Analysis
-
max time kernel
89s -
max time network
92s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/05/2024, 18:55
General
-
Target
sipy.exe
-
Size
15.5MB
-
MD5
7f864172c9c2ba147afb4bfaa23a12eb
-
SHA1
aba19ef4ec3f8133cc11f26bb187f3dc75a9c93e
-
SHA256
2718f768e2809cda78cb7e0d70fc32b875aab6637e9a2d9cbb5a3193f9f250ca
-
SHA512
34d1d767b004983c77804257f6735a644b9cb8bfe14044591bf7a517f2ea468d3f06880fd3a8a0d37c180cd5c5010f42bdf508e6875b08c32159699916c79517
-
SSDEEP
393216:8o9Ddnnx8ZlaetEL+9qz8/Ck+7q3D1JF1bWXiWCUI:p9Znx6s+9q4N3D1NtVUI
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3196 powershell.exe 4004 powershell.exe 2956 powershell.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sipy.exe sipy.exe -
Loads dropped DLL 48 IoCs
pid Process 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000100000002aa18-95.dat upx behavioral1/memory/2372-99-0x00007FFCE83A0000-0x00007FFCE8A78000-memory.dmp upx behavioral1/files/0x000100000002a9f0-101.dat upx behavioral1/files/0x000100000002aa12-106.dat upx behavioral1/memory/2372-109-0x00007FFD03D60000-0x00007FFD03D6F000-memory.dmp upx behavioral1/memory/2372-107-0x00007FFCFD750000-0x00007FFCFD775000-memory.dmp upx behavioral1/files/0x000100000002a9ee-110.dat upx behavioral1/files/0x000100000002a9f3-112.dat upx behavioral1/memory/2372-114-0x00007FFCFF970000-0x00007FFCFF989000-memory.dmp upx behavioral1/memory/2372-115-0x00007FFCFD720000-0x00007FFCFD74D000-memory.dmp upx behavioral1/files/0x000100000002aa11-116.dat upx behavioral1/files/0x000100000002a9fb-134.dat upx behavioral1/files/0x000100000002a9f9-132.dat upx behavioral1/files/0x000100000002a9f8-131.dat upx behavioral1/files/0x000100000002a9f7-130.dat upx behavioral1/files/0x000100000002a9f6-129.dat upx behavioral1/files/0x000100000002a9f5-128.dat upx behavioral1/files/0x000100000002a9f4-127.dat upx behavioral1/files/0x000100000002a9f2-126.dat upx behavioral1/files/0x000100000002a9f1-125.dat upx behavioral1/files/0x000100000002a9ef-124.dat upx behavioral1/files/0x000100000002a9ed-123.dat upx behavioral1/files/0x000100000002aa1d-121.dat upx behavioral1/files/0x000100000002aa1c-120.dat upx behavioral1/files/0x000100000002aa1b-119.dat upx behavioral1/files/0x000100000002aa16-118.dat upx behavioral1/memory/2372-136-0x00007FFD03DC0000-0x00007FFD03DCD000-memory.dmp upx behavioral1/files/0x000100000002aa13-117.dat upx behavioral1/memory/2372-138-0x00007FFCFE7B0000-0x00007FFCFE7C9000-memory.dmp upx behavioral1/memory/2372-140-0x00007FFCFE8B0000-0x00007FFCFE8BD000-memory.dmp upx behavioral1/memory/2372-142-0x00007FFCFD7A0000-0x00007FFCFD7AD000-memory.dmp upx behavioral1/memory/2372-147-0x00007FFCE7E70000-0x00007FFCE8392000-memory.dmp upx behavioral1/memory/2372-148-0x00007FFCFA310000-0x00007FFCFA3DD000-memory.dmp upx behavioral1/memory/2372-146-0x00007FFCFA700000-0x00007FFCFA733000-memory.dmp upx behavioral1/memory/2372-156-0x00007FFCFA490000-0x00007FFCFA4A2000-memory.dmp upx