Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 11:35
Static task
static1
Behavioral task
behavioral1
Sample
55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi
-
Size
135.7MB
-
MD5
8ec4ab0d1a1120dc9c159f807ef45c04
-
SHA1
7e904e814178238293e2ca11989f4245df1a0a6f
-
SHA256
55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b
-
SHA512
14d2b2cd195049c1566fde868965fa0a28caef2cd7a78f4e0f04023ce40a9600e1b9c26262568c929c6990a89e0aa58b5abbba6e7c47a96fe07adf2b377e2640
-
SSDEEP
3145728:vilSw/0KksfWneWVr6/4J3DYgxqmz8CZCLLURjTN:alSw/7ksOneWVm/CDYddLYt
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/876-13125-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/876-26204-0x0000000000400000-0x0000000001F5A000-memory.dmp purplefox_rootkit behavioral2/memory/12116-26313-0x0000000000400000-0x0000000001F5A000-memory.dmp purplefox_rootkit behavioral2/memory/5308-39404-0x0000000000400000-0x0000000001F5A000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/876-13125-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/876-26204-0x0000000000400000-0x0000000001F5A000-memory.dmp family_gh0strat behavioral2/memory/12116-26313-0x0000000000400000-0x0000000001F5A000-memory.dmp family_gh0strat behavioral2/memory/5308-39404-0x0000000000400000-0x0000000001F5A000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: Gwogw.exe File opened (read-only) \??\Y: Gwogw.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: Gwogw.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: Gwogw.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: Gwogw.exe File opened (read-only) \??\K: Gwogw.exe File opened (read-only) \??\L: Gwogw.exe File opened (read-only) \??\R: Gwogw.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: Gwogw.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: Gwogw.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: Gwogw.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: Gwogw.exe File opened (read-only) \??\O: Gwogw.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: Gwogw.exe File opened (read-only) \??\Q: Gwogw.exe File opened (read-only) \??\S: Gwogw.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: Gwogw.exe File opened (read-only) \??\X: Gwogw.exe File opened (read-only) \??\Z: Gwogw.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gwogw.exe SoftUpdate.exe File opened for modification C:\Windows\SysWOW64\Gwogw.exe SoftUpdate.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
pid Process 876 SoftUpdate.exe 876 SoftUpdate.exe 876 SoftUpdate.exe 12116 Gwogw.exe 12116 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4B2B1826-5935-494B-B7C1-90C074EA6814} msiexec.exe File opened for modification C:\Windows\Installer\MSIEDA3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE57E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIED83.tmp msiexec.exe File created C:\Windows\Installer\e57e445.msi msiexec.exe File opened for modification C:\Windows\Installer\e57e445.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE6C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE801.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE8BE.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE774.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIEC0B.tmp msiexec.exe -
Executes dropped EXE 6 IoCs
pid Process 3824 MSIED83.tmp 4376 MSIEDA3.tmp 876 SoftUpdate.exe 3568 YoudaoDict_fanyiweb_navigation.exe 12116 Gwogw.exe 5308 Gwogw.exe -
Loads dropped DLL 11 IoCs
pid Process 2004 MsiExec.exe 2004 MsiExec.exe 2004 MsiExec.exe 2004 MsiExec.exe 2004 MsiExec.exe 3568 YoudaoDict_fanyiweb_navigation.exe 3568 YoudaoDict_fanyiweb_navigation.exe 3568 YoudaoDict_fanyiweb_navigation.exe 3568 YoudaoDict_fanyiweb_navigation.exe 3568 YoudaoDict_fanyiweb_navigation.exe 3568 YoudaoDict_fanyiweb_navigation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3348 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEDA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gwogw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gwogw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SoftUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_fanyiweb_navigation.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5412 cmd.exe 14016 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Gwogw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Gwogw.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Gwogw.exe Key created \REGISTRY\USER\.DEFAULT\Software Gwogw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Gwogw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Gwogw.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Gwogw.