Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
02/04/2024, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
cryptedfile.exe
Resource
win7-20240221-en
General
-
Target
cryptedfile.exe
-
Size
7.5MB
-
MD5
e6af53b2f350d68371d8a55a244b84f1
-
SHA1
0e245a4b8c8d421e98dfa537d11ed0d1d1a1f7d5
-
SHA256
cc9844de1e847151ddb427976e540e146af4508d6c97f86ea5badb7c65cf4437
-
SHA512
eb788765bfd6600beb08b8e975135c73e232696d70b2e1cc2fca9da63b66eecaba75ac1345e2925268a09f02f5d6d5f752297aa992c5407aed31d4fd71fc130d
-
SSDEEP
196608:748H+uHTXObt2xDo1Sa4EEY1wM1ZJjWh9+u4:M8H+SbOR2BUSavf1d1Zawu4
Malware Config
Extracted
xworm
127.0.0.1:52733
stories-boulevard.gl.at.ply.gg:52733
points-detect.gl.at.ply.gg:52733
points-detect.gl.at.ply.gg:35608:52733
region-vip.gl.at.ply.gg:52733
-
Install_directory
%AppData%
-
install_file
explorer.exe
-
telegram
https://api.telegram.org/bot6976323003:AAGzNfsdTYlBPbGEbbSm--c7mAZ9PZzt9Xw/sendMessage?chat_id=5476035148
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x0008000000023339-7.dat family_xworm behavioral2/memory/1652-17-0x0000000000B70000-0x0000000000B8A000-memory.dmp family_xworm -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation cryptedfile.exe -
Executes dropped EXE 3 IoCs
pid Process 1652 explorer.exe 3648 Built.exe 4124 Built.exe -
Loads dropped DLL 17 IoCs
pid Process 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe 4124 Built.exe -
resource yara_rule behavioral2/files/0x000700000002334e-53.dat upx behavioral2/memory/4124-57-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp upx behavioral2/files/0x0007000000023345-75.dat upx behavioral2/files/0x0007000000023348-78.dat upx behavioral2/files/0x0007000000023347-77.dat upx behavioral2/memory/4124-79-0x00007FFC84AC0000-0x00007FFC84AE4000-memory.dmp upx behavioral2/memory/4124-80-0x00007FFC8A2B0000-0x00007FFC8A2BF000-memory.dmp upx behavioral2/files/0x0007000000023346-76.dat upx behavioral2/files/0x0007000000023344-74.dat upx behavioral2/files/0x0007000000023343-73.dat upx behavioral2/files/0x0007000000023340-88.dat upx behavioral2/files/0x0007000000023352-90.dat upx behavioral2/memory/4124-92-0x00007FFC73CE0000-0x00007FFC73D0D000-memory.dmp upx behavioral2/memory/4124-93-0x00007FFC875B0000-0x00007FFC875C9000-memory.dmp upx behavioral2/files/0x0007000000023351-96.dat upx behavioral2/memory/4124-94-0x00007FFC73CB0000-0x00007FFC73CD3000-memory.dmp upx behavioral2/files/0x0007000000023342-72.dat upx behavioral2/files/0x0007000000023353-70.dat upx behavioral2/files/0x000700000002334d-98.dat upx behavioral2/files/0x000700000002334b-100.dat upx behavioral2/memory/4124-107-0x00007FFC73990000-0x00007FFC73B06000-memory.dmp upx behavioral2/files/0x000700000002334c-62.dat upx behavioral2/files/0x0007000000023341-60.dat upx behavioral2/memory/4124-111-0x00007FFC738E0000-0x00007FFC73913000-memory.dmp upx behavioral2/memory/4124-115-0x00007FFC6FD10000-0x00007FFC70232000-memory.dmp upx behavioral2/memory/4124-121-0x00007FFC88DB0000-0x00007FFC88DBD000-memory.dmp upx behavioral2/memory/4124-122-0x00007FFC80340000-0x00007FFC80359000-memory.dmp upx behavioral2/memory/4124-123-0x00007FFC70710000-0x00007FFC7082C000-memory.dmp upx behavioral2/memory/4124-119-0x00007FFC73720000-0x00007FFC73734000-memory.dmp upx behavioral2/memory/4124-113-0x00007FFC73810000-0x00007FFC738DD000-memory.dmp