behavioral1/memory/2372-155-0x00007FFCF9EE0000-0x00007FFCF9F15000-memory.dmp upx behavioral1/memory/2372-160-0x00007FFCE7980000-0x00007FFCE7AF6000-memory.dmp upx behavioral1/memory/2372-159-0x00007FFCF9EB0000-0x00007FFCF9ED4000-memory.dmp upx behavioral1/memory/2372-154-0x00007FFCFA6A0000-0x00007FFCFA6B6000-memory.dmp upx behavioral1/memory/2372-153-0x00007FFCFD750000-0x00007FFCFD775000-memory.dmp upx behavioral1/memory/2372-152-0x00007FFCE83A0000-0x00007FFCE8A78000-memory.dmp upx behavioral1/files/0x000100000002aa15-162.dat upx behavioral1/memory/2372-163-0x00007FFCFD720000-0x00007FFCFD74D000-memory.dmp upx behavioral1/memory/2372-164-0x00007FFCF9E50000-0x00007FFCF9E68000-memory.dmp upx behavioral1/files/0x000100000002aa02-171.dat upx behavioral1/memory/2372-176-0x00007FFCE7E70000-0x00007FFCE8392000-memory.dmp upx behavioral1/memory/2372-175-0x00007FFCE7020000-0x00007FFCE713B000-memory.dmp upx behavioral1/memory/2372-174-0x00007FFCF6810000-0x00007FFCF6837000-memory.dmp upx behavioral1/memory/2372-172-0x00007FFCFD780000-0x00007FFCFD78B000-memory.dmp upx behavioral1/memory/2372-170-0x00007FFCF98D0000-0x00007FFCF98E4000-memory.dmp upx behavioral1/files/0x000100000002aa01-168.dat upx behavioral1/memory/2372-167-0x00007FFD03DC0000-0x00007FFD03DCD000-memory.dmp upx behavioral1/files/0x000100000002a9c5-177.dat upx behavioral1/memory/2372-180-0x00007FFCFA700000-0x00007FFCFA733000-memory.dmp upx behavioral1/files/0x000100000002a9c0-179.dat upx behavioral1/files/0x000100000002a9c1-183.dat upx behavioral1/memory/2372-181-0x00007FFCFD710000-0x00007FFCFD71B000-memory.dmp upx behavioral1/files/0x000100000002a9c8-185.dat upx behavioral1/memory/2372-189-0x00007FFCFA6F0000-0x00007FFCFA6FC000-memory.dmp upx behavioral1/memory/2372-190-0x00007FFCF96B0000-0x00007FFCF96BB000-memory.dmp upx behavioral1/memory/2372-192-0x00007FFCF7010000-0x00007FFCF701C000-memory.dmp upx behavioral1/memory/2372-191-0x00007FFCFA310000-0x00007FFCFA3DD000-memory.dmp upx behavioral1/memory/2372-188-0x00007FFCFD660000-0x00007FFCFD66B000-memory.dmp upx behavioral1/files/0x000100000002a9c2-187.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 1 raw.githubusercontent.com 1 discord.com 3 raw.githubusercontent.com 5 discord.com 7 discord.com 8 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org 1 api.ipify.org 2 api.ipify.org -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1240 WMIC.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2340 PING.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 2372 sipy.exe 3736 powershell.exe 3736 powershell.exe 3196 powershell.exe 3196 powershell.exe 4004 powershell.exe 4004 powershell.exe 2956 powershell.exe 2956 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2372 sipy.exe Token: SeIncreaseQuotaPrivilege 2408 WMIC.exe Token: SeSecurityPrivilege 2408 WMIC.exe Token: SeTakeOwnershipPrivilege 2408 WMIC.exe Token: SeLoadDriverPrivilege 2408 WMIC.exe Token: