Analysis
-
max time kernel
236s -
max time network
249s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe
Resource
win10v2004-20221111-en
General
-
Target
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe
-
Size
1.5MB
-
MD5
88d379f82097fdb50c0b9a55fdb9e2f5
-
SHA1
b8eccb9bbc517e6c13a7331fbf87b1b39cf2f477
-
SHA256
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608
-
SHA512
38d7a88e2c68adc9e3968e781a51b1a9aa8249fdf6df53129bc82c104b77c1169852b545dc6c9a47855507487e5fd41c34c3a2f7b0510e4ac8c0589102337f6e
-
SSDEEP
49152:mcYTuIXq4/kdbS3/eE0XgvRt8eNZmeifNq4t:mXiEK8xggvhNZmeifNV
Malware Config
Signatures
-
Executes dropped EXE 12 IoCs
Processes:
FB_4E6F.tmp.exeFB_5237.tmp.exeFB_5286.tmp.exeFB_4E6F.tmp.exeFB_5286.tmp.exedefragsvc.exeWindows Update.exeAppReadiness.exeWindows Update.exeAppReadiness.exedefragsvc.exedefragsvc.exepid process 1792 FB_4E6F.tmp.exe 1012 FB_5237.tmp.exe 1724 FB_5286.tmp.exe 1548 FB_4E6F.tmp.exe 960 FB_5286.tmp.exe 1092 defragsvc.exe 1760 Windows Update.exe 1992 AppReadiness.exe 292 Windows Update.exe 1572 AppReadiness.exe 752 defragsvc.exe 1384 defragsvc.exe -
Processes:
resource yara_rule behavioral1/memory/1644-109-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Loads dropped DLL 13 IoCs
Processes:
AppLaunch.exeFB_4E6F.tmp.exeFB_5237.tmp.exeFB_5286.tmp.exeFB_5286.tmp.exedefragsvc.exeWindows Update.exeAppReadiness.exepid process 1000 AppLaunch.exe 1000 AppLaunch.exe 1000 AppLaunch.exe 1792 FB_4E6F.tmp.exe 1012 FB_5237.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 960 FB_5286.tmp.exe 1092 defragsvc.exe 1760 Windows Update.exe 1992 AppReadiness.exe 1760 Windows Update.exe 1992 AppReadiness.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
FB_4E6F.tmp.exedefragsvc.exedefragsvc.exedefragsvc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Default NKey = "C:\\Users\\Admin\\AppData\\Roaming\\Default NFolder\\Default File.exe" FB_4E6F.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Readiness = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\defragsvc.exe" defragsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Readiness = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\defragsvc.exe" defragsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Readiness = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\defragsvc.exe" defragsvc.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exeFB_4E6F.tmp.exeFB_5286.tmp.exeWindows Update.exeAppReadiness.exedescription pid process target process PID 968 set thread context of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 1792 set thread context of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1724 set thread context of 960 1724 FB_5286.tmp.exe FB_5286.tmp.exe PID 1760 set thread context of 292 1760 Windows Update.exe Windows Update.exe PID 1992 set thread context of 1572 1992 AppReadiness.exe AppReadiness.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
FB_5286.tmp.exedefragsvc.exepid process 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe 1092 defragsvc.exe 1724 FB_5286.tmp.exe 1724 FB_5286.tmp.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exeFB_4E6F.tmp.exeFB_5237.tmp.exeFB_5286.tmp.exeFB_4E6F.tmp.exedefragsvc.exeWindows Update.exeAppReadiness.exedefragsvc.exedefragsvc.exedescription pid process Token: SeDebugPrivilege 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe Token: SeDebugPrivilege 1792 FB_4E6F.tmp.exe Token: SeDebugPrivilege 1012 FB_5237.tmp.exe Token: SeDebugPrivilege 1724 FB_5286.tmp.exe Token: SeDebugPrivilege 1548 FB_4E6F.tmp.exe Token: SeDebugPrivilege 1092 defragsvc.exe Token: SeDebugPrivilege 1760 Windows Update.exe Token: