Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
221s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 20:58
Behavioral task
behavioral1
Sample
b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe
Resource
win10v2004-20220812-en
General
-
Target
b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe
-
Size
9.2MB
-
MD5
797dd4c605af40a0fb1353f4b3c22d67
-
SHA1
256f9136ef8ad4fe4b09ad84e3e42ff580d0b7d3
-
SHA256
b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce
-
SHA512
cea6fcd301d8cbc13d3483068c57423f5c15babd5ddc8b12667b8c4e5f634d4b9bc6b18b250ed6d7850d9e103b643addd22a5638ccfe4792c830c9cf2814f080
-
SSDEEP
24576:wDyTFtjTDyTFtjtDyTFtjSDyTFtjwDyTFtjTDyTFtjtDyTFtjSDyTFtjKDyTFtj7:JtotGtztFtotGtztztotGtzt
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1292 tmp7152957.exe 864 tmp7156140.exe 1708 tmp7168308.exe 924 tmp7168589.exe 560 tmp7168994.exe 1620 tmp7172145.exe 516 notpad.exe 520 tmp7190616.exe 1924 tmp7192800.exe 1668 notpad.exe 1644 tmp7193642.exe 584 notpad.exe 1652 tmp7194906.exe 752 tmp7195280.exe 984 tmp7195639.exe 1572 tmp7196138.exe 1976 notpad.exe 1356 tmp7195795.exe 1096 tmp7196762.exe 1108 tmp7198026.exe 2012 notpad.exe 1136 tmp7198338.exe 1304 notpad.exe 1540 tmp7198525.exe 1712 tmp7216200.exe 1292 tmp7216762.exe 1672 tmp7246730.exe 1368 tmp7244374.exe 1844 notpad.exe 1256 tmp7251316.exe 1560 tmp7251347.exe 1380 tmp7254452.exe 668 notpad.exe 960 tmp7251831.exe 2008 tmp7252002.exe 1512 tmp7252299.exe 288 notpad.exe 944 notpad.exe 1776 tmp7255622.exe 752 tmp7252658.exe 1320 notpad.exe 1268 tmp7252845.exe 1936 tmp7253188.exe 1708 tmp7252892.exe 1452 notpad.exe 1496 tmp7253032.exe 1756 notpad.exe 580 tmp7253453.exe 1952 notpad.exe 1028 tmp7253718.exe 1716 tmp7253469.exe 1280 tmp7253828.exe 2028 tmp7253859.exe 1292 tmp7253968.exe 880 tmp7254077.exe 1712 tmp7254046.exe 516 notpad.exe 332 tmp7254374.exe 624 tmp7254218.exe 1380 tmp7254452.exe 876 tmp7254545.exe 1140 tmp7254576.exe 800 tmp7255263.exe 1596 tmp7254920.exe -
resource yara_rule behavioral1/memory/1420-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0009000000012758-60.dat upx behavioral1/memory/1420-65-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0009000000012758-64.dat upx behavioral1/files/0x0009000000012758-63.dat upx behavioral1/files/0x0009000000012758-61.dat upx behavioral1/memory/924-78-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000133e6-77.dat upx behavioral1/memory/864-76-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000133e6-75.dat upx behavioral1/files/0x00070000000133e6-73.dat upx behavioral1/files/0x00070000000133e6-72.dat upx behavioral1/files/0x0008000000013494-83.dat upx behavioral1/memory/1292-86-0x0000000002630000-0x000000000264F000-memory.dmp upx behavioral1/memory/924-89-0x0000000000220000-0x0000000000242000-memory.dmp upx behavioral1/memory/924-91-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0008000000013494-95.dat upx behavioral1/files/0x0008000000013494-93.dat upx behavioral1/files/0x0008000000013494-97.dat upx behavioral1/memory/516-100-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/516-109-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000133dd-110.dat upx behavioral1/files/0x0009000000013494-114.dat upx behavioral1/files/0x0009000000013494-117.dat upx behavioral1/files/0x0009000000013494-118.dat upx behavioral1/files/0x0009000000013494-115.dat upx behavioral1/memory/1668-119-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000133dd-125.dat upx behavioral1/files/0x0009000000013494-128.dat upx behavioral1/files/0x0009000000013494-131.dat upx behavioral1/files/0x0009000000013494-129.dat upx behavioral1/files/0x0006000000014159-136.dat upx behavioral1/files/0x0006000000014159-135.dat upx behavioral1/memory/1668-137-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1652-147-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/584-146-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000133dd-143.dat upx