SeSystemProfilePrivilege 2408 WMIC.exe Token: SeSystemtimePrivilege 2408 WMIC.exe Token: SeProfSingleProcessPrivilege 2408 WMIC.exe Token: SeIncBasePriorityPrivilege 2408 WMIC.exe Token: SeCreatePagefilePrivilege 2408 WMIC.exe Token: SeBackupPrivilege 2408 WMIC.exe Token: SeRestorePrivilege 2408 WMIC.exe Token: SeShutdownPrivilege 2408 WMIC.exe Token: SeDebugPrivilege 2408 WMIC.exe Token: SeSystemEnvironmentPrivilege 2408 WMIC.exe Token: SeRemoteShutdownPrivilege 2408 WMIC.exe Token: SeUndockPrivilege 2408 WMIC.exe Token: SeManageVolumePrivilege 2408 WMIC.exe Token: 33 2408 WMIC.exe Token: 34 2408 WMIC.exe Token: 35 2408 WMIC.exe Token: 36 2408 WMIC.exe Token: SeIncreaseQuotaPrivilege 2408 WMIC.exe Token: SeSecurityPrivilege 2408 WMIC.exe Token: SeTakeOwnershipPrivilege 2408 WMIC.exe Token: SeLoadDriverPrivilege 2408 WMIC.exe Token: SeSystemProfilePrivilege 2408 WMIC.exe Token: SeSystemtimePrivilege 2408 WMIC.exe Token: SeProfSingleProcessPrivilege 2408 WMIC.exe Token: SeIncBasePriorityPrivilege 2408 WMIC.exe Token: SeCreatePagefilePrivilege 2408 WMIC.exe Token: SeBackupPrivilege 2408 WMIC.exe Token: SeRestorePrivilege 2408 WMIC.exe Token: SeShutdownPrivilege 2408 WMIC.exe Token: SeDebugPrivilege 2408 WMIC.exe Token: SeSystemEnvironmentPrivilege 2408 WMIC.exe Token: SeRemoteShutdownPrivilege 2408 WMIC.exe Token: SeUndockPrivilege 2408 WMIC.exe Token: SeManageVolumePrivilege 2408 WMIC.exe Token: 33 2408 WMIC.exe Token: 34 2408 WMIC.exe Token: 35 2408 WMIC.exe Token: 36 2408 WMIC.exe Token: SeDebugPrivilege 3736 powershell.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 2956 powershell.exe Token: SeIncreaseQuotaPrivilege 3768 WMIC.exe Token: SeSecurityPrivilege 3768 WMIC.exe Token: SeTakeOwnershipPrivilege 3768 WMIC.exe Token: SeLoadDriverPrivilege 3768 WMIC.exe Token: SeSystemProfilePrivilege 3768 WMIC.exe Token: SeSystemtimePrivilege 3768 WMIC.exe Token: SeProfSingleProcessPrivilege 3768 WMIC.exe Token: SeIncBasePriorityPrivilege 3768 WMIC.exe Token: SeCreatePagefilePrivilege 3768 WMIC.exe Token: SeBackupPrivilege 3768 WMIC.exe Token: SeRestorePrivilege 3768 WMIC.exe Token: SeShutdownPrivilege 3768 WMIC.exe Token: SeDebugPrivilege 3768 WMIC.exe Token: SeSystemEnvironmentPrivilege 3768 WMIC.exe Token: SeRemoteShutdownPrivilege 3768 WMIC.exe Token: SeUndockPrivilege 3768 WMIC.exe Token: SeManageVolumePrivilege 3768 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 988 wrote to memory of 2372 988 sipy.exe 80 PID 988 wrote to memory of 2372 988 sipy.exe 80 PID 2372 wrote to memory of 4812 2372 sipy.exe 83 PID 2372 wrote to memory of 4812 2372 sipy.exe 83 PID 4812 wrote to memory of 2408 4812 cmd.exe 85 PID 4812 wrote to memory of 2408 4812 cmd.exe 85 PID 2372 wrote to memory of 1556 2372 sipy.exe 86 PID 2372 wrote to memory of 1556 2372 sipy.exe 86 PID 1556 wrote to memory of 4476 1556 cmd.exe 88 PID 1556 wrote to memory of 4476 1556 cmd.exe 88 PID 2372 wrote to