Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe
Resource
win10v2004-20220812-en
General
-
Target
219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe
-
Size
92KB
-
MD5
618a15fadfe2ef431dca7b52bc354e2e
-
SHA1
e7cc28413baf7857ca3146e0b4befdb86c98d463
-
SHA256
219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
-
SHA512
3174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
SSDEEP
768:/SyCk0yiLw6K7njb5Vf0XghCF7RlH5sf1zBmQzTGfmgyq/4U:0kViCnoXghCF7PHWf1zwQVgv/F
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 53 IoCs
pid Process 2352 userinit.exe 5004 system.exe 5112 system.exe 1380 system.exe 2792 system.exe 2664 system.exe 1732 system.exe 1068 system.exe 1256 system.exe 4324 system.exe 4156 system.exe 1816 system.exe 212 system.exe 564 system.exe 4420 system.exe 2260 system.exe 968 system.exe 484 system.exe 2960 system.exe 8 system.exe 3756 system.exe 3096 system.exe 3060 system.exe 1148 system.exe 3176 system.exe 2556 system.exe 3336 system.exe 2928 system.exe 5036 system.exe 2088 system.exe 4892 system.exe 3880 system.exe 4316 system.exe 4736 system.exe 2572 system.exe 2956 system.exe 2812 system.exe 2600 system.exe 884 system.exe 1732 system.exe 2964 system.exe 3520 system.exe 1180 system.exe 2364 system.exe 5068 system.exe 3856 system.exe 832 system.exe 4592 system.exe 968 system.exe 384 system.exe 696 system.exe 5048 system.exe 612 system.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\userinit.exe 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe File opened for modification C:\Windows\userinit.exe 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe File created C:\Windows\kdcoms.dll userinit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 2352 userinit.exe 2352 userinit.exe 2352 userinit.exe 2352 userinit.exe 5004 system.exe 5004 system.exe 2352 userinit.exe 2352 userinit.exe 5112 system.exe 5112 system.exe 2352 userinit.exe 2352 userinit.exe 1380 system.exe 1380 system.exe 2352 userinit.exe 2352 userinit.exe 2792 system.exe 2792 system.exe 2352 userinit.exe 2352 userinit.exe 2664 system.exe 2664 system.exe 2352 userinit.exe 2352 userinit.exe 1732 system.exe 1732 system.exe 2352 userinit.exe 2352 userinit.exe 1068 system.exe 1068 system.exe 2352 userinit.exe 2352 userinit.exe 1256 system.exe 1256 system.exe 2352 userinit.exe 2352 userinit.exe 4324 system.exe 4324 system.exe 2352 userinit.exe 2352 userinit.exe 4156 system.exe 4156 system.exe 2352 userinit.exe 2352 userinit.exe 1816 system.exe 1816 system.exe 2352 userinit.exe 2352 userinit.exe 212 system.exe 212 system.exe 2352 userinit.exe 2352 userinit.exe 564 system.exe 564 system.exe 2352 userinit.exe 2352 userinit.exe 4420 system.exe 4420 system.exe 2352 userinit.exe 2352 userinit.exe 2260 system.exe 2260 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2352 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 2352 userinit.exe 2352 userinit.exe 5004 system.exe 5004 system.exe 5112 system.exe 5112 system.exe 1380 system.exe 1380 system.exe 2792 system.exe 2792 system.exe 2664 system.exe 2664 system.exe 1732 system.exe 1732 system.exe 1068 system.exe 1068 system.exe 1256 system.exe 1256 system.exe 4324 system.exe 4324 system.exe 4156 system.exe 4156 system.exe 1816 system.exe 1816 system.exe 212 system.exe 212 system.exe 564 system.exe 564 system.exe 4420 system.exe 4420 system.exe 2260 system.exe 2260 system.exe 968 system.exe 968 system.exe 484 system.exe 484 system.exe 2960 system.exe 2960 system.exe 8 system.exe 8 system.exe 3756 system.exe 3756 system.exe 3096 system.exe 3096 system.exe 3060 system.exe 3060 system.exe 1148 system.exe 1148 system.exe 3176 system.exe 3176 system.exe 2556 system.exe 2556 system.exe 3336 system.exe 3336 system.exe 2928 system.exe 2928 system.exe 5036 system.exe 5036 system.exe 2088 system.exe 2088 system.exe 4892 system.exe 4892 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2352 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 81 PID 2268 wrote to memory of 2352 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 81 PID 2268 wrote to memory of 2352 2268 219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe 81 PID 2352 wrote to memory of 5004 2352 userinit.exe 82 PID 2352 wrote to memory of 5004 2352 userinit.exe 82 PID 2352 wrote to memory of 5004 2352 userinit.exe 82 PID 2352 wrote to memory of 5112 2352 userinit.exe 83 PID 2352 wrote to memory of 5112 2352 userinit.exe 83 PID 2352 wrote to memory of 5112 2352 userinit.exe 83 PID 2352 wrote to memory of 1380 2352 userinit.exe 84 PID 2352 wrote to memory of 1380 2352 userinit.exe 84 PID 2352 wrote to memory of 1380 2352 userinit.exe 84 PID 2352 wrote to memory of 2792 2352 userinit.exe 85 PID 2352 wrote to memory of 2792 2352 userinit.exe 85 PID 2352 wrote to memory of 2792 2352 userinit.exe 85 PID 2352 wrote to memory of 2664 2352 userinit.exe 86 PID 2352 wrote to memory of 2664 2352 userinit.exe 86 PID 2352 wrote to memory of 2664 2352 userinit.exe 86 PID 2352 wrote to memory