46bf0a6b4cdd62cbdabf9067
-
SHA256
ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2
-
SHA512
bfc5d6b0ca0f841e8900bae346ab0f8e101f1bd5422c56704de70505e90c8f228d2a8ea5eff982a0fb55f4bd315cf71cffae021137a16f7446ad2bbed98e73d8
-
SSDEEP
12288:pRaF0bZkvLCji7MzHKLub30T+QlDKxhcQQHipHXBxvy7r:pRaF2Z3ji72HNbEaQxicLHAlEr
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdpo
-
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw
Signatures
-
Detect Vidar Stealer 5 IoCs
resource yara_rule behavioral2/memory/3260-46-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/4512-49-0x00000000005B0000-0x00000000005FB000-memory.dmp family_vidar_v6 behavioral2/memory/3260-52-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/3260-51-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 behavioral2/memory/3260-66-0x0000000000400000-0x000000000065E000-memory.dmp family_vidar_v6 -
Detected Djvu ransomware 16 IoCs
resource yara_rule behavioral2/memory/4460-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4460-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4460-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4460-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3288-2-0x0000000002240000-0x000000000235B000-memory.dmp family_djvu behavioral2/memory/4460-17-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-24-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-23-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-29-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-36-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-37-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-54-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3108-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1296 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3934047325-4097474570-3437169968-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\81d357ab-cfdc-4212-8f82-4a1b4456f6e4\\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe\" --AutoStart" ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.2ip.ua 4 api.2ip.ua 13 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3288 set thread context of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3924 set thread context of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3448 3260 WerFault.exe 79 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4152 schtasks.exe 2188 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 3288 wrote to memory of 4460 3288 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 74 PID 4460 wrote to memory of 1296 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 75 PID 4460 wrote to memory of 1296 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 75 PID 4460 wrote to memory of 1296 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 75 PID 4460 wrote to memory of 3924 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 77 PID 4460 wrote to memory of 3924 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 77 PID 4460 wrote to memory of 3924 4460 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 77 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78 PID 3924 wrote to memory of 3108 3924 ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\81d357ab-cfdc-4212-8f82-4a1b4456f6e4" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:1296
-
-
C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe"C:\Users\Admin\AppData\Local\Temp\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:3108
-