SeDebugPrivilege 1992 AppReadiness.exe Token: SeDebugPrivilege 1384 defragsvc.exe Token: SeDebugPrivilege 752 defragsvc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exeFB_4E6F.tmp.exepid process 868 AcroRd32.exe 868 AcroRd32.exe 868 AcroRd32.exe 1548 FB_4E6F.tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exeAppLaunch.exeFB_4E6F.tmp.exeFB_5237.tmp.exeFB_5286.tmp.exedescription pid process target process PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 968 wrote to memory of 1000 968 49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe AppLaunch.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1792 1000 AppLaunch.exe FB_4E6F.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1012 1000 AppLaunch.exe FB_5237.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 1724 1000 AppLaunch.exe FB_5286.tmp.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1000 wrote to memory of 868 1000 AppLaunch.exe AcroRd32.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1792 wrote to memory of 1548 1792 FB_4E6F.tmp.exe FB_4E6F.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1012 wrote to memory of 1644 1012 FB_5237.tmp.exe FB_5237.tmp.exe PID 1724 wrote to memory of 960 1724 FB_5286.tmp.exe FB_5286.tmp.exe PID 1724 wrote to memory of 960 1724 FB_5286.tmp.exe FB_5286.tmp.exe PID 1724 wrote to memory of 960 1724 FB_5286.tmp.exe FB_5286.tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe"C:\Users\Admin\AppData\Local\Temp\49e147f16a5b0a8fb2230b87320f79256bcd74867fd0ef6f58db56bd4b63d608.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\FB_4E6F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_4E6F.tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\FB_4E6F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_4E6F.tmp.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
-
C:\Users\Admin\AppData\Local\Temp\FB_5237.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_5237.tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\FB_5237.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_5237.tmp.exe"4⤵PID:1644
-
-
-
C:\Users\Admin\AppData\Local\Temp\FB_5286.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_5286.tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\FB_5286.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_5286.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"6⤵
- Executes dropped EXE
PID:292
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092 -
C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exeC:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1992 -
C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AppReadiness.exe"6⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\defragsvc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FB_5342.tmp.pdf"3⤵
- Suspicious use of SetWindowsHookEx
PID:868
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD5e70554626613b71cad3ee25fedc14860
SHA144a6ee6a6fa305f6361e9c22bd81b65b7c73d029
SHA256d1a69a078b42b37ca36b10a42004a1c24772eec70b2c81e99e29b7c8fe64d2c8
SHA512a7db08e98daa5bd0d9c520736ce24bf43ad77818f16cdbe8f99d50f5bb8d26499a08fcd0e164121ce96c84518c2aea01027e685c6688f37f5ed91edf08465f86
-
Filesize
375KB
MD5e70554626613b71cad3ee25fedc14860
SHA144a6ee6a6fa305f6361e9c22bd81b65b7c73d029
SHA256d1a69a078b42b37ca36b10a42004a1c24772eec70b2c81e99e29b7c8fe64d2c8
SHA512a7db08e98daa5bd0d9c520736ce24bf43ad77818f16cdbe8f99d50f5bb8d26499a08fcd0e164121ce96c84518c2aea01027e685c6688f37f5ed91edf08465f86
-
Filesize
375KB
MD5e70554626613b71cad3ee25fedc14860
SHA144a6ee6a6fa305f6361e9c22bd81b65b7c73d029
SHA256d1a69a078b42b37ca36b10a42004a1c24772eec70b2c81e99e29b7c8fe64d2c8