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 14016 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 msiexec.exe 2896 msiexec.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe 5308 Gwogw.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 3348 msiexec.exe Token: SeIncreaseQuotaPrivilege 3348 msiexec.exe Token: SeSecurityPrivilege 2896 msiexec.exe Token: SeCreateTokenPrivilege 3348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3348 msiexec.exe Token: SeLockMemoryPrivilege 3348 msiexec.exe Token: SeIncreaseQuotaPrivilege 3348 msiexec.exe Token: SeMachineAccountPrivilege 3348 msiexec.exe Token: SeTcbPrivilege 3348 msiexec.exe Token: SeSecurityPrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeLoadDriverPrivilege 3348 msiexec.exe Token: SeSystemProfilePrivilege 3348 msiexec.exe Token: SeSystemtimePrivilege 3348 msiexec.exe Token: SeProfSingleProcessPrivilege 3348 msiexec.exe Token: SeIncBasePriorityPrivilege 3348 msiexec.exe Token: SeCreatePagefilePrivilege 3348 msiexec.exe Token: SeCreatePermanentPrivilege 3348 msiexec.exe Token: SeBackupPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeShutdownPrivilege 3348 msiexec.exe Token: SeDebugPrivilege 3348 msiexec.exe Token: SeAuditPrivilege 3348 msiexec.exe Token: SeSystemEnvironmentPrivilege 3348 msiexec.exe Token: SeChangeNotifyPrivilege 3348 msiexec.exe Token: SeRemoteShutdownPrivilege 3348 msiexec.exe Token: SeUndockPrivilege 3348 msiexec.exe Token: SeSyncAgentPrivilege 3348 msiexec.exe Token: SeEnableDelegationPrivilege 3348 msiexec.exe Token: SeManageVolumePrivilege 3348 msiexec.exe Token: SeImpersonatePrivilege 3348 msiexec.exe Token: SeCreateGlobalPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeRestorePrivilege 2896 msiexec.exe Token: SeTakeOwnershipPrivilege 2896 msiexec.exe Token: SeIncBasePriorityPrivilege 876 SoftUpdate.exe Token: 33 5308 Gwogw.exe Token: SeIncBasePriorityPrivilege 5308 Gwogw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3348 msiexec.exe 3348 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2004 2896 msiexec.exe 88 PID 2896 wrote to memory of 2004 2896 msiexec.exe 88 PID 2896 wrote to memory of 2004 2896 msiexec.exe 88 PID 2896 wrote to memory of 3824 2896 msiexec.exe 92 PID 2896 wrote to memory of 3824 2896 msiexec.exe 92 PID 2896 wrote to memory of 3824 2896 msiexec.exe 92 PID 2896 wrote to memory of 4376 2896 msiexec.exe 93 PID 2896 wrote to memory of 4376 2896 msiexec.exe 93 PID 2896 wrote to memory of 4376 2896 msiexec.exe 93 PID 876 wrote to memory of 5412 876 SoftUpdate.exe 99 PID 876 wrote to memory of 5412 876 SoftUpdate.exe 99 PID 876 wrote to memory of 5412 876 SoftUpdate.exe 99 PID 12116 wrote to memory of 5308 12116 Gwogw.exe 100 PID 12116 wrote to memory of 5308 12116 Gwogw.exe 100 PID 12116 wrote to memory of 5308 12116 Gwogw.exe 100 PID 5412 wrote to memory of 14016 5412 cmd.exe 102 PID 5412 wrote to memory of 14016 5412 cmd.exe 102 PID 5412 wrote to memory of 14016 5412 cmd.exe 102
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\55884dd052613e18da67ca7a2c9bdf4221102b5328d13619c73187590a07249b.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3348
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 16163D78A0CBC9541F3D244A20A18F312⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Windows\Installer\MSIED83.tmp"C:\Windows\Installer\MSIED83.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Windows\Installer\MSIEDA3.tmp"C:\Windows\Installer\MSIEDA3.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:14016
-
-
-
C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3568
-
C:\Windows\SysWOW64\Gwogw.exeC:\Windows\SysWOW64\Gwogw.exe -auto1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:12116 -
C:\Windows\SysWOW64\Gwogw.exeC:\Windows\SysWOW64\Gwogw.exe -acsi2⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5bc3da4a92ca935f375633ce52ef59d5b
SHA1f40ad454efda4fe99ed340db246f4ed25d3d79f7
SHA256bc1fc6bf9152cff92c7e5df14a7b5b0355ae955b9730ac19df0277c0757387e8
SHA512debb2e91d3528ad9719a60156db3181f2eecefc9c6791d1235be50b8076b5c00d4c13a7c3aac3d358e517fa52c9a141d283c89ad7f89729783f8ca96d9da200c
-
Filesize
27.4MB
MD5b0d42f500cfc5ea2d25dd408a42c4720
SHA10507dfd1e1d0e6fea86a415d518df06770406e75
SHA25643982d5f68e03fabceac983c736c1ba71751ee5bed1c69899167fab3cbdc1c19
SHA5120c22f09960b70f444accf97071225d5018156e72a74b07692208f94d9305815293758d57efb233cc6785e2a0cf54b4862d27daa67ea1458669eb4a7a7c1d4be6
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
908KB
MD53d3ec6392cf9a8b408569a3dd4cd3ce8
SHA195ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
419KB
MD5cac0eaeb267d81cf3fa968ee23a6af9d
SHA1cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA5128edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b
