Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe
Resource
win10v2004-20220812-en
General
-
Target
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe
-
Size
26KB
-
MD5
3a8ee9a41b0259d5301dedf16aa97da2
-
SHA1
28dd02497be450521e16ae772e99e3399835542d
-
SHA256
99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05
-
SHA512
bf4ec4c0d39e4bfd451c887bc7734441900568f34141ec3e92de644077acf5696411c966a2339ee67799d80248170530e2c62d47b94f985b3a6802691d953a4f
-
SSDEEP
384:1M3PnQoHDCpHf4I4Qwdc0G5KDJgSxKYDvHv9TmjX2d:1m/QojCpHfx0gSxTlWX2d
Malware Config
Signatures
-
Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\Msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe File opened for modification C:\Windows\SysWOW64\drivers\winlogon.exe winlogon.exe File created C:\Windows\SysWOW64\drivers\Msvbvm60.dll winlogon.exe -
Executes dropped EXE 4 IoCs
pid Process 2108 winlogon.exe 3148 AE 0124 BE.exe 4240 winlogon.exe 4836 winlogon.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation AE 0124 BE.exe -
Loads dropped DLL 3 IoCs
pid Process 3148 AE 0124 BE.exe 4240 winlogon.exe 4836 winlogon.exe -
Drops desktop.ini file(s) 24 IoCs
description ioc Process File opened for modification C:\Windows\Offline Web Pages\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\Fonts\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\Media\Desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini AE 0124 BE.exe -
Drops autorun.inf file 1 TTPs 27 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\T:\Autorun.inf winlogon.exe File opened for modification \??\Z:\Autorun.inf winlogon.exe File opened for modification \??\L:\Autorun.inf winlogon.exe File opened for modification \??\Q:\Autorun.inf winlogon.exe File opened for modification C:\Autorun.inf winlogon.exe File opened for modification \??\E:\Autorun.inf winlogon.exe File opened for modification \??\G:\Autorun.inf winlogon.exe File opened for modification \??\O:\Autorun.inf winlogon.exe File opened for modification \??\P:\Autorun.inf winlogon.exe File opened for modification \??\W:\Autorun.inf winlogon.exe File opened for modification \??\J:\Autorun.inf winlogon.exe File opened for modification \??\M:\Autorun.inf winlogon.exe File opened for modification \??\N:\Autorun.inf winlogon.exe File opened for modification \??\X:\Autorun.inf winlogon.exe File opened for modification \??\V:\Autorun.inf winlogon.exe File opened for modification \??\Y:\Autorun.inf winlogon.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf AE 0124 BE.exe File opened for modification \??\F:\Autorun.inf winlogon.exe File opened for modification \??\I:\Autorun.inf winlogon.exe File opened for modification \??\U:\Autorun.inf winlogon.exe File opened for modification \??\R:\Autorun.inf winlogon.exe File opened for modification \??\S:\Autorun.inf winlogon.exe File opened for modification \??\A:\Autorun.inf winlogon.exe File opened for modification D:\Autorun.inf winlogon.exe File opened for modification \??\H:\Autorun.inf winlogon.exe File opened for modification \??\B:\Autorun.inf winlogon.exe File opened for modification \??\K:\Autorun.inf winlogon.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe AE 0124 BE.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\fr-FR\bootfix.bin AE 0124 BE.exe File opened for modification C:\Windows\INF\mdmmot64.inf AE 0124 BE.exe File opened for modification C:\Windows\INF\uaspstor.PNF AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals.resources\v4.0_4.0.0.0_de_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\default.aspx AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\es\SqlWorkflowInstanceStoreLogic.sql AE 0124 BE.exe File opened for modification C:\Windows\PolicyDefinitions\MicrosoftEdge.admx AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Word.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc# AE 0124 BE.exe File opened for modification C:\Windows\Boot\EFI\pl-PL\bootmgr.efi.mui AE 0124 BE.exe File opened for modification C:\Windows\diagnostics\system\Printer\TS_PrinterDriver.ps1 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\0411\mscorsecr.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Security.Resources\2.0.0.0_es_b03f5f7f11d50a3a\System.Security.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20220812.191113.336.2.etl AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_de_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Primitives.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Net.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Basic~ba-ru~1.0.mum AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regbrowsers.resources AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\SqlPersistenceService_Schema.sql AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\Microsoft.JScript.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.Resources\2.0.0.0_ja_b77a5c561934e089\System.Runtime.Remoting.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.Resources\3.0.0.0_fr_31bf3856ad364e35\UIAutomationTypes.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\diagnostics\system\IESecurity\de-DE AE 0124 BE.exe File opened for modification C:\Windows\Fonts\app857.fon AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.fr.resx AE 0124 BE.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Memory.xml AE 0124 BE.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Compute-Storage-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.mum AE 0124 BE.exe File opened for modification C:\Windows\PolicyDefinitions\it-IT\Bits.adml AE 0124 BE.