behavioral1/memory/1652-155-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0009000000013494-156.dat upx behavioral1/memory/1976-162-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/584-161-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0006000000014159-133.dat upx behavioral1/files/0x0006000000014159-132.dat upx behavioral1/memory/1356-163-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1356-167-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2012-172-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2012-175-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1540-176-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1304-177-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1540-178-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1540-184-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1304-187-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1368-195-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1844-198-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/960-206-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/288-210-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/668-209-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1776-211-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1776-218-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/288-222-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1708-238-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1452-244-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1952-249-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/516-248-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Loads dropped DLL 64 IoCs
pid Process 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 864 tmp7156140.exe 864 tmp7156140.exe 864 tmp7156140.exe 864 tmp7156140.exe 924 tmp7168589.exe 924 tmp7168589.exe 1292 tmp7152957.exe 924 tmp7168589.exe 924 tmp7168589.exe 1292 tmp7152957.exe 1092 WerFault.exe 1092 WerFault.exe 516 notpad.exe 516 notpad.exe 516 notpad.exe 520 tmp7190616.exe 520 tmp7190616.exe 1668 notpad.exe 1668 notpad.exe 1644 tmp7193642.exe 1644 tmp7193642.exe 1668 notpad.exe 1668 notpad.exe 584 notpad.exe 584 notpad.exe 1652 tmp7194906.exe 1652 tmp7194906.exe 1652 tmp7194906.exe 752 tmp7195280.exe 584 notpad.exe 584 notpad.exe 752 tmp7195280.exe 1356 tmp7195795.exe 1356 tmp7195795.exe 1356 tmp7195795.exe 1096 tmp7196762.exe 1096 tmp7196762.exe 1092 WerFault.exe 2012 notpad.exe 2012 notpad.exe 1136 tmp7198338.exe 1136 tmp7198338.exe 2012 notpad.exe 2012 notpad.exe 1304 notpad.exe 1304 notpad.exe 1540 tmp7198525.exe 1540 tmp7198525.exe 1540 tmp7198525.exe 1304 notpad.exe 1304 notpad.exe 1712 tmp7254046.exe 1712 tmp7254046.exe 1368 tmp7244374.exe 1368 tmp7244374.exe 1844 notpad.exe 1844 notpad.exe 1368 tmp7244374.exe 1256 tmp7251316.exe 1256 tmp7251316.exe -
Drops file in System32 directory 58 IoCs
description ioc Process File created C:\Windows\SysWOW64\notpad.exe- tmp7255622.exe File created C:\Windows\SysWOW64\notpad.exe tmp7256246.exe File created C:\Windows\SysWOW64\notpad.exe tmp7252002.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7190616.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7190616.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7195280.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7195280.exe File created C:\Windows\SysWOW64\notpad.exe tmp7252658.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7254545.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7254920.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7152957.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7193642.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7196762.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7253469.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7255856.exe File created C:\Windows\SysWOW64\notpad.exe tmp7190616.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7251316.exe File created C:\Windows\SysWOW64\notpad.exe tmp7195280.