upx behavioral2/memory/4124-109-0x00007FFC88FA0000-0x00007FFC88FAD000-memory.dmp upx behavioral2/memory/4124-154-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp upx behavioral2/memory/4124-156-0x00007FFC8A2B0000-0x00007FFC8A2BF000-memory.dmp upx behavioral2/memory/4124-155-0x00007FFC84AC0000-0x00007FFC84AE4000-memory.dmp upx behavioral2/memory/4124-157-0x00007FFC73CE0000-0x00007FFC73D0D000-memory.dmp upx behavioral2/memory/4124-158-0x00007FFC875B0000-0x00007FFC875C9000-memory.dmp upx behavioral2/memory/4124-159-0x00007FFC73CB0000-0x00007FFC73CD3000-memory.dmp upx behavioral2/memory/4124-160-0x00007FFC73990000-0x00007FFC73B06000-memory.dmp upx behavioral2/memory/4124-163-0x00007FFC80340000-0x00007FFC80359000-memory.dmp upx behavioral2/memory/4124-164-0x00007FFC88FA0000-0x00007FFC88FAD000-memory.dmp upx behavioral2/memory/4124-167-0x00007FFC73810000-0x00007FFC738DD000-memory.dmp upx behavioral2/memory/4124-168-0x00007FFC6FD10000-0x00007FFC70232000-memory.dmp upx behavioral2/memory/4124-165-0x00007FFC738E0000-0x00007FFC73913000-memory.dmp upx behavioral2/memory/4124-170-0x00007FFC88DB0000-0x00007FFC88DBD000-memory.dmp upx behavioral2/memory/4124-169-0x00007FFC73720000-0x00007FFC73734000-memory.dmp upx behavioral2/memory/4124-172-0x00007FFC70710000-0x00007FFC7082C000-memory.dmp upx behavioral2/memory/4836-173-0x0000026B8FAB0000-0x0000026B8FAC0000-memory.dmp upx behavioral2/memory/4124-171-0x00007FFC74170000-0x00007FFC7475E000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 408 tasklist.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 2460 powershell.exe 2460 powershell.exe 2460 powershell.exe 4836 powershell.exe 4836 powershell.exe 4836 powershell.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4408 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 4408 taskmgr.exe Token: SeSystemProfilePrivilege 4408 taskmgr.exe Token: SeCreateGlobalPrivilege 4408 taskmgr.exe Token: SeDebugPrivilege 1652 explorer.exe Token: SeDebugPrivilege 2460 powershell.exe Token: SeDebugPrivilege 408 tasklist.exe Token: SeIncreaseQuotaPrivilege 552 WMIC.exe Token: SeSecurityPrivilege 552 WMIC.exe Token: SeTakeOwnershipPrivilege 552 WMIC.exe Token: SeLoadDriverPrivilege 552 WMIC.exe Token: SeSystemProfilePrivilege 552 WMIC.exe Token: SeSystemtimePrivilege 552 WMIC.exe Token: SeProfSingleProcessPrivilege 552 WMIC.exe Token: SeIncBasePriorityPrivilege 552 WMIC.exe Token: SeCreatePagefilePrivilege 552 WMIC.exe Token: SeBackupPrivilege 552 WMIC.exe Token: SeRestorePrivilege 552 WMIC.exe Token: SeShutdownPrivilege 552 WMIC.exe Token: SeDebugPrivilege 552 WMIC.exe Token: SeSystemEnvironmentPrivilege 552 WMIC.exe Token: SeRemoteShutdownPrivilege 552 WMIC.exe Token: SeUndockPrivilege 552 WMIC.exe Token: SeManageVolumePrivilege 552 WMIC.exe Token: 33 552 WMIC.exe Token: 34 552 WMIC.exe Token: 35 552 WMIC.exe Token: 36 552 WMIC.