Overview
overview
10Static
static
10Tear.exe
windows7-x64
10Tear.exe
windows10-2004-x64
10adochi.exe
windows7-x64
7adochi.exe
windows10-2004-x64
7autoit.exe
windows7-x64
10autoit.exe
windows10-2004-x64
6autoit2.exe
windows7-x64
10autoit2.exe
windows10-2004-x64
10autoit3.exe
windows7-x64
10autoit3.exe
windows10-2004-x64
10deviation.exe
windows7-x64
8deviation.exe
windows10-2004-x64
8encoder.exe
windows7-x64
10encoder.exe
windows10-2004-x64
10encoder2.exe
windows7-x64
9encoder2.exe
windows10-2004-x64
encoder3.exe
windows7-x64
10encoder3.exe
windows10-2004-x64
10encoder4.exe
windows7-x64
5encoder4.exe
windows10-2004-x64
5encoder5.exe
windows7-x64
10encoder5.exe
windows10-2004-x64
10erebus.exe
windows7-x64
9erebus.exe
windows10-2004-x64
7myxaha.exe
windows7-x64
7myxaha.exe
windows10-2004-x64
7$LOCALAPPD...er.exe
windows7-x64
7$LOCALAPPD...er.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 00:24
Behavioral task
behavioral1
Sample
Tear.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Tear.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
adochi.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
adochi.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
autoit.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
autoit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
autoit2.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
autoit2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
autoit3.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
autoit3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
deviation.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
deviation.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
encoder.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
encoder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
encoder2.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
encoder2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
encoder3.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
encoder3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
encoder4.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
encoder4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
encoder5.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
encoder5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
erebus.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
erebus.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
myxaha.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
myxaha.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$LOCALAPPDATA/ConduitInstaller.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
$LOCALAPPDATA/ConduitInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241023-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
Tear.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Malware Config
Extracted
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
Signatures
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (1019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Tear.exe -
Executes dropped EXE 1 IoCs