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7198338.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7196762.exe File created C:\Windows\SysWOW64\notpad.exe tmp7193642.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7216200.exe File created C:\Windows\SysWOW64\notpad.exe tmp7253032.exe File created C:\Windows\SysWOW64\notpad.exe tmp7196762.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7252845.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7253469.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7254920.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7256246.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7216200.exe File created C:\Windows\SysWOW64\notpad.exe tmp7254545.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7253032.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7193642.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7253032.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7152957.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7251316.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7252002.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7253453.exe File created C:\Windows\SysWOW64\notpad.exe tmp7253469.exe File created C:\Windows\SysWOW64\notpad.exe tmp7216200.exe File created C:\Windows\SysWOW64\notpad.exe tmp7198338.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7252002.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7252658.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7252658.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7253453.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7256246.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7198338.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7254545.exe File created C:\Windows\SysWOW64\notpad.exe tmp7254920.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7255622.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7252845.exe File created C:\Windows\SysWOW64\notpad.exe tmp7255856.exe File created C:\Windows\SysWOW64\notpad.exe tmp7252845.exe File created C:\Windows\SysWOW64\notpad.exe tmp7253453.exe File created C:\Windows\SysWOW64\notpad.exe tmp7152957.exe File created C:\Windows\SysWOW64\notpad.exe tmp7251316.exe File created C:\Windows\SysWOW64\notpad.exe tmp7255622.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7255856.exe File created C:\Windows\SysWOW64\fsb.tmp tmp7152957.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1092 1620 WerFault.exe 34 -
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7152957.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7252002.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7253469.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7251316.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7252845.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7255856.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7256246.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7195280.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7196762.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7198338.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7216200.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7252658.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7253032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7253453.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7254920.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7190616.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7193642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7254545.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7255622.