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeIncreaseQuotaPrivilege 552 WMIC.exe Token: SeSecurityPrivilege 552 WMIC.exe Token: SeTakeOwnershipPrivilege 552 WMIC.exe Token: SeLoadDriverPrivilege 552 WMIC.exe Token: SeSystemProfilePrivilege 552 WMIC.exe Token: SeSystemtimePrivilege 552 WMIC.exe Token: SeProfSingleProcessPrivilege 552 WMIC.exe Token: SeIncBasePriorityPrivilege 552 WMIC.exe Token: SeCreatePagefilePrivilege 552 WMIC.exe Token: SeBackupPrivilege 552 WMIC.exe Token: SeRestorePrivilege 552 WMIC.exe Token: SeShutdownPrivilege 552 WMIC.exe Token: SeDebugPrivilege 552 WMIC.exe Token: SeSystemEnvironmentPrivilege 552 WMIC.exe Token: SeRemoteShutdownPrivilege 552 WMIC.exe Token: SeUndockPrivilege 552 WMIC.exe Token: SeManageVolumePrivilege 552 WMIC.exe Token: 33 552 WMIC.exe Token: 34 552 WMIC.exe Token: 35 552 WMIC.exe Token: 36 552 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe 4408 taskmgr.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3664 wrote to memory of 1652 3664 cryptedfile.exe 99 PID 3664 wrote to memory of 1652 3664 cryptedfile.exe 99 PID 3664 wrote to memory of 3648 3664 cryptedfile.exe 100 PID 3664 wrote to memory of 3648 3664 cryptedfile.exe 100 PID 3648 wrote to memory of 4124 3648 Built.exe 101 PID 3648 wrote to memory of 4124 3648 Built.exe 101 PID 4124 wrote to memory of 2144 4124 Built.exe 103 PID 4124 wrote to memory of 2144 4124 Built.exe 103 PID 4124 wrote to memory of 1128 4124 Built.exe 104 PID 4124 wrote to memory of 1128 4124 Built.exe 104 PID 4124 wrote to memory of 4028 4124 Built.exe 107 PID 4124 wrote to memory of 4028 4124 Built.exe 107 PID 4124 wrote to memory of 2560 4124 Built.exe 109 PID 4124 wrote to memory of 2560 4124 Built.exe 109 PID 2144 wrote to memory of 2460 2144 cmd.exe 111 PID 2144 wrote to memory of 2460 2144 cmd.exe 111 PID 4028 wrote to memory of 408 4028 cmd.exe 113 PID 4028 wrote to memory of 408 4028 cmd.exe 113 PID 2560 wrote to memory of 552 2560 cmd.exe 115 PID 2560 wrote to memory of 552 2560 cmd.exe 115 PID 1128 wrote to memory of 4836 1128 cmd.exe 116 PID 1128 wrote to memory of 4836 1128 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\cryptedfile.exe"C:\Users\Admin\AppData\Local\Temp\cryptedfile.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"4⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4408
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:81⤵PID:6140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
7.4MB
MD5022c90d2b607ce098df042969f1ff10c
SHA1ba9e320d766bc4e131c51c115275dc0efe2b8df6
SHA25660e2391c0b640cbed4d5773ad9d65a54dd07e03afa18d410ef8b08d90a2a3b07
SHA51284cbcc875dd977d8b319fa68a472bf6ec3b7f923e43ab10fd88102bc02f46180820e427416bb5a95da57302b151703df298b9eb9c37ac93e98da0e181a7a5f31
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5341a6188f375c6702de4f9d0e1de8c08
SHA1204a508ca6a13eb030ed7953595e9b79b9b9ba3b
SHA2567039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e
SHA5125976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24
-
Filesize
58KB
MD5ee2d4cd284d6bad4f207195bf5de727f
SHA1781344a403bbffa0afb080942cd9459d9b05a348
SHA2562b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009
SHA512a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55
-
Filesize
106KB
MD5918e513c376a52a1046c4d4aee87042d
SHA1d54edc813f56c17700252f487ef978bde1e7f7e1
SHA256f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29
SHA512ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497
-
Filesize
35KB
MD56d2132108825afd85763fc3b8f612b11
SHA1af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0
SHA256aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52
SHA512196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0