memory of 2816 2372 sipy.exe 89 PID 2372 wrote to memory of 2816 2372 sipy.exe 89 PID 2816 wrote to memory of 3736 2816 cmd.exe 91 PID 2816 wrote to memory of 3736 2816 cmd.exe 91 PID 2816 wrote to memory of 3196 2816 cmd.exe 92 PID 2816 wrote to memory of 3196 2816 cmd.exe 92 PID 2816 wrote to memory of 4004 2816 cmd.exe 93 PID 2816 wrote to memory of 4004 2816 cmd.exe 93 PID 2816 wrote to memory of 2956 2816 cmd.exe 94 PID 2816 wrote to memory of 2956 2816 cmd.exe 94 PID 2372 wrote to memory of 2728 2372 sipy.exe 95 PID 2372 wrote to memory of 2728 2372 sipy.exe 95 PID 2728 wrote to memory of 3768 2728 cmd.exe 97 PID 2728 wrote to memory of 3768 2728 cmd.exe 97 PID 2372 wrote to memory of 732 2372 sipy.exe 98 PID 2372 wrote to memory of 732 2372 sipy.exe 98 PID 2372 wrote to memory of 3084 2372 sipy.exe 100 PID 2372 wrote to memory of 3084 2372 sipy.exe 100 PID 3084 wrote to memory of 1240 3084 cmd.exe 102 PID 3084 wrote to memory of 1240 3084 cmd.exe 102 PID 2372 wrote to memory of 2216 2372 sipy.exe 103 PID 2372 wrote to memory of 2216 2372 sipy.exe 103 PID 2216 wrote to memory of 2848 2216 cmd.exe 105 PID 2216 wrote to memory of 2848 2216 cmd.exe 105 PID 2372 wrote to memory of 3492 2372 sipy.exe 106 PID 2372 wrote to memory of 3492 2372 sipy.exe 106 PID 3492 wrote to memory of 412 3492 cmd.exe 108 PID 3492 wrote to memory of 412 3492 cmd.exe 108 PID 2372 wrote to memory of 224 2372 sipy.exe 109 PID 2372 wrote to memory of 224 2372 sipy.exe 109 PID 224 wrote to memory of 2340 224 cmd.exe 111 PID 224 wrote to memory of 2340 224 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\sipy.exe"C:\Users\Admin\AppData\Local\Temp\sipy.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\sipy.exe"C:\Users\Admin\AppData\Local\Temp\sipy.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵PID:4476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "3⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵PID:732
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵PID:412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /F "C:\Users\Admin\AppData\Local\Temp\sipy.exe""3⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- Runs ping.exe
PID:2340
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91B
MD55aa796b6950a92a226cc5c98ed1c47e8
SHA16706a4082fc2c141272122f1ca424a446506c44d
SHA256c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
-
Filesize
23B
MD55638715e9aaa8d3f45999ec395e18e77
SHA14e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA2564db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA51278c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
-
Filesize
10KB
MD5f2bf3f3cdce0e6a8a29bd7fad094736b
SHA17eb4af31b93ee38219eb31c2a867959bb7a3ec53
SHA256d8a9edff4c8cbbd02cc89541cd1a9f8b1ba8381f000a86f910b4d6831bb9a034
SHA512ea3dcdd0218f51bedafe9fb995d84a820d244673086f42276d7cb6c398c67f0e4f79ec343dd0a6fc0af03ae605aabbbd93c8c612cbfd7ddf641b9f8a8db13c83
-