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows Sidebar\Gadgets AE 0124 BE.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Feature-VirtualMachinePlatform-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat AE 0124 BE.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\wide.Contact.png AE 0124 BE.exe File opened for modification C:\Windows\INF\ServiceModelOperation 3.0.0.0 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.ServiceModel.Channels.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\INF\wgencounter.inf AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\1041\alinkui.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.ServiceProcess.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe.config AE 0124 BE.exe File opened for modification C:\Windows\PolicyDefinitions\fr-FR\Setup.adml AE 0124 BE.exe File opened for modification C:\Windows\PolicyDefinitions\it-IT\WindowsProducts.adml AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\msbuild.exe.config AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\Browsers\opera.browser AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\normnfc.nlp AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Web.Services.Resources.dll AE 0124 BE.exe File opened for modification C:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf AE 0124 BE.exe File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini AE 0124 BE.exe File opened for modification C:\Windows\INF\wvid.PNF AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Dtc.PowerShell.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Queryable\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Linq.Queryable.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Net.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Device.resources.dll AE 0124 BE.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\df2df1942cb2ba4282e50ac095a7b932\System.Runtime.Remoting.ni.dll.aux AE 0124 BE.exe File opened for modification C:\Windows\INF\ESENT\0000 AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.comments AE 0124 BE.exe File opened for modification C:\Windows\diagnostics\system\Audio\DiagPackage.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regbrowsers.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\CvtResUI.dll AE 0124 BE.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe.config AE 0124 BE.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-976DB280.pf AE 0124 BE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ AE 0124 BE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5048 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe 2108 winlogon.exe 3148 AE 0124 BE.exe 4240 winlogon.exe 4836 winlogon.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5048 wrote to memory of 2108 5048 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe 80 PID 5048 wrote to memory of 2108 5048 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe 80 PID 5048 wrote to memory of 2108 5048 99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe 80 PID 2108 wrote to memory of 3148 2108 winlogon.exe 81 PID 2108 wrote to memory of 3148 2108 winlogon.exe 81 PID 2108 wrote to memory of 3148 2108 winlogon.exe 81 PID 2108 wrote to memory of 4240 2108 winlogon.exe 82 PID 2108 wrote to memory of 4240 2108 winlogon.exe 82 PID 2108 wrote to memory of 4240 2108 winlogon.exe 82 PID 3148 wrote to memory of 4836 3148 AE 0124 BE.exe 83 PID 3148 wrote to memory of 4836 3148 AE 0124 BE.exe 83 PID 3148 wrote to memory of 4836 3148 AE 0124 BE.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe"C:\Users\Admin\AppData\Local\Temp\99a14714902ad890ae06b199dffb5abb790c746da254b126ddb2323a132aaf05.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Drops autorun.inf file
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\AE 0124 BE.exe"C:\Windows\AE 0124 BE.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4836
-
-
-
C:\Windows\SysWOW64\drivers\winlogon.exe"C:\Windows\System32\drivers\winlogon.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4240
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD595f3aaef82d221904b2027425d996b62
SHA1a94509c7be084c4f8b6aef50a77a646be1517c73
SHA256c5e8cdac0cf7bd88e49de51f0ae641c424466f187e84065f655b44a6b3c08b35
SHA512b99cbe4631bd36757f682808a2325a8f34093ceb7e57c9e9839068448caf11fb7e20ac74b31c4bb405f50c7bf616e9030d1b2cb8ea7b4ff06db03ca433769da0
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
1.4MB
MD525f62c02619174b35851b0e0455b3d94
SHA14e8ee85157f1769f6e3f61c0acbe59072209da71
SHA256898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
SHA512f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
40KB
MD50da770c334ebd98c1c7d2603a026812f
SHA1b8c031251ae5c07ed5ab49acbb607244f6a6acf2
SHA2563ef9825cb96362826fafd520ff64793da6468f1ff1d72970ee6f96ba23a393d2
SHA5127fedfee445fbdeb8a7563151d1c15580b47fe232ee89ae9b08b562ca054df681b432d1391f931c0048e94071b4509dde53dbc9155296d13a969c1c06e70eceb8
-
Filesize
25B
MD5589b6886a49054d03b739309a1de9fcc
SHA10ec1dff7a03f13dea28eea5e754d5b0e5e1dc308
SHA256564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
SHA5124b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb
-
Filesize
25B
MD5589b6886a49054d03b739309a1de9fcc
SHA10ec1dff7a03f13dea28eea5e754d5b0e5e1dc308
SHA256564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
SHA5124b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb