Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 21:26
Static task
static1
General
-
Target
2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
847b677750eee60cec9cbdb6dfcc9d51
-
SHA1
80a88edb43fad74b6d59d0abf0915c8d36e4fb64
-
SHA256
4e946a9fd2e4bbce1660691cbf3feb3fba76993119f913509603432e66cff0df
-
SHA512
9936cf231353fc738871031304df840ecdbf43482df5921514566d2c0fb9e64c3fd77b9f5dc91dd3b68e6eb4ce2b6f73deed9cc1dd7a3ab8db6e881010f445f0
-
SSDEEP
49152:8Qt30B3uA8EYHCree1uksbraFShGJ0Wkw:1t32u51HCri+sc
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.84
http://185.215.113.66
185.215.113.66
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000023c99-10.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 3164 created 3484 3164 2587115980.exe 56 PID 3164 created 3484 3164 2587115980.exe 56 PID 1972 created 3484 1972 winupsecvmgr.exe 56 PID 1972 created 3484 1972 winupsecvmgr.exe 56 PID 1972 created 3484 1972 winupsecvmgr.exe 56 -
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral1/memory/1972-87-0x00007FF6C79C0000-0x00007FF6C7F57000-memory.dmp xmrig behavioral1/memory/3932-98-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-101-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-103-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-105-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-107-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-109-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-111-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-114-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-116-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig behavioral1/memory/3932-118-0x00007FF6EEE40000-0x00007FF6EF62F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 307095305.exe -
Executes dropped EXE 11 IoCs
pid Process 1080 9B94.exe 4700 118414040.exe 5036 sysnldcvmr.exe 2548 307095305.exe 3088 2287025921.exe 3164 2587115980.exe 888 1241813818.exe 1972 winupsecvmgr.exe 1912 130071917.exe 4060 2992723296.exe 3500 3604416572.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" 118414040.exe -
pid Process 1864 powershell.exe 3352 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1972 set thread context of 4916 1972 winupsecvmgr.exe 121 PID 1972 set thread context of 3932 1972 winupsecvmgr.exe 122 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\sysnldcvmr.exe 118414040.exe File created C:\Windows\sysnldcvmr.exe 118414040.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241813818.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 130071917.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2992723296.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3604416572.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118414040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2287025921.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2548 307095305.exe 3164 2587115980.exe 3164 2587115980.exe 3352 powershell.exe 3352 powershell.exe 3164 2587115980.exe 3164 2587115980.exe 1972 winupsecvmgr.exe 1972 winupsecvmgr.exe 1864 powershell.exe 1864 powershell.exe 1972 winupsecvmgr.exe 1972 winupsecvmgr.exe 1972 winupsecvmgr.exe 1972 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2548 307095305.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeIncreaseQuotaPrivilege 3352 powershell.exe Token: SeSecurityPrivilege 3352 powershell.exe Token: SeTakeOwnershipPrivilege 3352 powershell.exe Token: SeLoadDriverPrivilege 3352 powershell.exe Token: SeSystemProfilePrivilege 3352 powershell.exe Token: SeSystemtimePrivilege 3352 powershell.exe Token: SeProfSingleProcessPrivilege 3352 powershell.exe Token: SeIncBasePriorityPrivilege 3352 powershell.exe Token: SeCreatePagefilePrivilege 3352 powershell.exe Token: SeBackupPrivilege 3352 powershell.exe Token: SeRestorePrivilege 3352 powershell.exe Token: SeShutdownPrivilege 3352 powershell.