Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 06:23
Static task
static1
Behavioral task
behavioral1
Sample
fcf774c2e831fdb46309e8df7e951d86eec8e8956e28a49dda08e3a4fbb52804.msi
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
fcf774c2e831fdb46309e8df7e951d86eec8e8956e28a49dda08e3a4fbb52804.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
fcf774c2e831fdb46309e8df7e951d86eec8e8956e28a49dda08e3a4fbb52804.msi
-
Size
135.7MB
-
MD5
f251241df91698f6d87500b7ba697399
-
SHA1
0eeb66750d3cbded68ddd579d7c06b657158c829
-
SHA256
fcf774c2e831fdb46309e8df7e951d86eec8e8956e28a49dda08e3a4fbb52804
-
SHA512
3e3eb70d63b68a58c337ec8a94d340e2174806d69873c344fa9b68bba7a82f1c0f5c9bdafc036ddf141980ca4240eecd95592b463ee5e54f52d0af969bdd958e
-
SSDEEP
3145728:eUlSw/0KksfWneWVr6/4J3DYgxqmz8CZCLLUR6qxr7W3G9Ay:plSw/7ksOneWVm/CDYddLYHtKg
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1716-13125-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/1716-13133-0x0000000000400000-0x0000000001F58000-memory.dmp purplefox_rootkit behavioral2/memory/13576-26313-0x0000000000400000-0x0000000001F58000-memory.dmp purplefox_rootkit behavioral2/memory/9768-39405-0x0000000000400000-0x0000000001F58000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/1716-13125-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/1716-13133-0x0000000000400000-0x0000000001F58000-memory.dmp family_gh0strat behavioral2/memory/13576-26313-0x0000000000400000-0x0000000001F58000-memory.dmp family_gh0strat behavioral2/memory/9768-39405-0x0000000000400000-0x0000000001F58000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: Phxph.exe File opened (read-only) \??\G: Phxph.exe File opened (read-only) \??\K: Phxph.exe File opened (read-only) \??\X: Phxph.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: Phxph.exe File opened (read-only) \??\W: Phxph.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: Phxph.exe File opened (read-only) \??\U: Phxph.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: Phxph.exe File opened (read-only) \??\L: Phxph.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: Phxph.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: Phxph.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: Phxph.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: Phxph.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: Phxph.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: Phxph.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: Phxph.exe File opened (read-only) \??\N: Phxph.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: Phxph.exe File opened (read-only) \??\I: Phxph.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: Phxph.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Phxph.exe SoftUpdate.exe File opened for modification C:\Windows\SysWOW64\Phxph.exe SoftUpdate.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
pid Process 1716 SoftUpdate.exe 1716 SoftUpdate.exe 1716 SoftUpdate.exe 1716 SoftUpdate.exe 13576 Phxph.exe 13576 Phxph.exe 1716 SoftUpdate.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe -
Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA623.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIACEF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA905.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA877.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA8B6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{A3CE6828-13C4-4A4D-AE47-6BA43E771F33} msiexec.exe File created C:\Windows\Installer\e57a44e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIAB68.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD10.tmp msiexec.exe File opened for modification C:\Windows\Installer\e57a44e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA818.tmp msiexec.exe -
Executes dropped EXE 6 IoCs
pid Process 3252 MSIACEF.tmp 2444 MSIAD10.tmp 1716 SoftUpdate.exe 2928 YoudaoDict_fanyiweb_navigation.exe 13576 Phxph.exe 9768 Phxph.exe -
Loads dropped DLL 11 IoCs
pid Process 1772 MsiExec.exe 1772 MsiExec.exe 1772 MsiExec.exe 1772 MsiExec.exe 1772 MsiExec.exe 2928 YoudaoDict_fanyiweb_navigation.exe 2928 YoudaoDict_fanyiweb_navigation.exe 2928 YoudaoDict_fanyiweb_navigation.exe 2928 YoudaoDict_fanyiweb_navigation.exe 2928 YoudaoDict_fanyiweb_navigation.exe 2928 YoudaoDict_fanyiweb_navigation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 540 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_fanyiweb_navigation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Phxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIACEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIAD10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SoftUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 9784 cmd.exe 9680 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Phxph.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Phxph.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Phxph.exe Key created \REGISTRY\USER\.DEFAULT\Software Phxph.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Phxph.