Filesize
10KB
MD54d651469eff9f0a3f904fcac9b1a41d2
SHA1f9eb0d3ae58b8195e2485c6c378ce84f95c9ee54
SHA2561b835a8c05dcc24c77fcf21ae0091ce34aca3b6b3d153415e3f0cf0142c53f9b
SHA5120c10c6a52e2fa9bdf89229ad9964cfff6f3621eaad6f3aacebbbc8da6ff742e087c79af2d2d152c433160f25a9e45a2c41e13349cba758640163832569d37cfd
-
Filesize
11KB
MD50a47ae20f5c45144eaa5c6af1ba33757
SHA1dad050ea948c1e327369a3644c7cc65e7927bf10
SHA25677d5d375fa405f83fba90ff51bda86c2233146a3aa768367f8ef582aba453aab
SHA512a8eb40ae7a390d2d13deb0df6e753a3d3fd1f02597271020ee46c1326578908e402f3a527d8bc69fe9638cc1960330c7e81578a3dbdc0e93636b90d506ed5cae
-
Filesize
9KB
MD5b47c542168546fb875e74e49c84325b6
SHA12aecab080cc0507f9380756478eadad2d3697503
SHA25655657830c9ab79875af923b5a92e7ee30e0560affc3baa236c38039b4ef987f2
SHA512fc25087c859c76dff1126bbfe956ea6811dc3ca79e9bbfd237893144db8b7ce3cae3aeb0923f69e0bfffa5575b5442ad1891d7088dd3857b62be12b5326be50d
-
Filesize
10KB
MD56315a891ea3f996fc4b5ec384841f10c
SHA1ed76ef57517e35b7b721a8b1a3e1ffa7873aec57
SHA256087c238e1aa9038f53f8c92e7255f7adc9cd9a60a895256962dc39a73d596382
SHA512083859a84ff84e865cfc255ff1674134940c5a64cc703c4ae7815501d586005b6b6cabc28e52239ae24cd38a1253d634d8de87d98a4a65f45df2b34bc24c2483
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
48KB
MD5f8dfa78045620cf8a732e67d1b1eb53d
SHA1ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
-
Filesize
37KB
MD5e70f94909c6c85d7d9eeede874a6425a
SHA1e234a34c7d46e6977b30f7115ab622ecd6dfb2b9
SHA256d6b5daed17b0b0c27b321776b639b2e1547ad098a27e7b994f4cfa6670d24fc7
SHA512826ecaf2ac3503660d23c467b3c5739670dbf61a7e0b75819510e45084b6451593a61492fea35fd230e732e6aa529ab92f3f1899907f649ac5e42c28b4c1168e
-
Filesize
48KB
MD52152fe099ca3e722a8b723ea26df66c6
SHA11daaaba933501949e5d0e3d3968f4279dcde617d
SHA25641eb95b13a115594ca40eacbb73b27233b7a8f40e9dbfbc597b9f64f0a06b485
SHA5125168f3c554ba8f6c1d923a047ca6784c106b56b8e1944113059190e2a9c19bd8722f14106ea7300ab222696e5164ee66d857b5d619328dd29bbb27943b073cf9
-
Filesize
71KB
MD526624b2ea2b9ec0e6ddec72f064c181a
SHA12658bae86a266def37cce09582874c2da5c8f6fa
SHA2569fcab2f71b7b58636a613043387128394e29fe6e0c7ed698abdc754ba35e6279
SHA512a5315700af222cdb343086fd4a4e8a4768050fdf36e1f8041770a131fc6f45fefe806291efc1cfb383f975e123d378a029d9884244a420523fc58b8178e8571f
-
Filesize
59KB
MD51b06133298f03ff20e5d31cb3b0bca63
SHA10678e26f8d03e2ea0ba8d78d6d14809914d9c0a8
SHA256e92c373cc790a5411681a78ade2b75ecb03f3cf17aab7d98c0fb3afa2254684d
SHA51218c50a5ff69c0c7e19c27039eda0cade0e8bc8d617cca4bc8981dc8a519fa86a05a86b0662aaa493604e9801edf6a41ee65336332b715188e5e17a60a8154cbc
-
Filesize
105KB
MD5a6102e46e07e1219f90392d1d89ac4d6
SHA1425375d377fde63532aa567978c58a1f131a41b1
SHA256572116a1ecdc809846f22d3ccd432326a7cff84969aa0de5a44e1fbe4c02bcf7
SHA51227bad2fd9b9953798b21602f942228aae6cec23cac1c160a45c4a321f1d0151ce245a82cceb65bfcd7412b212cb19e44fff3b045d7f3bedac49ff92d1c4affa6
-
Filesize
35KB
MD5ee8c405267c3baaa133e2e8d13b28893