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1292 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 28 PID 1420 wrote to memory of 1292 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 28 PID 1420 wrote to memory of 1292 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 28 PID 1420 wrote to memory of 1292 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 28 PID 1420 wrote to memory of 864 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 29 PID 1420 wrote to memory of 864 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 29 PID 1420 wrote to memory of 864 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 29 PID 1420 wrote to memory of 864 1420 b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe 29 PID 864 wrote to memory of 1708 864 tmp7156140.exe 30 PID 864 wrote to memory of 1708 864 tmp7156140.exe 30 PID 864 wrote to memory of 1708 864 tmp7156140.exe 30 PID 864 wrote to memory of 1708 864 tmp7156140.exe 30 PID 864 wrote to memory of 924 864 tmp7156140.exe 31 PID 864 wrote to memory of 924 864 tmp7156140.exe 31 PID 864 wrote to memory of 924 864 tmp7156140.exe 31 PID 864 wrote to memory of 924 864 tmp7156140.exe 31 PID 924 wrote to memory of 560 924 tmp7168589.exe 32 PID 924 wrote to memory of 560 924 tmp7168589.exe 32 PID 924 wrote to memory of 560 924 tmp7168589.exe 32 PID 924 wrote to memory of 560 924 tmp7168589.exe 32 PID 924 wrote to memory of 1620 924 tmp7168589.exe 34 PID 924 wrote to memory of 1620 924 tmp7168589.exe 34 PID 924 wrote to memory of 1620 924 tmp7168589.exe 34 PID 924 wrote to memory of 1620 924 tmp7168589.exe 34 PID 1292 wrote to memory of 516 1292 tmp7152957.exe 33 PID 1292 wrote to memory of 516 1292 tmp7152957.exe 33 PID 1292 wrote to memory of 516 1292 tmp7152957.exe 33 PID 1292 wrote to memory of 516 1292 tmp7152957.exe 33 PID 1620 wrote to memory of 1092 1620 tmp7172145.exe 35 PID 1620 wrote to memory of 1092 1620 tmp7172145.exe 35 PID 1620 wrote to memory of 1092 1620 tmp7172145.exe 35 PID 1620 wrote to memory of 1092 1620 tmp7172145.exe 35 PID 516 wrote to memory of 520 516 notpad.exe 36 PID 516 wrote to memory of 520 516 notpad.exe 36 PID 516 wrote to memory of 520 516 notpad.exe 36 PID 516 wrote to memory of 520 516 notpad.exe 36 PID 516 wrote to memory of 1924 516 notpad.exe 37 PID 516 wrote to memory of 1924 516 notpad.exe 37 PID 516 wrote to memory of 1924 516 notpad.exe 37 PID 516 wrote to memory of 1924 516 notpad.exe 37 PID 520 wrote to memory of 1668 520 tmp7190616.exe 38 PID 520 wrote to memory of 1668 520 tmp7190616.exe 38 PID 520 wrote to memory of 1668 520 tmp7190616.exe 38 PID 520 wrote to memory of 1668 520 tmp7190616.exe 38 PID 1668 wrote to memory of 1644 1668 notpad.exe 39 PID 1668 wrote to memory of 1644 1668 notpad.exe 39 PID 1668 wrote to memory of 1644 1668 notpad.exe 39 PID 1668 wrote to memory of 1644 1668 notpad.exe 39 PID 1644 wrote to memory of 584 1644 tmp7193642.exe 40 PID 1644 wrote to memory of 584 1644 tmp7193642.exe 40 PID 1644 wrote to memory of 584 1644 tmp7193642.exe 40 PID 1644 wrote to memory of 584 1644 tmp7193642.exe 40 PID 1668 wrote to memory of 1652 1668 notpad.exe 41 PID 1668 wrote to memory of 1652 1668 notpad.exe 41 PID 1668 wrote to memory of 1652 1668 notpad.exe 41 PID 1668 wrote to memory of 1652 1668 notpad.exe 41 PID 584 wrote to memory of 752 584 notpad.exe 46 PID 584 wrote to memory of 752 584 notpad.exe 46 PID 584 wrote to memory of 752 584 notpad.exe 46 PID 584 wrote to memory of 752 584 notpad.exe 46 PID 1652 wrote to memory of 984 1652 tmp7194906.exe 45 PID 1652 wrote to memory of 984 1652 tmp7194906.exe 45 PID 1652 wrote to memory of 984 1652 tmp7194906.exe 45 PID 1652 wrote to memory of 984 1652 tmp7194906.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe"C:\Users\Admin\AppData\Local\Temp\b0336076c54f1050148f7cdf3a1e3fe92ba4ee445c30272eac0540486a4d25ce.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\tmp7152957.exeC:\Users\Admin\AppData\Local\Temp\tmp7152957.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\tmp7190616.exeC:\Users\Admin\AppData\Local\Temp\tmp7190616.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\tmp7193642.exeC:\Users\Admin\AppData\Local\Temp\tmp7193642.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\tmp7195795.exeC:\Users\Admin\AppData\Local\Temp\tmp7195795.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\tmp7196762.exeC:\Users\Admin\AppData\Local\Temp\tmp7196762.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1096 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\tmp7198525.exeC:\Users\Admin\AppData\Local\Temp\tmp7198525.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\tmp7216762.exeC:\Users\Admin\AppData\Local\Temp\tmp7216762.exe12⤵
