Analysis
-
max time kernel
150s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
Fantom.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Fantom.exe
Resource
win10v2004-20240319-en
General
-
Target
Fantom.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Malware Config
Extracted
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Signatures
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (1017) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation Fantom.exe -
Executes dropped EXE 1 IoCs
pid Process 4212 WindowsUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_MedTile.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\weather_trends.png Fantom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt Fantom.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\joni.md Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\wordEtw.man Fantom.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\LargeTile.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-200_contrast-white.png Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\System\msadc\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125_contrast-black.png Fantom.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-48_altform-lightunplated.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_SplashScreen.scale-125.png Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-lightunplated.png Fantom.exe File created C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-100.png Fantom.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png Fantom.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md Fantom.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt Fantom.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Windows Photo Viewer\es-ES\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt Fantom.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\DECRYPT_YOUR_FILES.HTML Fantom.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\DECRYPT_YOUR_FILES.HTML Fantom.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Fantom.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\8.jpg Fantom.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md Fantom.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png Fantom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2208 Fantom.exe 2208 Fantom.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2208 Fantom.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2208 wrote to memory of 4212 2208 Fantom.exe 111 PID 2208 wrote to memory of 4212 2208 Fantom.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fantom.exe"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4052 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:81⤵PID:2240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c515d6d5b5ae4b58ee29226759f92437