pid Process 764 WindowsUpdate.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsMedTile.scale-125.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_es-US.json Tear.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a_thumb.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_~_8wekyb3d8bbwe\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\th-TH\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Filter.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-lightunplated.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySplashScreen.png Tear.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png Tear.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-32_altform-unplated_contrast-black.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-150.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\SplashScreen.scale-100.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-colorize.png Tear.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\MediumTile.scale-125.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-100.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png Tear.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\DECRYPT_YOUR_FILES.HTML Tear.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-125.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-unplated_contrast-white.png Tear.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-100_contrast-white.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_contrast-white.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\km-KH\View3d\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxManifest.xml Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-black_scale-200.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\be-BY\View3d\3DViewerProductDescription-universal.xml Tear.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-fullcolor.png Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-125.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-60_altform-unplated.png Tear.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt Tear.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSplash.scale-100_contrast-black.png Tear.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\DECRYPT_YOUR_FILES.HTML Tear.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx Tear.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-125.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-150.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-white_scale-100.png Tear.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_25more_360x120_2x.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-200.png Tear.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml Tear.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrome.7z Tear.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DECRYPT_YOUR_FILES.HTML Tear.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png Tear.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\DECRYPT_YOUR_FILES.HTML Tear.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml Tear.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tear.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3092 Tear.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3092 Tear.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3092 wrote to memory of 764 3092 Tear.exe 95 PID 3092 wrote to memory of 764 3092 Tear.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tear.exe"C:\Users\Admin\AppData\Local\Temp\Tear.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
PID:764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54519c59858255be72bbae802382db664
SHA1d487a14a49c4a307c77f3d40d275a6dffc0b30e5
SHA2564e7aba93b2643f751fec8ede5d8cc664b91250ee3b8286b22825782098e0de79
SHA51253a301e1833572c9d7d5a8562397192fec2e98ee9cee84c38970b0fa0ab21efe6bf55b57bbd36ca1937b3b9b807d2e3088742110afd4148f677e07e0bb10a783