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeSystemEnvironmentPrivilege 3352 powershell.exe Token: SeRemoteShutdownPrivilege 3352 powershell.exe Token: SeUndockPrivilege 3352 powershell.exe Token: SeManageVolumePrivilege 3352 powershell.exe Token: 33 3352 powershell.exe Token: 34 3352 powershell.exe Token: 35 3352 powershell.exe Token: 36 3352 powershell.exe Token: SeIncreaseQuotaPrivilege 3352 powershell.exe Token: SeSecurityPrivilege 3352 powershell.exe Token: SeTakeOwnershipPrivilege 3352 powershell.exe Token: SeLoadDriverPrivilege 3352 powershell.exe Token: SeSystemProfilePrivilege 3352 powershell.exe Token: SeSystemtimePrivilege 3352 powershell.exe Token: SeProfSingleProcessPrivilege 3352 powershell.exe Token: SeIncBasePriorityPrivilege 3352 powershell.exe Token: SeCreatePagefilePrivilege 3352 powershell.exe Token: SeBackupPrivilege 3352 powershell.exe Token: SeRestorePrivilege 3352 powershell.exe Token: SeShutdownPrivilege 3352 powershell.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeSystemEnvironmentPrivilege 3352 powershell.exe Token: SeRemoteShutdownPrivilege 3352 powershell.exe Token: SeUndockPrivilege 3352 powershell.exe Token: SeManageVolumePrivilege 3352 powershell.exe Token: 33 3352 powershell.exe Token: 34 3352 powershell.exe Token: 35 3352 powershell.exe Token: 36 3352 powershell.exe Token: SeIncreaseQuotaPrivilege 3352 powershell.exe Token: SeSecurityPrivilege 3352 powershell.exe Token: SeTakeOwnershipPrivilege 3352 powershell.exe Token: SeLoadDriverPrivilege 3352 powershell.exe Token: SeSystemProfilePrivilege 3352 powershell.exe Token: SeSystemtimePrivilege 3352 powershell.exe Token: SeProfSingleProcessPrivilege 3352 powershell.exe Token: SeIncBasePriorityPrivilege 3352 powershell.exe Token: SeCreatePagefilePrivilege 3352 powershell.exe Token: SeBackupPrivilege 3352 powershell.exe Token: SeRestorePrivilege 3352 powershell.exe Token: SeShutdownPrivilege 3352 powershell.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeSystemEnvironmentPrivilege 3352 powershell.exe Token: SeRemoteShutdownPrivilege 3352 powershell.exe Token: SeUndockPrivilege 3352 powershell.exe Token: SeManageVolumePrivilege 3352 powershell.exe Token: 33 3352 powershell.exe Token: 34 3352 powershell.exe Token: 35 3352 powershell.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1080 5068 2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe 83 PID 5068 wrote to memory of 1080 5068 2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe 83 PID 5068 wrote to memory of 1080 5068 2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe 83 PID 1080 wrote to memory of 4700 1080 9B94.exe 87 PID 1080 wrote to memory of 4700 1080 9B94.exe 87 PID 1080 wrote to memory of 4700 1080 9B94.exe 87 PID 4700 wrote to memory of 5036 4700 118414040.exe 92 PID 4700 wrote to memory of 5036 4700 118414040.exe 92 PID 4700 wrote to memory of 5036 4700 118414040.exe 92 PID 5036 wrote to memory of 2548 5036 sysnldcvmr.exe 99 PID 5036 wrote to memory of 2548 5036 sysnldcvmr.exe 99 PID 2548 wrote to memory of 1828 2548 307095305.exe 100 PID 2548 wrote to memory of 1828 2548 307095305.exe 100 PID 2548 wrote to memory of 1044 2548 307095305.exe 102 PID 2548 wrote to memory of 1044 2548 307095305.exe 102 PID 1828 wrote to memory of 3908 1828 cmd.exe 104 PID 1828 wrote to memory of 3908 1828 cmd.exe 104 PID 1044 wrote to memory of 3940 1044 cmd.exe 105 PID 1044 wrote to memory of 3940 1044 cmd.exe 105 PID 5036 wrote to memory of 3088 5036 sysnldcvmr.exe 106 PID 5036 wrote to memory of 3088 5036 sysnldcvmr.exe 106 PID 5036 wrote to memory of 3088 5036 sysnldcvmr.exe 106 PID 3088 wrote to memory of 3164 3088 2287025921.exe 107 PID 3088 wrote to memory of 3164 3088 2287025921.exe 107 PID 5036 wrote to memory of 888 5036 sysnldcvmr.exe 108 PID 5036 wrote to memory of 888 5036 sysnldcvmr.exe 108 PID 5036 wrote to memory of 888 5036 sysnldcvmr.exe 108 PID 5036 wrote to memory of 1912 5036 sysnldcvmr.exe 118 PID 5036 wrote to memory of 1912 5036 sysnldcvmr.exe 118 PID 5036 wrote to memory of 1912 5036 sysnldcvmr.exe 118 PID 1972 wrote to memory of 4916 1972 winupsecvmgr.exe 121 PID 1972 wrote to memory of 3932 1972 winupsecvmgr.exe 122 PID 5036 wrote to memory of 4060 5036 sysnldcvmr.exe 124 PID 5036 wrote to memory of 4060 5036 sysnldcvmr.exe 124 PID 5036 wrote to memory of 4060 5036 sysnldcvmr.exe 124 PID 4060 wrote to memory of 3500 4060 2992723296.exe 125 PID 4060 wrote to memory of 3500 4060 2992723296.exe 125 PID 4060 wrote to memory of 3500 4060 2992723296.