SHA1ff964643155ab5d6bd11a25f9812caaeaeefbd9d
SHA2564f3fd7095438bfe4ec75cb1613866ef9c3c50e9a9a80d3a683fe34e03c500dcc
SHA5120f7bca6b88f9031da47ad8100198d04b30c799e9e03d735ffe4137b3846f355baf694ab421664e7ffba228652c4ab4cf455d82e29773427d57d7fe729fc4a0a4
-
Filesize
160B
MD568a5f31834a61d6ef5bc95c220490966
SHA1d0b921ba4c59f2f12451b9fccdcedce2188ef180
SHA256d7f89dc8dbbafa2d0af6c087281a0d649677215e80692a4aa4c3f0c1f05c8c1c
SHA512cf57f47ed7dcd7e040a6aaee9605621fa9c8f4bbd05b0fbb034922783a42188f1518599ca90e4e776d2bcf46882f90732337cd1a5c373adc44a57dc56390c7db
-
Filesize
192B
MD5f2546bea0b65daf8460db6662566389f
SHA1dc517a93610f48811a8e45aaa0d7314bf89e477f
SHA256e9ec586abcd5652b5beb6b24eb31c02bc39af32423ef8bdab659582b5ca166b2
SHA51298b6ba0c07ecc26a3daa74cfa905d0c403eba9f0a8982da113a717f8e426495efec77ca0f6bcaba586a8914a9da0ac99abeef558813107ff33444747094cca45
-
Filesize
192B
MD5f96e806593ed9d4ff8b9a333da01d51f
SHA1f280dd384549b77977b0d11a420ace87fb37b822
SHA256b8bfef39696c60373d67d5aca64ca0cb5478e433b3a2859882ee938638f17ba9
SHA51260844488860d5f76a5d7b8c6dafd6da0ce526c07b799aea0f18175c146110ca9d27d2ef4abe10dbf5549406b9fc15d3d6a2cdbcbae1fa4deacf6ef2ec689bf35
-
Filesize
1KB
MD50cbca26fd35889fc1909b13d23ea03b7
SHA1e83256e32ff223af54767752860b0f516c5cb46a
SHA2564c0573b502358812448a69e3f9e3132426510f7a2175288ef55720935cbf2df9
SHA512553f0e2749d52129fca16f273a782922a5c86d006729613dad574ef2cb5c98511341947e6b243229b40b87480fdd561494fccc77972db8d7f3914883d551ea22
-
Filesize
31KB
MD57f51cf26be5f64365d83dedca082797d
SHA1482c366eb7aa5f75f70bca0121ee2a4197935b66
SHA256f65cc29806a2ea0d4c18a63a3d3395b11adec06c3960d8d369e66f96ea523736
SHA51283704e2cddcd53e509e4beb1380c1b4b374a39821b26672d040cfb266208749494801cd7aec26388b1f50f5d7f08cf45810106cb202acd3ffd7064346f3385e6
-
Filesize
34KB
MD5c27ebb44f1d4faf26cb0b367bee5e47f
SHA1abac9b6ca8f5206bcfe49eb663ed8cebfcf6f056
SHA256175d4dc844bf009059e62a43e1014c9430715ffb93a572a8aa419ab06d57557f
SHA512bc833e9381f8e43c70a8c1ce27ebc645cdf615fed6d9fb46613f4baaac7701397ec645af93d15046fd6c85ff0d2eb695542ba0deb9148e7ddb39bf993082f5c5
-
Filesize
23KB
MD524e1041816e044046e80fc0be80564aa
SHA17660bfede1040759016b83bd6dc118c692cc57ca
SHA256c5abbf0a294c1e7b2e321815bc1c44da57be51810bbcd2254628c15f70b5c8ff
SHA51205e91f35e4ae9e60856195386ca630b043efcb8c3791a1adb166c68a1a5be1362f511e937e5b3254b18b57d6c3edf639e252cbf1ee4f8ec459ff3ebecfb710f8
-
Filesize
2KB
MD5ef61daa23b5be53318df26cc3638e0e3
SHA1f65f6f7431156738e97453bf0ce31fe663bbb538
SHA256d8011911f90584850d3ff0ca441c052ff342af9e86a84caec0c120a2822f4b46
SHA51234cc768c8c1e9d79c721121ec0123556cdcd85e6db133804593a4091c825833b767561f751ac9a1efbe7fca39ac9561ef988ec9169d028a1768b1274ec1ae4b1
-
Filesize
1KB
MD5bd14007b1284c435f58769898e1fdea3
SHA1e0ced387f2ead6cee418eca20d7967323fe54fdf
SHA25654fc3015000d31185367e0915f6c27fa4aa5d6ccc760f53b676c9a65517f033b