-
Filesize
160B
MD581872862d6f092b25d440c6559a80fb0
SHA11a98991739fb06232f407c1b56092aaed24d43b0
SHA2562d88cfceed2a232dcd0c511cccd433e835287b8503b02d74973c70bdeac9d467
SHA512953c658bb82c2f98b1b3f0b9c7df65fb48e8b5da937268014dd01f55a20fb016c31e9eb81522763b0c3b6f8c5b3c548a343c2c079471f17ea758971786343484
-
Filesize
192B
MD5bb670e849331c999857ca068263c3da2
SHA10fc9989c8ac0acd6476e18e66983e66551c7ea5c
SHA25601e1b1ed77ab8fa891c1c232d9f1d55ecb28175b33fa18ccb7f1673a4d418e18
SHA5128764bfcbdc8dab03f81444c8bf935c906479d46df322b57f7257a7897452d1f0c3731dcf7f3240fbbc2ba1dca272a92138fbe3d4a203c4c49bedb485d059e6e0
-
Filesize
192B
MD5da7f089483e67f2ee7f282ebbd28dbbe
SHA18251a8b0860b3a343e78aa8aa97d5efca64908a1
SHA2562e9bd40b4ae3877d74b43e93625c33e31b75449c9e0be2762c2bd0db29b2826d
SHA5122a9713c3fca60441cef019bea966ae6fc5d1a94826371e8e70c1db785ec15e855f9ce998a0e310b7cf2d1180e19c8eaf75362a0cbb19b9c54b888e1d408dbfdc
-
Filesize
1KB
MD5148d32e61f81d78bc2accfc7845506d4
SHA1567d7e3c7336423bc87f5e2a376f479ca100ef22
SHA256f37c28ea31c090da42ae123bc82bbc1dc8d8406c4ad4df8124039102e8a2c20e
SHA51269f5a16509574ca2bbd8321f48aef35440aed4d68e85b8dce8c661aabac87458734a14c5732df12c2d6557a05029d5e41fc67c340a8aa8a8faf4f212456d0d0f
-
Filesize
31KB
MD5dd2831902c3e2b2d8e575901d001abb1
SHA138bd4d4a37765105eb7c9a8d255cd750bad1158a
SHA25698a3aca26530ce744e22084281749449aac03ecfe1fca3207e6009f773cf3df8
SHA5120cc3e4554cc4fd58e4d8748458b8cd5e3ed63606e072ca7da629dedc72d752130d4ffdd45a3d1e1948db28185f49071f243d57956ac286fe2d83129ad6205c2b
-
Filesize
34KB
MD57e79a7e429430ad86703d8642314326d
SHA1e5f445e259bac1b82c232a607c96d176504a1457
SHA256fc6b756100484038df1b50de686a509286ba521121b192601feca183736a5aa5
SHA512b5638a68ca1995eeba7804e9f2291d215882d068841b92826bc88b93ea26140d595b7f8da0026fd3a6d035fc2ae1bfed7d68d4e7c1b9b23bebf9cb4567dc618a
-
Filesize
23KB
MD5c38c25ba6afd88716e82f1df21239b9c
SHA15fb3e6cd1389ce20e4c53cf770e7f53eddfaf98b
SHA25616671c0387d83bfe3fcb3ac15d15c115de07fc5096b4ad81e585e948ae15d628
SHA512d4d8acd594607517ef5447fcb703a93581479af8e923c3e82e51ab8bb1b07cff07d6c03b2cdd96c2e5259457fe62f3ba3cc4751b170a9d8c30b8782245c6ce83
-
Filesize
2KB
MD500e4c3097d42d56776147b08b2652d2a
SHA129d71359334db7a685d13526b1fdd5448b1b58ec
SHA256a9279bf09a58c9347fec3857d7a22e379f0c855d5c5a8d3964f78c49f99bce8f
SHA512672efb05cb6c026da489819189df8d2c84f60feb212b3f98b98ef7b57038dbb6d61cce91b1eb35a56c174357b581c403633658ec95add3865a0e02e2511b5008
-
Filesize
1KB
MD5e9c7562c348052ab36430b65f5439cda
SHA161e113a88ebf45c88120a1cf699944e413dad512
SHA2564c81c7aac9e3fce9386b91f9c4dcbab6a631b3e1f2264b9d78bfb97facd49bae
SHA51291873abd6eda0f9bd79ca74b9ff70ab89cedda9955665ba6bbc3c821e2f867fc0c5d4fbfa76b94f1fb2f36bc2b68a16aed716caa7b912ac26cb94b5953348f50
-
Filesize
3KB
MD50a072961e4a61f513b6782ce12fcab89
SHA1c28ee84d036320902e77d0ddd854e7185dc3936e
SHA256c61a30b5f11cad4427815a97d7b1a2ed45f82fe473d824184d450c8fd28f7afa
SHA512e8c941ea4e47c5ac3430aca5b6923a539df7a49958446b4aa6820786fcd5cc6baac2ac2aa646cc57d8e2b4d2fa8f9c11bc1ef02346ea691af0f1e9d971f1e00b
-
Filesize
2KB
MD5dc69ea4edf8e04f6eeb7da5da5891587
SHA1de4f348713c2202b97be4e00251e5abf7dcc1fb8
SHA25659f27686435a1b5edeb2398843e59c99031f90a08fd0eed626428683c5e773a4
SHA5122aec1a179bb9405706408e271c9a3d5a5868320b84962f867e44b96fd05786cabd0fd6efa3f38feac5d67fddaa51a744220788cfee392071a1bbc63952f96e6d
-
Filesize
5KB
MD55e2ea65dcf3632ab0dc32f377c9ccfab
SHA11d98e1026bd4ce930c8b2d60dff1cee0b510689d