SHA1b048112268f8300b3e47e441c346dea35e55d52a
SHA256462b55ca1a405cf11a20798cf38873a328d3720bbd9e46242ce40a5bc82f47d1
SHA512da290e352fa759414bbfa84d1c213be9c5722f5b43ab36ae72ea816e792a04e9aaa5253b935d6acdc34611f0ef17c2c0e8d181d014ce3cb117b5775e406f820a
-
Filesize
86KB
MD5cf374ecc905c5694986c772d7fc15276
SHA1a0ee612388a1c68013f5e954e9280ba0db1bd223
SHA256d94c8b2004a570d0f3b1cfd0333e4b1a82696fe199a1614d9054f8bfef4ba044
SHA5120074b3e365782721de8d0a6ee4aa43871d9498eae07a24443b84b755fa00ec3335e42aedeefed0499e642bde9f4ad08843f36b97e095ef212ec29db022676a42
-
Filesize
27KB
MD5166e38053ab1b5f688b6d287910ab659
SHA16dc6905db08448b4051c3e0a144bd0d703a92ffc
SHA256ca483a515a978ede2fb1db581ad68412e186fcc1dcca8d023c1e3fa990982cb0
SHA5120d633041be4958f7a1ecc400a62bee2089312888ad0055d1b1a73e5f0ef3035d869a1a1f9ed9b63ab3b0e5ff918890e466e0a7cc991851ddbb2518f7d4aca681
-
Filesize
33KB
MD5058694b932db66c57d856e727745de5d
SHA14595d0bdd5190d92edc4c9ffcaa333aa40fa7106
SHA25615542d51c901f9b725f29be3ed954b6044505a087ca8eb943997b2d70f843a87
SHA5120361b6d6e86dd9de8b38934b9f4a9759906be179974413835d6a7fc73ec46f2815e2a00545a92af3facf5c0cc7999407035b6340750bc237d83ce7d352422fe6
-
Filesize
26KB
MD5a56e79b7526129f06c4feacf1f8ed117
SHA199f4b0e65c01604f1f5beaff1c0549b1c5a807c5
SHA256dff778a28f75ea484a8e2e91c31235eb8d44128f5ace83491e4fbe923addffad
SHA512b1f1fee24e1041424e5e05e2087440a6b9eb79ab57367d6f83fa83c6a39c7eb693d6edac9a7ac1c22a26109014fb4a12ef31b33775b23e857afeca777ae0bbcb
-
Filesize
44KB
MD5cd2becb9c6dc5cc632509da8cbd0b15d
SHA128a705e779ed0e40651875cb62fa8e07d3e27e10
SHA2562a56f2fdbd69a386924d2c00266f1a57954e09c9eb022280be713d0c6ef805ce
SHA512fb22b719d4db4c50ab11984ba1bef29a2154d3f2a283b9fa407fd5ec079b67bedf188d5bb94b45b3d18e9000dce11ebf8bb3cd35d465ccbe49c54e150d21a62a
-
Filesize
57KB
MD5a045491faa0cba94b3230b254db7f2d2
SHA111a87b7f872e24bab0b278bd88c514b5788975b1
SHA25679769e9318b6e525a145293affedc97b5e7a2e994c88f9df445b887df75f92ee
SHA512a279306e78f34feed13dedd7ecedd226304d5f06746a14c0f9759a7191953de6409b244d23629b25fe9c4a374528ffc6ac92bd1090e218ee5962815491fdcb43
-
Filesize
65KB
MD57b0d6d717535bc48f0176fd6455a133b
SHA1a3fd5e6495d961eeaa66ccb7b2a8135812210356
SHA2563e2d13bda93c59fdd1b9bbb2b30c682774e8da4503248e96e0e3c1b0fe588ce7
SHA512861443c982a821f61bd971f57f65998366f325d084f21636e38f91aaaac752e7dc2b2344f414db3cb7fddec08210cfc197c1815a44e9b726ff5eabe2c62f42f9
-
Filesize
24KB
MD5b9e2ab3d934221a25f2ad0a8c2247f94
SHA1af792b19b81c1d90d570bdfedbd5789bdf8b9e0c
SHA256d462f34aca50d1f37b9ea03036c881ee4452e1fd37e1b303cd6daaecc53e260e
SHA5129a278bfe339f3cfbd02a1bb177c3bc7a7ce36eb5b4fadaaee590834ad4d29cbe91c8c4c843263d91296500c5536df6ac98c96f59f31676cecdccf93237942a72
-
Filesize
28KB
MD5bb53704984e3a8de17513de077528ef5
SHA1fedf2063382d594dfe4ee790b1b123e435bf4ea6
SHA256c77ad132a6c481d9143edb58ceb99bb49f458c8910477a6240846a127da6b2f2
SHA512627c56cd1b3fc642cc3b45222da77f22946ce8caccab275275b3b8348a59225753efc0780eb8159ac1b3d1b35d5d15b0c35cbf8f0ab23d537519d418f117b183