-
Filesize
86KB
MD55eee7d45b8d89c291965a153d86592ee
SHA193562dcdb10bd93433c7275d991681b299f45660
SHA2567b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9
SHA5120d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e
-
Filesize
25KB
MD58b3ba5fb207d27eb3632486b936396a3
SHA15ad45b469041d88ec7fd277d84b1e2093ec7f93e
SHA2569a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051
SHA51218f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b
-
Filesize
43KB
MD53ea95c5c76ea27ca44b7a55f6cfdcf53
SHA1aace156795cfb6f418b6a68a254bb4adfc2afc56
SHA2567367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923
SHA512916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0
-
Filesize
56KB
MD5c9d6ffa3798bb5ae9f1b082d66901350
SHA125724fecf4369447e77283ece810def499318086
SHA256410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec
SHA512878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448
-
Filesize
65KB
MD5936919f3509b2a913bf9e05723bc7cd2
SHA16bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd
SHA256efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3
SHA5122b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3
-
Filesize
1.4MB
MD59d84222015f5e2d8afb5ec74d6808ad0
SHA138f7c2439e7829cbd2837be1f8b0380ce5c8e444
SHA25620adf37360e803029eb7f0a99ec882f277765193f6d4bed683a391c06959581f
SHA5125939f286d47d8ad459521042781d666ff4f99a7b1e4c5747f32f4b3604abca9171fa777ea6453f2e169a4c62931d960b231894fa8faaae0e531c0f232a30e906
-
Filesize
117KB
MD5fcd2a0afcdd171e5fbb84b4cfaac2bf2
SHA1227f2b1ccebd278897d83ce8213c8a092828d8e8
SHA256b9eec542fc7fca3229d8ae9d4f47a7d9dc1543aaaeb5babe5bbe62300955fbc5
SHA512f8f425cc73c1703415c722b8f327eaf16739e4a83e6f41abbf2e9c8f0fefe29988c7ad903dffa8f988e6fde7695f36b9ad2ef5c0123c73b1bbcc09a8eb84d6b1
-
Filesize
117KB
MD5291948ee8e8927f3a74e829695ff9b43
SHA12d28ac4941f4095b8ac4340e4b626af45da15625
SHA256035ba985560ab044aa1c4c413dc1b5706031a6143cd38606e57b5da145aaac6a
SHA512924ec1ba39ef26332855871222945b5d5197a7782387175e764558ec410f1f0dab9f8479575e582479e645c3af23d9264141b61846458489e335d308d6024906
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
1.6MB
MD576eb1ad615ba6600ce747bf1acde6679
SHA1d3e1318077217372653be3947635b93df68156a4
SHA25630be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1
SHA5122b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD52398a631bae547d1d33e91335e6d210b
SHA1f1f10f901da76323d68a4c9b57f5edfd3baf30f5
SHA256487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435
SHA5126568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21
-
Filesize
630KB
MD5cc9d1869f9305b5a695fc5e76bd57b72
SHA1c6a28791035e7e10cfae0ab51e9a5a8328ea55c1
SHA25631cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee
SHA512e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1
-
Filesize
295KB
MD56279c26d085d1b2efd53e9c3e74d0285
SHA1bd0d274fb9502406b6b9a5756760b78919fa2518
SHA256411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6
SHA51230fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
81KB
MD56d2de4d8e6da9b41140a5c67bdf549b0
SHA18774a939e41a7debb2bb784c0bb953d28fc53274
SHA2560c652dbd9acd1062ebd77d70f2f71d174e6584fc7ba52f2bb52435dd3c9c21f5
SHA5123959a3be932ef26109755663dca3ea2c2d6383163c26fb8011d242405a4ee533e73c60ef667c4025f23ba9d252cb07c1ac64715f7c00b8497fc320e019035a97