SHA256a5d5c133bf705fbb30644fa4c8f72e2f4baf12a7f9db80a9447927fa38011a7e
SHA5125df6e23be64944fef6d7904d61407e6386ad363234055753d9791fce9c7ee6b57bf53e7f5c25c0fe8d21d2cdd9d91ca81ccc08bd596a6c3d22aebff5a37411df
-
Filesize
17KB
MD5be799fafed1952b4a94ec6e7c7cde672
SHA1c4d575e12b37eb16058f6f6f9f9b8af98c2a62f5
SHA2567e0000984ab314ec66212699d375c345e4cf039547a6ee06b7aac52930fc1ca9
SHA512e7c600217b7e89be9223cd6e555f52f8d541a9530056daff36da022f7163253b8b72947cf46f1653a5d55b830644852307329202e042f7f12079bf50c8ef7633
-
Filesize
320KB
MD5584fe83dc7b740ecb500164e9625a653
SHA118e1dd72b1e8d91aeced080f0ca47bd18a8947e3
SHA256db55412c0b9b697c1d5190d7b09a0c0bdac77d22e21ac02232738020d42b8ed2
SHA512f66960884369846e2bec62154844f0b1d749c180a5a626ef0c2b6bc83f6cf068e2a2ead0bed923c6abb513e0f435df8d289fae34a676f4ccce0651493f024303
-
Filesize
1KB
MD59480c8bc6f4e7538d0b01cf9de91891c
SHA1b7c8cae0ad48c6a7a83f725857da4d4bda8ba147
SHA2562e67592c9889530bda0fbd7900f01c23cca90f753b9af4108e18a6f3fcf3a026
SHA5127cd6bfca7a6367fd325270fd881fddd16da23816680932ba1d4e93ee9079f3ac2b76cae4403482fa66d38cfbeca45ff118058baed8b229dadf996d23d75e7907
-
Filesize
10KB
MD5cd117e1ab73f532515aba8bab95c3e68
SHA18a8a68d8602421560cc93a0b501391cbd4d40f39
SHA25626530d02e42c83505fda5ccea4ba0925908a08e74f608633fe750fc0cfa809c0
SHA5124ec57c98df5dc561d81323d505c3102230b12bbca540c4193a2b1342fd4346f9cbeaa5dd55bf520c61625dddd88d879072d494208bf3cb5f0f384f70866e3d9b
-
Filesize
3KB
MD5dff2da2c640a2ae3f844753cfd6ee716
SHA12ce65ba285c193b66885282697f04193d5632865
SHA256b3b5c8a631829eb688b5f825f0134493596d48f336d5193078cc7d0ec3401d31
SHA51280d748a4082d433120f9f271141d85f7b9f5666cc8abb360fb4142e4503bfe7f1d1c2a9664a43760ab3aaa8c6add72c49e8f97cb5f0ca3324153da90c52188b4
-
Filesize
176B
MD5bc12177e8a10626cba76a71ce271ca0c
SHA13ee50ba4c2e249e617604296488806730a48f52f
SHA256b69584fd07e34cbc93cba48f6d838d949e86dabdf6af440e801149254cccf997
SHA51296b9e87918dcaa09c21a023e584b7e5fc84914753b641efa645d8b28db5f7a2fb173fbe99fecbac2dfc583da551defb2848aa78a37b1aee90850ee2885520ae8
-
Filesize
1KB
MD55532c9097f84c782bac28d6e6f6e883f
SHA1b3bfad30d3b7536af06f9abf81e0c3128c1f05e2
SHA256f21be3f128a31e528fa86f51396275946a5fd4f5059e5a40d2238ffacd9e25ec
SHA512c4e7e7863d93df3cea9cf2424711234c40bfd89ff6843742c7b63d3503329c01262d119bb573ab2bdc0f8b81f6dc583f55edc5bf576f93dc5f2e95a48e0f5acd
-
Filesize
3KB
MD5fe2dfdb2e5d16529119cf5fe610f949d
SHA1eaee9741e103d23c407b797dd7bc5d0f52d28854
SHA2566a0824300ea8791e12e708d2f4bf18cb2b3a0bffe1289574a7d5e78af633a576
SHA512cfef25e9ae9960c3f24fbdf766d4f7feaca6fb1f78ad3d4605c4ca0d5daa73297bef05a8a1ab359e70d5cd85968bbfaa2dea0dd266cb4b19a0477606f2ec6410
-
Filesize
1KB
MD504a880934683de3791daf8ea273484b2
SHA1c7406528c2a11d2feced50bd3dbb0814c1b89215
SHA2567379bfc4bf7dbd94b5ee724e2b100d3e4cfe0f3dd5e4e8bd88cc0619dc2e461f
SHA5122a7ba11bbb5fb63e198ce9f360b42d5849a7bfdd011a7e453d3252d2373f0cc49bb43f49ed88da8682422da3babcb496c228d4863714be2a1cca977adf2f4dfd
-
Filesize
28KB
MD59ec01ec30b0bcc28a1d0d7bd77bd5803
SHA19519735810587da8bc774b9209e9438b313124fe
SHA256e2a02252adf018dc17b12e1e3b231b6c15544f2667d9cb6e3d94ceb3155f251a
SHA512398f27e4df350b13239cc29809523059a57171dc560087168db8d30b0d7eae3ba575e4d3815c8a6646293d4e53defa76c6b1564a638c2bb80d3a6253b517909e
-
Filesize
2KB
MD5c772aca4111655cac5c30071e0341176
SHA1f7a6cd6e33a1cf6af32285f0fdc08cd350b822e3
SHA2562606114ffeec0e0f1c8ce66ca572c67150731d9861571b47180d696c7e117c16
SHA512484b8cd23c329a3f43b323fd50be9d03343d5b27e76f089a21b150f1df44867a5fa831c4e16fb94cae2fd1c776d71aa3d7def529d4b13e234c00d7c8efb7d041