of 1732 2352 userinit.exe 87 PID 2352 wrote to memory of 1732 2352 userinit.exe 87 PID 2352 wrote to memory of 1732 2352 userinit.exe 87 PID 2352 wrote to memory of 1068 2352 userinit.exe 88 PID 2352 wrote to memory of 1068 2352 userinit.exe 88 PID 2352 wrote to memory of 1068 2352 userinit.exe 88 PID 2352 wrote to memory of 1256 2352 userinit.exe 89 PID 2352 wrote to memory of 1256 2352 userinit.exe 89 PID 2352 wrote to memory of 1256 2352 userinit.exe 89 PID 2352 wrote to memory of 4324 2352 userinit.exe 90 PID 2352 wrote to memory of 4324 2352 userinit.exe 90 PID 2352 wrote to memory of 4324 2352 userinit.exe 90 PID 2352 wrote to memory of 4156 2352 userinit.exe 91 PID 2352 wrote to memory of 4156 2352 userinit.exe 91 PID 2352 wrote to memory of 4156 2352 userinit.exe 91 PID 2352 wrote to memory of 1816 2352 userinit.exe 92 PID 2352 wrote to memory of 1816 2352 userinit.exe 92 PID 2352 wrote to memory of 1816 2352 userinit.exe 92 PID 2352 wrote to memory of 212 2352 userinit.exe 93 PID 2352 wrote to memory of 212 2352 userinit.exe 93 PID 2352 wrote to memory of 212 2352 userinit.exe 93 PID 2352 wrote to memory of 564 2352 userinit.exe 94 PID 2352 wrote to memory of 564 2352 userinit.exe 94 PID 2352 wrote to memory of 564 2352 userinit.exe 94 PID 2352 wrote to memory of 4420 2352 userinit.exe 95 PID 2352 wrote to memory of 4420 2352 userinit.exe 95 PID 2352 wrote to memory of 4420 2352 userinit.exe 95 PID 2352 wrote to memory of 2260 2352 userinit.exe 96 PID 2352 wrote to memory of 2260 2352 userinit.exe 96 PID 2352 wrote to memory of 2260 2352 userinit.exe 96 PID 2352 wrote to memory of 968 2352 userinit.exe 97 PID 2352 wrote to memory of 968 2352 userinit.exe 97 PID 2352 wrote to memory of 968 2352 userinit.exe 97 PID 2352 wrote to memory of 484 2352 userinit.exe 98 PID 2352 wrote to memory of 484 2352 userinit.exe 98 PID 2352 wrote to memory of 484 2352 userinit.exe 98 PID 2352 wrote to memory of 2960 2352 userinit.exe 99 PID 2352 wrote to memory of 2960 2352 userinit.exe 99 PID 2352 wrote to memory of 2960 2352 userinit.exe 99 PID 2352 wrote to memory of 8 2352 userinit.exe 100 PID 2352 wrote to memory of 8 2352 userinit.exe 100 PID 2352 wrote to memory of 8 2352 userinit.exe 100 PID 2352 wrote to memory of 3756 2352 userinit.exe 102 PID 2352 wrote to memory of 3756 2352 userinit.exe 102 PID 2352 wrote to memory of 3756 2352 userinit.exe 102 PID 2352 wrote to memory of 3096 2352 userinit.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe"C:\Users\Admin\AppData\Local\Temp\219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5004
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5112
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1380
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2792
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1256
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4324
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4156
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1816
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:212
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:564
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:484
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3756
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3096
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1148
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3176
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5036
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4892
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3880
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4316
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4736
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2572
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2956
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2812
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2600
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:884
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1732
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1180
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2364
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:5068
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:3856
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:832
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:4592
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:968
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:384
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:5048
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:612
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7
-
Filesize
92KB
MD5618a15fadfe2ef431dca7b52bc354e2e
SHA1e7cc28413baf7857ca3146e0b4befdb86c98d463
SHA256219f0e8d2eb4bd679968c4d88eacb24162f2c9eb707262bb1a2a80109a12a09a
SHA5123174507626ef851270cc913b712a8182906bdf4f98536f634355e403c77556a72f77a27302584a1332a0c504521dd682eb8bc65e2eaa80e06f69dab6aa6443a7