C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"5⤵PID:4512
-
-
C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"5⤵PID:3592
-
C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build3.exe"6⤵PID:3328
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
PID:4152
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"C:\Users\Admin\AppData\Local\b70c4e1a-8c56-403d-a98a-44b5e9d09e70\build2.exe"1⤵PID:3260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 18962⤵
- Program crash
PID:3448
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:4124
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:2836
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
PID:2188
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:3180
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:2504
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:748
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:3796
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵PID:4228
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:4484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5b7470a9aa569b259d4c2bb3b80ae3aa3
SHA1093290296b7f1e402ef96e4b33a88f064aa401eb
SHA256ee8aeed77dd9f1631fa75845214d75bfe04951a61892410ee369035e13fd14c6
SHA5124da3fc09260692f159c37b068664852931b712c8173de5e4b294799ac33ecf179055aaeb016fd0afad88cbfc50a571c4c88033dca56a573431af7462ea7979be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD58f338ad47439d6349242b9657e571cc5
SHA1a0689579db1fef7704ba627c8a590a0f1f9d661c
SHA2568725b41a81db65a6f38c4c9282300e3a541123594710d4940b15a90d8e2e11b1
SHA51292e0648109d2c810930c678b58a77990082697c9db6acf5d296e7ef779bba748b1e8893f7ca32b494070570cd0670de9a4524981d1b91076c0857b2c08b3f0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5d3af9b175cc3f8660bfcdd19c712cdad
SHA1c9ca56f1a94a13c4d1cc3126163af9e6f2f3a076
SHA256cb566e8eb2007006130b213b6711338cb43aa1ffa3c8143a0cb9e72f0c938b17
SHA512af82db0cc51c5eff897441c166313c6cd8871c843d6e99cedde3d79aa87a27c63145ebf43e519324b78f0b1f4ede2c722c8b11b341cfec35c8572f9e7729ae04
-
C:\Users\Admin\AppData\Local\81d357ab-cfdc-4212-8f82-4a1b4456f6e4\ad491e18f0871e13524e696647c31d4784b0d1286955aeb4ee54a378042ab3a2.exe
Filesize18KB
MD52dece59d47456dcebc1b2a838d6a0016
SHA1fff2c2791c8ea2691eb74707cfc1284df2115a03
SHA25643bbb2eb226c4630f1e31771c9679b3e44ea9303abcf486d616f49610e7b8454
SHA512928ea5089f6bdfc6d2574c6e6d15db0aaac3c6075bd958cb2474e307b2bdedae4e1f413a664eb0bf4562780e5efddca30adad53b23b1e38c4586b6403d95ab5b
-
Filesize
51KB
MD528b9e1c1b007c047b29aedbbb1ebfff3
SHA161da7928d700065a97e9f633dd95ee1d4ffbc82c
SHA2567d15d1e9286b8c4a1ca5617e175653e683aecefe18caa9825b63ec820a5e467c
SHA5124ed25a90b6d7d4e8d40c558ad996446151a1557ee3df90c1c4c9373f7f4904e3f37aa3dc8a721e5cdd64cb70d24ea684d27b342d39f8d7a48d39b135c56fa4b0
-
Filesize
23KB
MD52e6c8168f3ec29356a8b18525ff08afc
SHA1f81bee7e73f78eb6c574ce2255863df6f6b7d688
SHA2569bb525624d28204af1f8813d411c66493fabc5f4bc5c9a0884c0acd9ac4a71de
SHA5127e51885fe43bb0e3de31651c726ba32fe1a3787438f7ab92baed6e2f392d5c73d5bc2febf04a4147b9ecb3aff10cb69fb8ecdea64557a366cd9917c9cc0a6b46
-
Filesize
16KB
MD5c021b3be5c367bff4ca8b10cf151a15f
SHA1583be865b92b60987828fafd78f9f5b5e740922b
SHA2563c795d49379653e1b73db741ee512991ce5089c98bf191c874e9d320b804f36e
SHA51214a3353acc2d32dbe67cfc012f0cc400a4f4a22a570ebb7c9fa654948df9bf74a4ca19dd807d16526b7115ae0ed288574c199fc454520be20e2f33cdc4dd2846
-
Filesize
13KB
MD50f83fc771cbbfef7f95cb68ef1d8b7b3
SHA16f64ca26b670c3286cb109c39c049bffc202eaf3