-
Filesize
1KB
MD53609ca6d3f16e23573c277eb02181fcc
SHA186caff32d95aa98d0f0d07d8de1f029e3777da9e
SHA25685a73fd6bf51d6235a08fea14845d743d90804955e22ff8af60d7f5f6e1ba756
SHA51255e81f675b5281668d8d7a310c7904759e8ba443aa44e4062e874b5d93f5395c591d605c0499eba0755bad7ced7507da32cdce7198fdbf45962a953f5601c7e5
-
Filesize
2KB
MD528270c1540b5a8095288a37fdafc5d91
SHA13dd58babca5859bd8ff31da74cebaa7ca608a276
SHA25673c56a77069ed8cf3f52e54e64bb5b79ac07c148de8e8949929edf632ead92b8
SHA512086c373ccb8e5e0c97b39afa14a7f4427e32ae0dfd1a31eded2a926730e3d7b08b81bc97111d95efa22718a702bcfc86770991d6a724595c9b15b924ea9dc115
-
Filesize
1KB
MD5f6c4c28e5548c32e0f39daf385743192
SHA15a9061172955547fa1bb4a4779f8bafec9d5cbab
SHA25609ebb3d68a41e794051174881a4ac6d831768d28e206f399fabd820634c7798a
SHA51275d2c2ea73500d29b31f612162181064f387997d309e1bd9145e0ba61fdb9146e4ee3d4c509334451772f0840224e375eff83e0f0c39ec5fab2358046c9ea5ab
-
Filesize
1KB
MD5f9867c26ba7361567a18a6735686b22c
SHA1dc6150d3d2ca5a6c60fbbd4233fe61b6e5fde039
SHA256523c4ebb9c3b68656a829126e78c0a4ad1712e55603fb69ca7d14492fe4dda08
SHA512c9e910bd5f1d5c70a7d64564215ca5728c51af079cbaac1f24e85db7fd51f438d6105663e3f57a0c654ee0d1024e55711957b9eb1a344c2138426400efbffca2
-
Filesize
1KB
MD50196078978d8d28c3f37bddd82d6a7dd
SHA19ef5eb4a3fb96d603206661ebbc6ad102f4eff01
SHA25601e5eec7d2c523ea4f66e8648ef5627552a14961a6ea86fc0a01dfb10d040a36
SHA5128db377272aad8cd5fb548d6bbd853398c905742e05066956a3d255e789eb956a50d1719d5b4f754c3ac22bd82d43bca60c56b8a380e63dd09827fb05d76e0cdd
-
Filesize
3KB
MD5d86f348506c1713a768038e1c6de52ae
SHA14757ba419cf535e0ac1a2f3c1594beaac555c7fb
SHA25605525244c297b34ac5cdce607e0ac5b248377c24f101fecadbd95450be7e5f11
SHA5122ca33132229ebd3bb6bf248608b3d0738f11ce060da5b5065055bd6f872f81325891ad96bb5386c75e0cb7a2a07913ec0878143ae8005b064b547e2bd1cb161d
-
Filesize
2KB
MD5d69c69653d5af7b546d24750b9039543
SHA11d824ff39f2095d9c547e567b54a51895ee49ff7
SHA256b3b2525e38bef49207687c8b5a5a958502cb6f16526a24e7364bc65230377cd6
SHA512ad774582c5abdb3849dd55bc8539ef87761cb262fa8093c7d4759f2ea67aef78652e13d72ffdaf1b5713c165cafdd8c70ad66868a25efa1118dfd901e15096fc
-
Filesize
6KB
MD5da1b842a7e4992bc4f09e80b2c38b935
SHA1d0284e41fd433a8d2d50df1e50fcf449db05e66b
SHA256b87bf86f20b70e09b7e5faa48b93fc8f2c6ad76819c04acecceecad9135feb67
SHA512c2571ac5e74d02a7543980d85bf55533a45e684c418899447a9dabb5d24d609b03fee032c357b7968edb5bc14c079eee23cd388016e1812768e06605bd4aefd3
-
Filesize
5KB
MD54bb177f7635410af8ba4f5f890379e26
SHA16e2692c95242fef8ed8e79ceb5c5313924af0fb5
SHA2563064f36169a5031ee4380080b1bb19e4149f673d3e038871acb31fb847e6f930
SHA5121a73c4862768f7f96d9d1c5f912331d0a3cea29d26b5539b11081cfee4b0e383c381ee19d2cacab0f4fc9750d1a9ace248c7b6702843e672c155dde699d8cd47
-
Filesize
3KB
MD51c2d522e5df31c9dd51cc26acf13fddd
SHA15b0bbfe9d4996e4ccc053d996bc596d2bf771c01
SHA2567c793170e58705a290dbb726283d5cc350e63a61db5c0cf3000c260fb569f43f
SHA512faa245d3b64cb2167be50df35536db03c410e19ec04c4c4e50f74968938cb2a5586d9ee3697b91d7da6a36b15353d27cb75496006a549b385ba9eb97ee341625
-
Filesize
2KB
MD59ac31788f1da58d7d4ff002b0546c0c5
SHA14fbdf7037bf29da474d528abf9da295e9c14c39f
SHA256a4a2d53919b3c5679bdfb10cd7ae036a55784d29cb18759e71cdc201b54320fa
SHA512fa827d2f257f7afd2ca2778946b6b4916c3195c09b3e1d61841f93e787ecaf2805cf00168893f754cf2ed951b298658c8ed78e56bad258510bda3dfc281224b8
-
Filesize
2KB
MD569f74014d65bba4b85631ebf799f8627
SHA1c92305b8362c067be92f8b98d8e16467b04edf62