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_847b677750eee60cec9cbdb6dfcc9d51_cobalt-strike_ryuk.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9B94.exe"C:\Users\Admin\AppData\Local\Temp\9B94.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\118414040.exeC:\Users\Admin\AppData\Local\Temp\118414040.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\307095305.exeC:\Users\Admin\AppData\Local\Temp\307095305.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵PID:3908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵PID:3940
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2287025921.exeC:\Users\Admin\AppData\Local\Temp\2287025921.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\2587115980.exeC:\Users\Admin\AppData\Local\Temp\2587115980.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
-
C:\Users\Admin\AppData\Local\Temp\1241813818.exeC:\Users\Admin\AppData\Local\Temp\1241813818.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888
-
-
C:\Users\Admin\AppData\Local\Temp\130071917.exeC:\Users\Admin\AppData\Local\Temp\130071917.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\2992723296.exeC:\Users\Admin\AppData\Local\Temp\2992723296.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3604416572.exeC:\Users\Admin\AppData\Local\Temp\3604416572.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:2588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:4916
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵PID:3932
-
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD52ac3c9ba89b8c2ef19c601ecebb82157
SHA1a239a4b11438c00e5ff89ebd4a804ede6a01935b
SHA2563c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
SHA512b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
15KB
MD50c37ee292fec32dba0420e6c94224e28
SHA1012cbdddaddab319a4b3ae2968b42950e929c46b
SHA256981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1
SHA5122b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b
-
Filesize
49KB
MD5c38ea1b0838858f21ea572f60c69de0c
SHA1f5e34c47b0630056ba00df97641926f9579b384a
SHA256cae7ef69cce550af020bfc474c6e035882383b022d63e926c52bd8c3ad1d78e4
SHA512f9c55f31b9466c412711462322c167aadb72492d70fe5fe89ab5500b86eae8f42de29bc3e469b3f73eab9dd47061b51410d5bee444da0bad719c94c897c59d72
-
Filesize
10KB
MD596509ab828867d81c1693b614b22f41d
SHA1c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA256a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
SHA512ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
11KB
MD583a784716728ca579619d0e13a9f17b0
SHA15e33ca9dab3c0df2edcd597b8b0da06c88f18f6b
SHA2569dc0b007f33f768fff2249388428981d89cfcee3e5babd206bbaeb7d5cc34b4f
SHA512f8218a8e977f0ec340e7139041cfff8bac4cc23bcea0c0c0d7717ead76093d45d10acd72a5846486e9348ce642f529824f1575d0d28b8d2f566c543c7c9d3bc4
-
Filesize
8KB
MD5cb8420e681f68db1bad5ed24e7b22114
SHA1416fc65d538d3622f5ca71c667a11df88a927c31
SHA2565850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
SHA512baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
-
Filesize
20KB
MD52473392c0a773aad20da1519aa6f464b
SHA12068ffd843bb8c7c7749193f6d1c5f0a9b97b280
SHA2563d33e8778ea8194d486d42784411e8528c602594abdf3e32cdcee521a10f3ce7
SHA5125455866f5fc53ae48ff24222b40a264bf673102435abeac2a61ba6fcaa1de429d8f078d4d065cb5d77b96de87f343579651b718e0a60934fb9fa35818d948074
-
Filesize
10KB
MD508dafe3bb2654c06ead4bb33fb793df8
SHA1d1d93023f1085eed136c6d225d998abf2d5a5bf0
SHA256fc16c0bf09002c93723b8ab13595db5845a50a1b6a133237ac2d148b0bb41700
SHA5129cf2bd749a9ee6e093979bc0d3aacfba03ad6469c98ff3ef35ce5d1635a052e4068ac50431626f6ba8649361802f7fb2ffffb2b325e2795c54b7014180559c99
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82