SHA5124bef247fbc36afb4588d500106d5e9e3fcfb2bce2118d8121fa88a1049fcd3dd3cb8f4d653ce58cbfc36ef084b3802bf525a10d56363e9ccf14a6f0a601ff057
-
Filesize
3KB
MD5572160d08348aaf49bd1b1953c6c64b6
SHA13c5892deec7c7ee82a1f27e6e2402f22bb97536d
SHA2562b9dac5686276666f36f244d8989e206823771cc4477a55af459571cb02725c9
SHA5126b11278031c2e0c64e9ab46ca2e0fa72925aca23373c40227502b6b9e910b563b44f4a36dc4af59c4c1f56754ba5775e587c1431d28a5b423a8cf00c3d3a48d3
-
Filesize
2KB
MD5f8052167d7463e2fbd02c358f4a07aff
SHA10a22638f95d4ec65cde5061748b7240151e1f9b3
SHA25640069067b14d2a2b9bc0a862bb982f92525132757a7885e04ad8275b0e176c59
SHA5120013992e2654a45c3e0fb3f85b0b44f3b0b28f0927c2a1452f29696656f78a70041975a5bf62f093bc2ea37a01e51a8c9a2ffd6425f41f820e45146aa3f0407b
-
Filesize
5KB
MD5320181735d2d5681e1a7587878c06c95
SHA1f94f06a57d0a15637197750a735ad568da8c6bdd
SHA2560ef92abce109df92a0c6dcd0c1b81733d3a88e529c4e4d4e8ddc72fbeca34980
SHA51274bdcf2aa313cad70bc5a585b0384a253e842898ec32054c13f107070ea8cec4c009480fb672a8c124a2128f0db0a3078706ee2f333384ae7805b2f432c1eaee
-
Filesize
17KB
MD56c0e006cbb570aebe778420593cb1aac
SHA1f070908449865cf5b7dfe912de8b2b185740c143
SHA256c15471c3823016c36da8d8de0c23ec1e644e3856054a0693c332ae9d9d310f0e
SHA5128b89db73595ba68a6b724b6382c7826148a7c825596ae41793300f82e27e89da96f734133897aa6b703ccbba0ec1aa2a14c51bb3a024d6a6e0e6ff971274d8d1
-
Filesize
320KB
MD5230c48d776a71bf362f5b7c8f44d4bc3
SHA1dbf6bbea852fda2328c499031bc0607d7ccac17e
SHA256f1adfb7cb6f70c806804ddfb2cd1dcc91849b25a0f3b72be474b132b0faf41e2
SHA512e40ecbb1eab752096d240e886335c80a2726c662e3c2e14936eced19e0ee2ebc34f2c5fb2c37c01463026cb2414ab0386a47fa81fce7ded46706054d31dcbf3a
-
Filesize
1KB
MD578e0ff230da07cfe8f9bb3a7a7c70098
SHA176400a37a1864a817498290150aa5f4b3110e655
SHA256d23650d8bd3a64f2b8ceb9af3c5d6ec0c0d554b1663f3e26488fa00616364cea
SHA51240a25b6fd69817bc890061704f7efe67d198b1229557bdcaa0473bb9f439c7e8d1fdb6f87d2b77843589b71d077ab0298253d5ebcdc7327b623decf07d450d1f
-
Filesize
10KB
MD511a55bfd4944a57fb7cd63db9a23e32f
SHA157347d9f85250b9a97614d38a96de8167d183775
SHA256fe33d4cb76337475eb90ddb9ed7bf9498407eab3f0fba53dfdc6ab83163dd5f4
SHA5123b8a6226378afd1063dc9751898c54e5537ce1645f38c0cf5d48dd1572800cd8f007c839f876c72f4d7df75575645676e2dc24e7654a3b4b6fa57a17dad53922
-
Filesize
3KB
MD50b08ac58b6fac8071604dc2455575475
SHA123e24aacfeb5efc2801ec790ebed371474432f73
SHA2564dae7a88dc86de62a86a43824fa93eb0996db1985b330ac552dd6abd1e2d6513
SHA512f52b17d9626d6c98283e32c6ab9d74e0f5edd2778f4d2f02775a124346940f7579eddcbb8ea51cca1981d604089d8a1fe6c362993a7a912b07919a1cff1085b9
-
Filesize
176B
MD50c1808e0810ec054549c7a43e516f752
SHA1b45af6483bbdb4694078100e67236c127ff62df2
SHA256be860011c04c3c42c4330c3f0dd87fde277886f6cc3fce5201b9a2dad569b27a
SHA51283e056d1ab762acee9dcde4bd1bebfa8b0096344e542f553c5ba04139fd6130f9ee7522775ad1507862bff1f1e884cea373442381a9f100d81df7524cabbab3f