SHA256b7319e2aa4e5d112f3eba9a6cdb0a6d908a08429ab695eeb95fadeffb4a4ce06
SHA5123e8ba309955559b97f46b6a4296d67ae969ea470b78aff93093d08467e0b39c01ec286b9187405759d0b7476c84d901a7e30987756894dd22b11888549f232c9
-
Filesize
1KB
MD529b82fe031d3b070aa3eec6cf373a8c3
SHA13b3abf0856c98ea717b7897d4ecd15b32a66b03e
SHA25671acde30277c72572666906bc0827f15a584ce3be14bca88d98231885dc85894
SHA512910645e58844bcd955c673fbcc03c260533a0adbede981738ae458c0afcadb1f0b4f897e1f0334a68a095a6e9514ee03956c41fdf49994b4ec51dfb4c31278a0
-
Filesize
1KB
MD505a8b706bd1295575d8e819e98bf549f
SHA1a0a5fbd236862af8b2d601208e4bd1e750e1e724
SHA256996a9db8226c683df98d9bc4bd476ba9014b35e953ec9419409fd8c8e39619e1
SHA5120202f722c091b3703424c586cea799dc7b2228147c18f0185a55ba8feb72aa04cb2acaa0b81f925f72fde0c1b35c6ed2c61b1b4997da2d066e16274545121ff7
-
Filesize
11KB
MD555c2d96fbf9ef3093175f45650903cca
SHA1df6ea8df8e7cf885f360f69fa696f1bb06a93aec
SHA2563b93d351ed13b2dfa7b07d388bb2cec2370724cf41f1cf399eff7b250a9e1998
SHA51208a2bc19ba710f40457578c7761b291db5cc2b3f88193bf8e8f51fdbdb57badfb20fb6d19a6e20b244b47a74466e902b36301ea40b9920b087b428f563d44a6e
-
Filesize
1KB
MD59a3a7160d554a52140d314e4980366c3
SHA1b1179c8e6585a310bf5a5e8a66d1f5c256682de3
SHA256347fffc031f878951c8fe182e1b5c506e8a367920641b4010c01dff99f7aa843
SHA5124c1c5ac376bcb3e4d5b8365310bd62def4ad5a13a95f9f0f38648e359c3bf19e8cb549091b176a95ac6ab2b33b5b97e2e132201e90bdb5b1ccf948778544183f
-
Filesize
2KB
MD534f6ab3e5abf4122235619247598e88f
SHA17c040e8961b120c9bcb97c2923b07b852f4b2c9d
SHA256f8832f2f18c1d421f7cc79d46c7a9da9ea216149adf937ec945dd89c2bf78b21
SHA51253b203ad5e3fe79522507fbf597746e7620c46b1a2164722ee79931e888440de4680abcb9f1392b09dccee8284dfd69c01ad274980d9f1239ff3956e079450f2
-
Filesize
11KB
MD5cbfd911138b012d3400e52c0f169f38b
SHA14d827c36b5d4611a96167b98fb5ec39f28e6d797
SHA256ca7f19c153bf30e20e31e73edcd479b812744ea1966f605f25b5de498ebb931e
SHA51230b5b243bcc454dce57e5d5e8dd47af3190f1e4eb78d7363596c7f59340197a00ee95294535d79d7707db1d10ca3a60fd4034b742cc0c87893271b7e6e179f44
-
Filesize
11KB
MD5728d375043c5636cf0095cddd0917b52
SHA1e65e663512111470bab2e1b1b5222f3d9ac7dc94
SHA2563eea677361dc999863a7bc8f6d9a3ca79ad5586793d66991ebdfcc4b7ddb2544
SHA512caa3a3efade0daefc9aa649c021e26d5d80f4f7cd370c46cdc468794c1eb1c499db2fa409fe107c433b80450a742d0e7fcf5cec390ce9324748c740663d2955d
-
Filesize
11KB
MD5b463eaa11b69e0804197c493325d8123
SHA16428ca01f16caf5f1ecce516a37382108547867e
SHA25602f955485b8d559a98a1a033b436db73c230bbc49dea0dcc49aceff09b2bae13
SHA512961f189249c3e4678657e8887581106b9424dbed7ea2ec0544965bf8f83255af710875215f1b93cb4a849faf03c186bad9b6d4b435203c9ed3c32343625f4da3
-
Filesize
1024B
MD5ba41a96e25648d1123a0f958f48b7996
SHA1ab1cd534a479f3f333330605b8d48f07a423746e
SHA2566b1b3a2efedf492f0221bb7afb262796f2bf810bf84a82d797cc2a0e41da022d
SHA512372a988d58824e8ae2da29492e3f858a4da21b341372950df087ea59fc4a8ebad48f0e14b51bd51e5bec0d41ff537804f5dccab888ec4d06bb317b93afb4f189
-
Filesize
48B
MD5fe3d7373bcd52259a6942efbe9457c25
SHA118a193b38cfb94d58ebf8d0b98e6fdc0b21408eb
SHA2562d83c27e45c60113e789abb0606f87e5c840bdf73e26d45b5d1943ae10930d3b
SHA512e0ecb9d8039aee7f72413b061187ed81688cb1865df50a7de9a3cc8efbb74571585ab96f7712047151ed67211c48e78c3fd272be049e0dbf267b9bed96bfc543
-
Filesize
21KB
MD5fec89e9d2784b4c015fed6f5ae558e08
SHA1581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2
SHA256489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
SHA512e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24