- Executes dropped EXE
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7246730.exeC:\Users\Admin\AppData\Local\Temp\tmp7246730.exe12⤵
- Executes dropped EXE
PID:1672
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7198026.exeC:\Users\Admin\AppData\Local\Temp\tmp7198026.exe9⤵
- Executes dropped EXE
PID:1108
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7195280.exeC:\Users\Admin\AppData\Local\Temp\tmp7195280.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7194906.exeC:\Users\Admin\AppData\Local\Temp\tmp7194906.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\tmp7196138.exeC:\Users\Admin\AppData\Local\Temp\tmp7196138.exe7⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7195639.exeC:\Users\Admin\AppData\Local\Temp\tmp7195639.exe7⤵
- Executes dropped EXE
PID:984
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7192800.exeC:\Users\Admin\AppData\Local\Temp\tmp7192800.exe4⤵
- Executes dropped EXE
PID:1924
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7156140.exeC:\Users\Admin\AppData\Local\Temp\tmp7156140.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\tmp7168308.exeC:\Users\Admin\AppData\Local\Temp\tmp7168308.exe3⤵
- Executes dropped EXE
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7168589.exeC:\Users\Admin\AppData\Local\Temp\tmp7168589.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\tmp7168994.exeC:\Users\Admin\AppData\Local\Temp\tmp7168994.exe4⤵
- Executes dropped EXE
PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7172145.exeC:\Users\Admin\AppData\Local\Temp\tmp7172145.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 365⤵
- Loads dropped DLL
- Program crash
PID:1092
-
-
-
-
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
PID:1976
-
C:\Users\Admin\AppData\Local\Temp\tmp7198338.exeC:\Users\Admin\AppData\Local\Temp\tmp7198338.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1136 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\tmp7216200.exeC:\Users\Admin\AppData\Local\Temp\tmp7216200.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\tmp7251347.exeC:\Users\Admin\AppData\Local\Temp\tmp7251347.exe5⤵
- Executes dropped EXE
PID:1560
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7251831.exeC:\Users\Admin\AppData\Local\Temp\tmp7251831.exe5⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\tmp7252299.exeC:\Users\Admin\AppData\Local\Temp\tmp7252299.exe6⤵
- Executes dropped EXE
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7252564.exeC:\Users\Admin\AppData\Local\Temp\tmp7252564.exe6⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\tmp7255622.exeC:\Users\Admin\AppData\Local\Temp\tmp7255622.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\tmp7256246.exeC:\Users\Admin\AppData\Local\Temp\tmp7256246.exe9⤵
- Drops file in System32 directory
- Modifies registry class
PID:828 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵PID:1960
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7255918.exeC:\Users\Admin\AppData\Local\Temp\tmp7255918.exe7⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\tmp7256090.exeC:\Users\Admin\AppData\Local\Temp\tmp7256090.exe8⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7256433.exeC:\Users\Admin\AppData\Local\Temp\tmp7256433.exe8⤵PID:696