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Phxph.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Phxph.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 9680 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3512 msiexec.exe 3512 msiexec.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe 9768 Phxph.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 540 msiexec.exe Token: SeIncreaseQuotaPrivilege 540 msiexec.exe Token: SeSecurityPrivilege 3512 msiexec.exe Token: SeCreateTokenPrivilege 540 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 540 msiexec.exe Token: SeLockMemoryPrivilege 540 msiexec.exe Token: SeIncreaseQuotaPrivilege 540 msiexec.exe Token: SeMachineAccountPrivilege 540 msiexec.exe Token: SeTcbPrivilege 540 msiexec.exe Token: SeSecurityPrivilege 540 msiexec.exe Token: SeTakeOwnershipPrivilege 540 msiexec.exe Token: SeLoadDriverPrivilege 540 msiexec.exe Token: SeSystemProfilePrivilege 540 msiexec.exe Token: SeSystemtimePrivilege 540 msiexec.exe Token: SeProfSingleProcessPrivilege 540 msiexec.exe Token: SeIncBasePriorityPrivilege 540 msiexec.exe Token: SeCreatePagefilePrivilege 540 msiexec.exe Token: SeCreatePermanentPrivilege 540 msiexec.exe Token: SeBackupPrivilege 540 msiexec.exe Token: SeRestorePrivilege 540 msiexec.exe Token: SeShutdownPrivilege 540 msiexec.exe Token: SeDebugPrivilege 540 msiexec.exe Token: SeAuditPrivilege 540 msiexec.exe Token: SeSystemEnvironmentPrivilege 540 msiexec.exe Token: SeChangeNotifyPrivilege 540 msiexec.exe Token: SeRemoteShutdownPrivilege 540 msiexec.exe Token: SeUndockPrivilege 540 msiexec.exe Token: SeSyncAgentPrivilege 540 msiexec.exe Token: SeEnableDelegationPrivilege 540 msiexec.exe Token: SeManageVolumePrivilege 540 msiexec.exe Token: SeImpersonatePrivilege 540 msiexec.exe Token: SeCreateGlobalPrivilege 540 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeRestorePrivilege 3512 msiexec.exe Token: SeTakeOwnershipPrivilege 3512 msiexec.exe Token: SeIncBasePriorityPrivilege 1716 SoftUpdate.exe Token: 33 9768 Phxph.exe Token: SeIncBasePriorityPrivilege 9768 Phxph.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 540 msiexec.exe 540 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3512 wrote to memory of 1772 3512 msiexec.exe 85 PID 3512 wrote to memory of 1772 3512 msiexec.exe 85 PID 3512 wrote to memory of 1772 3512 msiexec.exe 85 PID 3512 wrote to memory of 3252 3512 msiexec.exe 86 PID 3512 wrote to memory of 3252 3512 msiexec.exe 86 PID 3512 wrote to memory of 3252 3512 msiexec.exe 86 PID 3512 wrote to memory of 2444 3512 msiexec.exe 87 PID 3512 wrote to memory of 2444 3512 msiexec.exe 87 PID 3512 wrote to memory of 2444 3512 msiexec.exe 87 PID 1716 wrote to memory of 9784 1716 SoftUpdate.exe 95 PID 1716 wrote to memory of 9784 1716 SoftUpdate.exe 95 PID 1716 wrote to memory of 9784 1716 SoftUpdate.exe 95 PID 13576 wrote to memory of 9768 13576 Phxph.exe 96 PID 13576 wrote to memory of 9768 13576 Phxph.exe 96 PID 13576 wrote to memory of 9768 13576 Phxph.exe 96 PID 9784 wrote to memory of 9680 9784 cmd.exe 98 PID 9784 wrote to memory of 9680 9784 cmd.exe 98 PID 9784 wrote to memory of 9680 9784 cmd.exe 98
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fcf774c2e831fdb46309e8df7e951d86eec8e8956e28a49dda08e3a4fbb52804.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:540
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E0FE525BD19962FD3F3AA25DEA07C00E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1772
-
-
C:\Windows\Installer\MSIACEF.tmp"C:\Windows\Installer\MSIACEF.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3252
-
-
C:\Windows\Installer\MSIAD10.tmp"C:\Windows\Installer\MSIAD10.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2928
-
C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:9784 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:9680
-
-
-
C:\Windows\SysWOW64\Phxph.exeC:\Windows\SysWOW64\Phxph.exe -auto1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:13576 -
C:\Windows\SysWOW64\Phxph.exeC:\Windows\SysWOW64\Phxph.exe -acsi2⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:9768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5cf71f1587fc52c73a702ca1a02e62ad3
SHA10c8857296bcf5d50f9a738b85772299987cc7847
SHA2560fb76079b74015a81d4b09642a6834771e0da835fc17d7ab4c8085d0146010fd
SHA5124b2469044a3fa883e90b92c60bf8542c6d77cb8391c2fd68dd6c20b05860222eabeb0190aa772680e8603370343e55243015f4db9aa35450f84fc3a9195a22e9
-
Filesize
27.3MB
MD5f9d4a4c93c769108a010dd8a1c7f3cdb
SHA1544448693eda94e35201ee220294250c4bbe9a51
SHA256fea7547e78ba91f0b72162ce9a4ec2f419446c57fa008fffe4c92eadc594aab0
SHA5121f362c032469027da4d7852315174cc4535cafc635790f8ef51ebbfaa84b46bfbe5abf6975c858e134d76995c6948fcc64113a9d5be51a2626dabd6bf7be14c3
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
908KB
MD53d3ec6392cf9a8b408569a3dd4cd3ce8
SHA195ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
419KB
MD5cac0eaeb267d81cf3fa968ee23a6af9d
SHA1cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA5128edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b