-
Filesize
1KB
MD57a647dd252588ebbfe31369891ca1197
SHA19635a06c89ef58c1e247aca9e413c5bcc7c54b70
SHA256906e925fcb0bc6e6fbc731638c2e33cc5b2d1623ea81a5898eb79f44cdd39bf6
SHA512f98b116928bc4db2a217d1f31f3318a464712a7f8c7f18f72361d4c377a007d3f24acd5beb2ed800883941f6200f7a5203edea38ccc3d402b550fd5f3788a34f
-
Filesize
3KB
MD547a93ab5c00a753ece6d95fba7da22d3
SHA1b735d4bba7190cfb5fac872fd5bf166b785eb08e
SHA256bb1f701f7d2dd7a3067117c337ba0ce4c022334cd08b7724bb365dab6c58f2eb
SHA512aa8b839b734b4a20044f192363d1013472fa801cb11ba9cf1245bd0bb82064986488a0e51ae8b19910193e6e2e67517dc72173c1f59906f42edca39e76de5677
-
Filesize
1KB
MD50a4d1c107a53e17e640983e2ca1699df
SHA1df45a3c2aec44cbdc81e69890085a05ae44b54da
SHA2565ce8f9d5c803fe0370fe014056551b82ac298b438e7e45534c217bced9d4e7f0
SHA5120b8c3017fa85a4d0681cfd167180501d8fc163adb9ed3ce2309fa2f41039a7cafa71633b8c02701eccab95d4380aa176476f55106904a2746dd19d570f3f6fd6
-
Filesize
28KB
MD5beb25fc18eb213be3c5c0af72b51a0f5
SHA131d29abc4b40e70dbbad9f42b80f38635c7cf336
SHA256a0d99ed4d487bd32e2c879e3c3bc7cb6a9323438231ba1d201151ac6aeb49313
SHA51259c00d7354a7564582befbc606e7cb20b999462dfccdd0737c6c08214aeaec3f7f49569c2cf31e0f7775100e074e9f71f7bcf002629f4becc273926da3742bf6
-
Filesize
2KB
MD57791df1278b164f71154a31b30208d14
SHA153f110114a6e5209e176a1b792f1f812286de438
SHA2563eb9217b233b16d09ab3f5ee329c30a2b2be4f3594d74b4fb6a3249d6e7555ca
SHA5121c825a3934b97ff89eda302ec8ed5c51e68e46fd02cbd99340d6a574e12c58dd192f54c6c0e8ef0eeea11868491d262ccb18da955d28b68b6637034262bbd857
-
Filesize
1KB
MD517fda408c3000d5fc61df649b9cb5176
SHA1dbd047df4a4c8d419b961cad7a60a7f04aef79cf
SHA256725d7b453a86883f6de430172d8e9bc15817192199313b0d5a197910c1175715
SHA5120f71887877ab307e457b324bf9d9a05410f96291136f1ac4c7149f16ab3971effbb0ce7e156fea7424b6e575c958dd5cba10f705889458be723ca06b9a04fddd
-
Filesize
2KB
MD5caf9f4a89b04b34f21b91993ef3d127a
SHA1250c87c2a371458478bebd9c45b053fe0ecfd026
SHA256ed8ad75c81d6db563daaa9d7fc09ebbc59c7e39e440a48b5a2780d7fe6792c2e
SHA512d88f38ee2adff7247a36e840f12c2da7d5208bef471e6b9d5b7670f5af4bf1909279fd09b604f62108008547b3c2a27671189414bf5b5d7b5d8e1e559bf4c131
-
Filesize
1KB
MD518f2a48f4fde2fe11fd77aed8ab28956
SHA12db5041dbe7bc4df45dbaa290b0624e48d62ea00
SHA25683c1ce6c6f19ccedc7235432050fbc8cd16e861312e5dda2bf836ca94b1af455
SHA512823368614583d1891caaa4a0e1aadd8747579177309ee3ab42724a6f4a14bc90416b183195d003ddb46aee31e59aba45e36fbd5e6604c26a3f185536f4538a84
-
Filesize
1KB
MD5f72368cda6f225344490efc8022b8118
SHA1982c5a1b8301771f7850a868a793eeb20d5c0bf7
SHA256764848efd6ba55f43441840b64bf7c0d30a10ad8fe259bd46fd13c347b535a6f
SHA5127d6da3d32249bf608366cc7ceebded6deb2960086e6e54560155a7bfffa2da34266db46aa991a25e81d81480b597abfd130c79ca2b741359c7cd4c0b85ff0077
-
Filesize
1KB
MD5f6b0072f127171ed4e4155c4e570b9de