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7244374.exeC:\Users\Admin\AppData\Local\Temp\tmp7244374.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\tmp7251316.exeC:\Users\Admin\AppData\Local\Temp\tmp7251316.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1256 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"5⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\tmp7252002.exeC:\Users\Admin\AppData\Local\Temp\tmp7252002.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"7⤵
- Executes dropped EXE
PID:288 -
C:\Users\Admin\AppData\Local\Temp\tmp7252658.exeC:\Users\Admin\AppData\Local\Temp\tmp7252658.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:752 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"9⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\tmp7253032.exeC:\Users\Admin\AppData\Local\Temp\tmp7253032.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1496 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"11⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\tmp7253828.exeC:\Users\Admin\AppData\Local\Temp\tmp7253828.exe12⤵
- Executes dropped EXE
PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7254218.exeC:\Users\Admin\AppData\Local\Temp\tmp7254218.exe12⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\tmp7255544.exeC:\Users\Admin\AppData\Local\Temp\tmp7255544.exe13⤵PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7254920.exeC:\Users\Admin\AppData\Local\Temp\tmp7254920.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1596
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7253718.exeC:\Users\Admin\AppData\Local\Temp\tmp7253718.exe10⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\tmp7254077.exeC:\Users\Admin\AppData\Local\Temp\tmp7254077.exe11⤵
- Executes dropped EXE
PID:880
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7254452.exeC:\Users\Admin\AppData\Local\Temp\tmp7254452.exe11⤵
- Executes dropped EXE
PID:1380
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7252892.exeC:\Users\Admin\AppData\Local\Temp\tmp7252892.exe8⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\tmp7253453.exeC:\Users\Admin\AppData\Local\Temp\tmp7253453.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:580 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\tmp7253968.exeC:\Users\Admin\AppData\Local\Temp\tmp7253968.exe11⤵
- Executes dropped EXE
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7254374.exeC:\Users\Admin\AppData\Local\Temp\tmp7254374.exe11⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\tmp7254670.exeC:\Users\Admin\AppData\Local\Temp\tmp7254670.exe12⤵PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7255778.exeC:\Users\Admin\AppData\Local\Temp\tmp7255778.exe12⤵PID:1696
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7253859.exeC:\Users\Admin\AppData\Local\Temp\tmp7253859.exe9⤵
- Executes dropped EXE
PID:2028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7252424.exeC:\Users\Admin\AppData\Local\Temp\tmp7252424.exe6⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\tmp7252845.exeC:\Users\Admin\AppData\Local\Temp\tmp7252845.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1268 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\tmp7253469.exeC:\Users\Admin\AppData\Local\Temp\tmp7253469.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1716 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\tmp7254576.exeC:\Users\Admin\AppData\Local\Temp\tmp7254576.exe11⤵
- Executes dropped EXE
PID:1140
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7255403.exeC:\Users\Admin\AppData\Local\Temp\tmp7255403.exe11⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\tmp7256027.exeC:\Users\Admin\AppData\Local\Temp\tmp7256027.exe12⤵PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7256480.exeC:\Users\Admin\AppData\Local\Temp\tmp7256480.exe12⤵PID:1716
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7254046.exeC:\Users\Admin\AppData\Local\Temp\tmp7254046.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\tmp7254545.exeC:\Users\Admin\AppData\Local\Temp\tmp7254545.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:876 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"11⤵
- Executes dropped EXE
PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7255263.exeC:\Users\Admin\AppData\Local\Temp\tmp7255263.exe10⤵
- Executes dropped EXE
PID:800
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7253188.exeC:\Users\Admin\AppData\Local\Temp\tmp7253188.exe7⤵
- Executes dropped EXE
PID:1936
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7251784.exeC:\Users\Admin\AppData\Local\Temp\tmp7251784.exe4⤵PID:1380
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7255856.exeC:\Users\Admin\AppData\Local\Temp\tmp7255856.exe1⤵
- Drops file in System32 directory
- Modifies registry class
PID:868 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\tmp7256339.exeC:\Users\Admin\AppData\Local\Temp\tmp7256339.exe3⤵PID:756
-
-
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\tmp7256168.exeC:\Users\Admin\AppData\Local\Temp\tmp7256168.exe2⤵PID:1976
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
6.2MB
MD5d84faf8eadbcb5917f266b37cbaf6339
SHA1f38496215d7cefb3083a10402888ab498e4944cb
SHA25649dc009563e1764895ad25d96afac11a3078e9ddaf8692641da2e365c5aac779
SHA512cec1df9959aa3ec6dcc352a37c9f6000ac50740045dbf55f9f5a5173fb29710a806a302b42ef7c2ba4c6932eafce3ed9b37cc5ef4a53cb5c5fc50d87f235c50f
-
Filesize
6.2MB
MD5d84faf8eadbcb5917f266b37cbaf6339
SHA1f38496215d7cefb3083a10402888ab498e4944cb
SHA25649dc009563e1764895ad25d96afac11a3078e9ddaf8692641da2e365c5aac779
SHA512cec1df9959aa3ec6dcc352a37c9f6000ac50740045dbf55f9f5a5173fb29710a806a302b42ef7c2ba4c6932eafce3ed9b37cc5ef4a53cb5c5fc50d87f235c50f
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.2MB
MD536638b3fa10c9b78b3b361fb39d470f4
SHA18d8d0d37ce3b920671be7a74c787e26d5c12f940
SHA25623f1efbb2baa676425c715a409f0271ff28a8f520e4195549602aa4db4483c2e
SHA5120b0c3b0fce6e741d22bba6ee96395d8a349b75a47fd7722cfa8cdcbeece44840829ad5bc8bd67502c616dfa0a5986e48b787c684717a34a7828647087d22a20c
-
Filesize
3.2MB
MD536638b3fa10c9b78b3b361fb39d470f4
SHA18d8d0d37ce3b920671be7a74c787e26d5c12f940
SHA25623f1efbb2baa676425c715a409f0271ff28a8f520e4195549602aa4db4483c2e
SHA5120b0c3b0fce6e741d22bba6ee96395d8a349b75a47fd7722cfa8cdcbeece44840829ad5bc8bd67502c616dfa0a5986e48b787c684717a34a7828647087d22a20c
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
136KB
MD59aeb06a81883647698958706907b1c8b
SHA11ed819748dd1683826910789ce3c0e331ab636b9
SHA2562739d7b4fc7ec6f5ccbed17d4c9f57c8905147bdc926a1995e1f9c4f258d55cc
SHA512d388602a1e322789dda56df6776d570972acce420e45044699f7178115f8c20f32f9723a63657c58771df3ef54afa3193e817679b91cc24fe80d94c78ad09bbe
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
175KB
MD5d378bffb70923139d6a4f546864aa61c
SHA1f00aa51c2ed8b2f656318fdc01ee1cf5441011a4
SHA256c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102
SHA5127c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
175KB
MD5d378bffb70923139d6a4f546864aa61c
SHA1f00aa51c2ed8b2f656318fdc01ee1cf5441011a4
SHA256c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102
SHA5127c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663
-
Filesize
3.0MB
MD56464d52b2070f48c21e68ca8805f66a4
SHA1252635dabdc882a5fb5862cb8babb4eb8f745cd2
SHA256965d01aadab2dbedbeb9dcb33fefe21389628264678efbd46105c52749845db6
SHA5125995a1a980b6ed9a7d89b55ca3aba519765db8c2b38b27a66337d7482d7c277b7764ed554ac69847aab19a737b0c9f2a5ad82f9ebeca6d2dd71e556174c15dae
-
Filesize
3.0MB
MD579662e058f47e962c795005c9e4c7d36
SHA1b3d66934e9ed011f0bedf92d37ddef8fd203d6b2
SHA256c9a0fe9ca36408f176af39f6c63ba0d8375f38a75d167adc0d47cc0fdb0e31f4
SHA512b445114366ed0ab11ebc81c80e8d87eafeb41f402fbd62599e10ea178ac22654bb5440e8037689d39c36cd53c927e6b8c0e141aa24eba92e21665a6fea5489c4
-
Filesize
3.0MB
MD5553f5f76ffa8045972efbdf555e42ad1
SHA16b58e67c72d6e29e8858395b69302e8b1a2c68ec
SHA256eec000c0895b207ca0c341147ccf21c793915b300bf488f23732af95eb4f86dd
SHA512482876b120ecb690252f7aef245be189249054ca441f36cf605a4d808a4550825db7a55286764c55bf9a62ffb62c8346917873c68030c9174a2a4829c65137c0
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