SHA512a7db08e98daa5bd0d9c520736ce24bf43ad77818f16cdbe8f99d50f5bb8d26499a08fcd0e164121ce96c84518c2aea01027e685c6688f37f5ed91edf08465f86
-
Filesize
133KB
MD5510be7b2655743c1816d28cf348f0605
SHA1ee71ce07ed98a82c4d2b9dac1e7f1c6dabe06456
SHA256a1fd1f4c66a5c748a43bf8aa670850ff0a4ec5941e6f91e1140b4c021ff259de
SHA512c5714a24caac7870042fb8ac113eb4d8a9f71b1db43b47f9695a0274b5f8a4964225903d05b0e93738c4f1ba51928cd85b9585311b0ea74279e7d47664a10271
-
Filesize
133KB
MD5510be7b2655743c1816d28cf348f0605
SHA1ee71ce07ed98a82c4d2b9dac1e7f1c6dabe06456
SHA256a1fd1f4c66a5c748a43bf8aa670850ff0a4ec5941e6f91e1140b4c021ff259de
SHA512c5714a24caac7870042fb8ac113eb4d8a9f71b1db43b47f9695a0274b5f8a4964225903d05b0e93738c4f1ba51928cd85b9585311b0ea74279e7d47664a10271
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
19KB
MD578ce19a2ec6b1d5045b26600cdde2ba2
SHA1f600c7449d0f843de4941b77971af731f11a8976
SHA256ba1768f6bd4e00591e88f94709ff7b97b1d9961dd2daa9be1431a945e6506f36
SHA512d071d196948586818e31de11b7b507f792649180b6c521569fbf85bea9d683dac48cea98a9abda95ef921e3872154b63e5cb05891801d42d4fcc81cdc0a7d4f7
-
Filesize
49B
MD568a78e98586e1853e403099b8af253e6
SHA1976feaf9d7d616c34d68d812b99cef5c2d61ce7c
SHA2563f8994a79c4db93cc85d9b5506caf8c647f690c264cfdb422d84caa55e6f0f48
SHA512f2cc9fb8885460351da9fc0ecaa71143e1ac64e33f7d2fbff37f841af9b5ee35530e6fb969b6d75332cfb90438431d17c320d694a6d8612c89a06ef3ffacfb2f
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
3B
MD51700002963a49da13542e0726b7bb758
SHA185f1002bf139bebdb7f0d07b31fa14155aea9dfc
SHA2566db6eb4af1e18ab81d3878e44672185d60ca8c988c9e2f7783de220735534c33
SHA5121f19f7072894a3c0f75b2be57fc630c8867de91e79487725b7884d9373c28d0da128481dc3a2a908b066b004c0f0deb401dd0aabb342a5f873bcde0479308f02
-
Filesize
375KB
MD5e70554626613b71cad3ee25fedc14860
SHA144a6ee6a6fa305f6361e9c22bd81b65b7c73d029
SHA256d1a69a078b42b37ca36b10a42004a1c24772eec70b2c81e99e29b7c8fe64d2c8
SHA512a7db08e98daa5bd0d9c520736ce24bf43ad77818f16cdbe8f99d50f5bb8d26499a08fcd0e164121ce96c84518c2aea01027e685c6688f37f5ed91edf08465f86
-
Filesize
375KB
MD5e70554626613b71cad3ee25fedc14860
SHA144a6ee6a6fa305f6361e9c22bd81b65b7c73d029
SHA256d1a69a078b42b37ca36b10a42004a1c24772eec70b2c81e99e29b7c8fe64d2c8
SHA512a7db08e98daa5bd0d9c520736ce24bf43ad77818f16cdbe8f99d50f5bb8d26499a08fcd0e164121ce96c84518c2aea01027e685c6688f37f5ed91edf08465f86
-
Filesize
133KB
MD5510be7b2655743c1816d28cf348f0605
SHA1ee71ce07ed98a82c4d2b9dac1e7f1c6dabe06456
SHA256a1fd1f4c66a5c748a43bf8aa670850ff0a4ec5941e6f91e1140b4c021ff259de
SHA512c5714a24caac7870042fb8ac113eb4d8a9f71b1db43b47f9695a0274b5f8a4964225903d05b0e93738c4f1ba51928cd85b9585311b0ea74279e7d47664a10271
-
Filesize
133KB
MD5510be7b2655743c1816d28cf348f0605
SHA1ee71ce07ed98a82c4d2b9dac1e7f1c6dabe06456
SHA256a1fd1f4c66a5c748a43bf8aa670850ff0a4ec5941e6f91e1140b4c021ff259de
SHA512c5714a24caac7870042fb8ac113eb4d8a9f71b1db43b47f9695a0274b5f8a4964225903d05b0e93738c4f1ba51928cd85b9585311b0ea74279e7d47664a10271
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
13KB
MD50ee04e685f30e70d9b35231493837faa
SHA180b193cf85321e106c0030e17f914c6ca14f52d6
SHA256d9d2cc7216825ca9b1a3056d1c812455fe5c105145ed8185568177b9c66cabf6
SHA512ef7b5de373a237e9e2d5e92612d7468a4498464c0c914bd2c03ba0a7a8eba8f8afec6507a1d71e596d8a83b41cdf8ae7d27d8f5a95fce344ab9c9364405ea494
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e
-
Filesize
897KB
MD52a7379159a848b79c2c572eb10111c90
SHA1386edeaa78a8610ffc84b267c6f11cb66d13914d
SHA256214cd649809bb59f310824dc79062b6da45f630063e9c81bea70d87de55eebe0
SHA512480e34086e1d99bffebebc51537f3964366fbec49ab387eba9cb36507661ffe3d111c182a1e1e5c980a3df187ba26b2714f551ba5e4387bca567bbd3d5673f3e