SHA1153693853cdfe64745538f4ee9bf497f8f5ecadd
SHA256583a334e8ed9486b1ebca329f85b71d8a4c8170cf86a882e419672a3169bdffb
SHA5127c9119d68bbca4a51dfb2ceeebdf107e858ab83030aa1f95394905b075dcf3cde3d0c01e9910ba5aa02092c134fa13ce0775461f686bcc2be50757a83788f8ff
-
Filesize
3KB
MD5f70741d46b419ef75b76d53bff2efb5e
SHA16a18d162c5e8b0697b5bd65280897564cd05c31f
SHA256973845f658eb3ad34ff6e18592e489d74927b27f75ef0644b47c864eb1d7b4eb
SHA5120265cd86ed7d75379a8c4ae0316f4d64c0eed2231d255314ec3f65d5abc5f6cd71870e65555479922072c1be3a27ec5ce2f22f58349dbcd2b4f434a95a34a733
-
Filesize
2KB
MD59481d1163268d5b03a9e6aeffd48cc83
SHA1782f132ceb9e11c97e991f5624749792d7d3c51b
SHA25641a8345e193cc355e7a7e42e12add6a794e85da792ccd16caf564a69ef6d1151
SHA5120cf5f637086807c4ad5a44ded89ff86aa5356d6b2cf4bd037f151536d311787e1d7f46ad963a41aeb5fa517bac04364e448ffceac667ef471f830feb7d5ba267
-
Filesize
6KB
MD5e5fa66930a7a3c41fadca3b4f1fee7ad
SHA106155904ee2891fb0c690198e793748d554d2262
SHA256cfb3b79214017cb29a584cf3b7a4d020b94da209dab35d90173aed639cb1ce8e
SHA512121c152893701f386e4f0c4d22661a16d50d71d79e2612fefa13f3644bcfbd992740e2fe3d335ab0cae9a54059672e56ff4cb8ce3f2ae2ee19f2ff93b87943e4
-
Filesize
5KB
MD524f7cb34b939b0eb70ce9417a66d6b6e
SHA19716dab3e6f3c3d19915bb790cf4c51ab2a67418
SHA2561bf16d4d7bd73326c6791cce7f8bb2708b9861e672bef531d49f096367030158
SHA5124253f3df836072c2dae498dcdd92833e9f7910d3eb38a3775b1bed1256c4604a78f4d10a26dce16b32ad835230a3f26c219a2198075350e4e618c13d4fbdf766
-
Filesize
3KB
MD57869dcee40e261d6cdee16613e02032d
SHA13bad52d28f854a93612d76f538c7f61d8ffb7ef8
SHA25627ee2cda741593083c76d4096415cb21d8d256f86352c698e9b6d61cc579e73e
SHA512e55b50c12ab4b0f6822964c5154fba56b4f012ac41295a1eb6e7a1e7245dcac096732cb80f9af50f2d164f0f0d048955cad9661ca35ec9913fdeb458600732aa
-
Filesize
2KB
MD5987bfb28a8fbec6e42a91d25dd5d002f
SHA1d386996eff21223d00fce45e5cdcd15446f52e37
SHA25688de8773f6e95633842d288b9c2c3edc2e0794c79e6b4b89316931edaadc37be
SHA5123c73efdf404273b5f53e08e7f4b016fadc1c65b3a85d13fac40e1724fbc54960b87581689908c5228285f9708d3137ffaa38463d73038c9ac8279e046e63bcf2
-
Filesize
2KB
MD59516274f1d57ab9c16d88de107373cf6
SHA13971d19e472d2c00f45fc042ef29d8fafb0633a7
SHA2569f87c643ff388eace78ea553f2eec0edd37e2eed8eb11007df767805408502b7
SHA512610d82c2d9b244dc379a45a81ee5106aa27a7505af9a25a3233f1abf7d0186b21f46c2dcd53ecef5a90921fac6f1940603e0b09b5048b895fc6a28c42f58b0cc
-
Filesize
1KB
MD5f323ff342a8c847c89ea627932bc1b29
SHA16ac0b1fe03173625dd37fc57cd92f1a3a26d24b3
SHA2567eaae8f8f542deb25264200c5e23533fc700bbaa1bf99930497de0bccb70ba9d
SHA51278e62c6ade0c114101e9f739b8a9754cd3034f15c992f20b2a9da26782a759d491065fd81f534406624931abc9a6a047653d6452617d53898cf4a31885952219
-
Filesize
1KB
MD5599a3ac620ce88d4ec2ebc29a73b396d
SHA143a6cea5f001f43889fbec66056996dfa8b845e4
SHA2565e464b45be10ef8f29aa132715bd13e982709319b28ebfdbce76c8605a5e8c8e