6.2MB
MD5d84faf8eadbcb5917f266b37cbaf6339
SHA1f38496215d7cefb3083a10402888ab498e4944cb
SHA25649dc009563e1764895ad25d96afac11a3078e9ddaf8692641da2e365c5aac779
SHA512cec1df9959aa3ec6dcc352a37c9f6000ac50740045dbf55f9f5a5173fb29710a806a302b42ef7c2ba4c6932eafce3ed9b37cc5ef4a53cb5c5fc50d87f235c50f
-
Filesize
6.2MB
MD5d84faf8eadbcb5917f266b37cbaf6339
SHA1f38496215d7cefb3083a10402888ab498e4944cb
SHA25649dc009563e1764895ad25d96afac11a3078e9ddaf8692641da2e365c5aac779
SHA512cec1df9959aa3ec6dcc352a37c9f6000ac50740045dbf55f9f5a5173fb29710a806a302b42ef7c2ba4c6932eafce3ed9b37cc5ef4a53cb5c5fc50d87f235c50f
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.2MB
MD536638b3fa10c9b78b3b361fb39d470f4
SHA18d8d0d37ce3b920671be7a74c787e26d5c12f940
SHA25623f1efbb2baa676425c715a409f0271ff28a8f520e4195549602aa4db4483c2e
SHA5120b0c3b0fce6e741d22bba6ee96395d8a349b75a47fd7722cfa8cdcbeece44840829ad5bc8bd67502c616dfa0a5986e48b787c684717a34a7828647087d22a20c
-
Filesize
3.2MB
MD536638b3fa10c9b78b3b361fb39d470f4
SHA18d8d0d37ce3b920671be7a74c787e26d5c12f940
SHA25623f1efbb2baa676425c715a409f0271ff28a8f520e4195549602aa4db4483c2e
SHA5120b0c3b0fce6e741d22bba6ee96395d8a349b75a47fd7722cfa8cdcbeece44840829ad5bc8bd67502c616dfa0a5986e48b787c684717a34a7828647087d22a20c
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
136KB
MD59aeb06a81883647698958706907b1c8b
SHA11ed819748dd1683826910789ce3c0e331ab636b9
SHA2562739d7b4fc7ec6f5ccbed17d4c9f57c8905147bdc926a1995e1f9c4f258d55cc
SHA512d388602a1e322789dda56df6776d570972acce420e45044699f7178115f8c20f32f9723a63657c58771df3ef54afa3193e817679b91cc24fe80d94c78ad09bbe
-
Filesize
136KB
MD59aeb06a81883647698958706907b1c8b
SHA11ed819748dd1683826910789ce3c0e331ab636b9
SHA2562739d7b4fc7ec6f5ccbed17d4c9f57c8905147bdc926a1995e1f9c4f258d55cc
SHA512d388602a1e322789dda56df6776d570972acce420e45044699f7178115f8c20f32f9723a63657c58771df3ef54afa3193e817679b91cc24fe80d94c78ad09bbe
-
Filesize
136KB
MD59aeb06a81883647698958706907b1c8b
SHA11ed819748dd1683826910789ce3c0e331ab636b9
SHA2562739d7b4fc7ec6f5ccbed17d4c9f57c8905147bdc926a1995e1f9c4f258d55cc
SHA512d388602a1e322789dda56df6776d570972acce420e45044699f7178115f8c20f32f9723a63657c58771df3ef54afa3193e817679b91cc24fe80d94c78ad09bbe
-
Filesize
136KB
MD59aeb06a81883647698958706907b1c8b
SHA11ed819748dd1683826910789ce3c0e331ab636b9
SHA2562739d7b4fc7ec6f5ccbed17d4c9f57c8905147bdc926a1995e1f9c4f258d55cc
SHA512d388602a1e322789dda56df6776d570972acce420e45044699f7178115f8c20f32f9723a63657c58771df3ef54afa3193e817679b91cc24fe80d94c78ad09bbe
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
175KB
MD5d378bffb70923139d6a4f546864aa61c
SHA1f00aa51c2ed8b2f656318fdc01ee1cf5441011a4
SHA256c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102
SHA5127c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
3.0MB
MD507f57eec4a6fc1a33c6637e3e6fad77c
SHA120708b1e6c5c37613169473ee3353c95893210a3
SHA256ade264bf24d9e797940a518241fb801f48fbd7b1bf36204da16bcffbc624b0a9
SHA5124c082c8cff59df232fdef28e12e25cd7dc205ed7daf097d6820914def4eb96482a9099e32de30ee193fb31e699fbcd9ab54f045c6602e999e8ae5626f83c92cd
-
Filesize
175KB
MD5d378bffb70923139d6a4f546864aa61c
SHA1f00aa51c2ed8b2f656318fdc01ee1cf5441011a4
SHA256c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102
SHA5127c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
3.2MB
MD54da493670c656b12966fb517e675e069
SHA18a8965c7bed95e8fa42b889f13ca588b83fa95c4
SHA25619ae5cc1d45525e8568c240b74ea045c6e677df9d0e2ba97ece47c044b045a14
SHA51238478346394a0b548e305827818b01f6805af6c34fa3d0a76bbc2fe467090015812faf7f64c7b0028f99f673d43f938b6f9c5c61dba064a3a3c7ea99d6777709
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9
-
Filesize
6.2MB
MD54a1f7906bda98068284deeb4cfaed538
SHA193e196e17af2f898e31e109b3726e4f524d88fe4
SHA256ab15da6b8e0978e62dd72ed5c1f3e15057f6b302ef4323e87d7bc828dce58916
SHA512d6bde40ba75ea401364c33b6f2af3ea4a22bd69d8161fd5b8c7eb9a7e19bedfaec86335bdd305b1cf927e0c4b417d5cf2a98e021fa32e1e73c3794cecc030ef9