SHA256b4b252a675da42915cde3e95e1b0f65041d01f2c976ef9fe217baca5ccfc8e3f
SHA512507b3823329167fb40e76c7c0c4f1469de44f63ee0c7eb6ddf5b3c5275230cf914cad69128e8ebd1efc9e6c30d8be4957de70bec43c75f94ee7b462120dd5618
-
Filesize
8KB
MD5bcef56ee6402e0e79076fcb99f4b67ef
SHA126154ec5a86682c1225da1694cee50cbfd6a4749
SHA256229756c13490504d00dfb1513b2c3b65d821efeeed598fc158bb63a261901ff7
SHA5123e66ca457d9798d0d47efcf32e8eb2cb8fe620cfac97571840be377385e484811f9feef45a5d6386be5cb04009022053d820cf85a6e532d2fc69ce40e6c8dcd2
-
Filesize
139KB
MD5da7ba82e40c496e48e12b502087286ba
SHA1c260140281e75f5d3e57077581ce91c97548738b
SHA256657f831f8f69b8adf7b8c9971a08f2f628e5ea84c2c83a2091f4eea1ef87556e
SHA512bacef7a362e066215a6848b5ae2bdc8954d67a59950f47f30855490558fa0f4258d2c9f2ac5dd448a64230d43f9f90d78fdbc684e25f853e3bcffcbed4f74903
-
Filesize
25KB
MD5718368af88a90b1467b5b28748461bde
SHA16057131857069ac4daf41e79af69ee388de86d91
SHA25609262122f3a54a6f4833722a0bb2fd46d70cbca7f0b390458e3efbb1f71dedea
SHA512c5952de7a6e264d7260bd1959d82ae2b6c8548e8bc91418eee64af9741868c4cef7eda54974cd123a82c72dce9c1b9776458e793037f2d60002a44c40f18040e
-
Filesize
15KB
MD54dd1984009b5b727ff260df88a694294
SHA1512b062c425cf935f076e33fddc8545da773eea5
SHA256b4a4f5008e3d37301e7d70ee2339ce62c61e0fa37047c3e4857e3ecf10a2d67c
SHA5126d541949369698d86168685ed6c8997388f18fd7e82213c9ac47643ad79da71b67138407a420dd924d7c3622dc56d89d68b0cc715a2ef76adff9b13cf3c07e93
-
Filesize
48KB
MD502d15f85aa142d0aa649bf142b370a35
SHA1d4981695443ec99304c6ee4676eb14808038a4ff
SHA2568f5ab238564845961c6646e8b84e07efddb86ecc611be8d00a776f3bf0a37e14
SHA512a10d43113d41d9a7e01d14629be18d91fe0849fca81082c94ba6dcad884c5a69b6897f9ab4a987768f186d6eba092ee7634193c2bc4ce2e1734d4dbee11e9bda
-
Filesize
85KB
MD5a5837628454c64dea0992dfc2cf195ee
SHA1a4fca069a1f8e71c90479531e5f78ece0fc891b0
SHA256c3af6a8344eb098ad1861121454083231d6e53a462eb4c233f4ac7f0575f12e5
SHA51287a5514e5965aa799ee87c3f24077651c2d58f4c31725ff60c296c102a89ddd50ac2fd1bbb73ad62694d89053343a2b13ba46b7b0b02cb9a0e737adce9189115
-
Filesize
55KB
MD57dec4e41e8e020c2dfbc0f848e7aacb7
SHA172857096b202b1096af43c9463488f855479345e
SHA25642fe0d1ff80578ac6b4bd0c4f727b9226287d842db1180a25247f717eef3c32d
SHA51298ac424d5c31dfc9d193ac8b5fab82351add800f3204b0bebbec3c48f0cdfebf18ec15962f78992af5c9945daa3f101f045790491b3e9b165190e5fd0069a3ce
-
Filesize
270KB
MD5c7b702dede28ca9a1e8e557c086ba6e7
SHA1388091a793128cbd7514e521804a28e583b3bcbb
SHA25676719684366b0d68a57b9002f4d4006b2176a2043e6f77a145dbd2d094036ffb
SHA512632fb2192b1a2d21fc82b09e9950006f2b1e1196f4b76b6aed86cdb36a540b9f0777510bda9aa6f4847db1fc64dd7aad549b1298037a92038ebcef75836f871c
-
Filesize
49KB
MD5283f17ca750ff66f240dfe0de9b768c9
SHA1052ae6113aeb38e6cb6c6133bcecc9d695b7458a
SHA256ef7eaad3412f9ad12002f61a2916d1a3fc4505ee3fab7b170cde7232a80625ae
SHA51225ce28aab4f0dd2806a10c7ef66a404b75ee557a507ec3b27bd76dc5cb1166620c67be2c3a83add54958bc845cf95973be4a70e7d3a11a99008847edbe5ae623
-
Filesize
43KB
MD5a94e7615f4c24668378a5e97d9b6b8fe
SHA1b32da33cdf349c677e81c6b3d1b6777610d17568
SHA256f7b7ad907f11c46a4566ad2977d4fa32c1520ddd2b3dec237462add55be83839
SHA51290ec35f717769ca98a023ef35cccd773d87556ead9a5b091360d39c315591cd3395b6017bc61220f605dca97704e97cef693318ea9e3e5443517d099fbef56fb
-
Filesize
1KB
MD5d35c806c95b926208b06f305860de044
SHA1fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b
SHA256722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061
SHA512cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6