SHA51265c8311208fe755dbff808344a9d4328f4e4fdddc3975b45a5c76f00baf6f783dd125e2ed7f79f7f508bc91b92030ba89ebb218b5be5157757d8ac6e9aeeef4e
-
Filesize
11KB
MD54c7ec4bbf6755f719dad7e0027a2ca73
SHA13fbba6d443ef66d2dd4cb157fd1c80381f21b674
SHA2560d07e6790321449fe757bf69059c268daa5f204f97ae1d4a23fa3e64d78114b0
SHA512b258de7bc271273b0e7e134a031261bf7819e4b33d38347ae33c6eec5d8a34cbd374b3dc29afd373e0a581b3b637ff07d09f390002b1136e0dbaaa4e14257cdc
-
Filesize
1KB
MD5bed752a2d7bf1b99b1f2c4bda1122651
SHA11cb6a881a85416ca6e6351847c6254ae8679c1de
SHA25634a6e1cc588d04746eb5fb253cf16eb8fe75d77848a26d9eb607ecc825fda865
SHA512b8442c756a04d35f3a74398408ec9a7122447b4e58c77473e7baa747283274119941932938e41304132f14a939d9b46680749cd3ddf0b478abe983e2cfccc668
-
Filesize
2KB
MD5dcac40eeddf25f9d4e2132d856350768
SHA1320542ddbd96992bda4e684fc775a08a609e081d
SHA2561c651e1fc1c42d9f0ecddc12cc71bed93a98f4bd39fe8788c47af81679c9014f
SHA51224e512172a3db5ae0671376bccf091fb212b422e5b345f57caa3261c8e6d27fb8af5a166949dacc017a967b93e5b275fecaa32705dddd8ff75480c2f9b590fb8
-
Filesize
11KB
MD5fbf3618d0bafd5b9ac327c1fd80ddd53
SHA1809d5405e539a5f44e390ee6f26a4b89301bd41d
SHA25644905d27a2c9442f848bfa7f42bad6b5ac36b780dd4386f661e2b8e708e35a88
SHA51230b14b10bc8523be6249753208e7d0573e99ac2c72167315e33c42064745b4560bc4e972c6622936a2faeebb3b7530341fd5438a5c429a20d8dd0979f719cf9e
-
Filesize
11KB
MD5e51474959f2af540d7ab5b24c4ece3be
SHA1647c845040448bdd3677e3ac7f9fc967a5e85781
SHA256c22c7cfb41819daf360466161db36f72030bfc60bc01a24df6cccbbea6653a63
SHA512ded0a94303eef515826daecb8cae9a8306d0b49673e8c81d53d608c9f47e79a5095f94ba59ff787ccc6dad0709f55f77a950ad8edc0aa606728ea97aed938fc0
-
Filesize
11KB
MD5b365c5d1bec105f278cf87f70cf80ae4
SHA15e7f9d63c3bcabbb11a71d1e02c9d3d5cc54a11a
SHA2560e665e421df7aad88a983201b56e2c385e8a12d526407ac9bc2be989cca63c21
SHA5129238ba156c317b8ac29f23e60efc099a25415e026bc8d986c09d7c072883a7ad5599a019a981251cfff0e7f0319e5378eebef5dbd93a9507fbc6e69375ee8fab
-
Filesize
1024B
MD59dc66d1fad44414134db5dff2aeeb7c5
SHA1340a3628cbac31af9df5bbd37999ef806359dee5
SHA256b6d3824305d5258aa6c64d887d9b22ed30b799231d3112e7bd535f71ec8f2fa7
SHA5122cd5ec7f19921601fe2badec33bb86357dbce0d4ddd67259821f08858e75ad5e08fd2a664856187f3d64aa8727161cb3b7e9c5ffc72d6ec54d544875d9488d9f
-
Filesize
48B
MD517eb1d8f815b47ecacc798d362ccd0c0
SHA194c4bdc965f9fb208ff4b249bea785cc1b5996e1
SHA2569296b81790ca20a5ab48f000a4408d32c82278e3d65f091e093e2c6c7699749a
SHA512e30bc9f91ddda4661e5a7c8d7e3b22ef01b4e21bff84daea3a92433fd0741c547d6a0b75b7938df5e0387b6661e578abf42b213125032a7ecba762e51618b625
-
Filesize
21KB
MD5fec89e9d2784b4c015fed6f5ae558e08
SHA1581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2
SHA256489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
SHA512e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24