-
Filesize
1.3MB
MD5ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA256eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
SHA5124f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
-
Filesize
9KB
MD5ea68b13d83a5c7521453120dd7bd4dfc
SHA1182d77f89ceb44b524b9d53d6480343f9670fc9c
SHA256c3d31f8842c002085e2d7aa43856c2297d6740f70450c2c4bf80dc1d8360cbc7
SHA51241d3eddc57ee9c643ab28a6e0286cd39c2724a9d1bdf24d75d1dd3ec7900396768e6afa4702272b051627855bdcb12fac8d8834d1d1ddf1638c769c89c2b488d
-
Filesize
39KB
MD54b81e1518d8fc26804b26fa0099ee5b6
SHA1b152ee2d7b843b883f830e69af629a49e2909dcf
SHA256f00565d8909029ce00bc04048a551975db20eb8aa39d1e4a65b7e659c0945100
SHA51209ad69911959418e458cf25c972b4d14983d58c4a48ae739c31d981125442673e66d935bf9c2ea0aa8fbfa20ba4434cf9aac6e6a3b0bd776cf4e46cb80b93949
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
31KB
MD51a3e12d8caf9634147b3749b676e6734
SHA11c0efdec5b613c44d20d78756d5f7f4c090c3144
SHA2563e03145dfb5218b4ca95b172349b0eac6f73dafe2a96300761692aa7e19f1c7a
SHA51278e0d4a4dbe38629719da9ef6be3373a0a093fb4771ce078c1dbf99cae2225cc9663c09ebecb55843c673fa90d7202c972f93bd8e357435edcb3d55711989a76
-
Filesize
87KB
MD505b5b559ac2e9f25b69b7fd050f3ff63
SHA1ea9b73a972292ac205816526f737ace9091e547f
SHA256b10ab33c09286a469adcf47299ffd544cf232e7109c7e02cdd4f0017d5956391
SHA5121c841b5ff1599e6ad91d227cc0d4213649344e3c39de298b4567bbad28a736de5bbfef163c9d82413eb84b7b3f3df071e04b1e8942b4f252559a4ac5448d697c
-
Filesize
66KB
MD54038af0427bce296ca8f3e98591e0723
SHA1b2975225721959d87996454d049e6d878994cbf2
SHA256a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
SHA512db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
-
Filesize
1.8MB
MD52f1072ddd9a88629205e7434ed055b3e
SHA120da3188dabe3d5fa33b46bfe671e713e6fa3056
SHA256d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf
SHA512d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b
-
Filesize
25KB
MD579bb09417365e9b66c8fb984cbb99950
SHA1517522dbcbefb65e37e309cb06fed86c5f946d79
SHA25694f2bac05e32cb3791f66efb3229c932ab71bc3725a417340304219721b0d50d
SHA5121c2129dd4d8febe2886e122868956ba6032a03b1297da095d3e9c02ab33183d964a8f790086e688b0720ab39aa1e8d0fe91fadbbe99035baf4d7cc5754de9e64
-
Filesize
630KB
MD55655f540da3e3bd91402e5e5b09a6d2f
SHA1d44db47026b330d06fa84128fd9f0241f5752011
SHA256aa05807dfa35d6fbe1484728110430802a791f3f8723f824696f2d6bd9c5b69a
SHA5121205dcd5657dcc457f8d02452c47fcb2e7fee108a675aaddc9f7b82d1f2371e38080a6fa0f767524f835c544f129b6f71b2d716180d196b18a9a6dbef6c9bf03
-
Filesize
295KB
MD520f206b5b405d837c201b8fb443cfa5a
SHA1f06b062505f7218d49a1ef0ea65c6212dc4105b0
SHA2560ae76f7316506bcaa4a59f31817569129fd1baaaba89032953785dbf9f7a7242
SHA512b36e4af96bef6b8c13d509b66c34f1cdf6ac8830267fabc13a811d7d486d938d798b32b4d195fea762ee550501002674d6681f8985318990b454a5bc5c982088
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82