Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
249s -
max time network
285s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe
Resource
win10v2004-20221111-en
General
-
Target
bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe
-
Size
8.6MB
-
MD5
551f83e52d985497f7601601d95b85bd
-
SHA1
1303d690f2089a91f5669e094ea2562e101e3b69
-
SHA256
bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
-
SHA512
6b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
SSDEEP
98304:J/tgS++cwcaS+/t3S++cwcaS+/tJS++cwcaS+/tcS++cwcaS+/t/tRcwcaS+/tBq:nJAiFVF6JAiFVs6JAiFV
Malware Config
Signatures
-
Executes dropped EXE 15 IoCs
pid Process 1568 notpad.exe 1476 tmp240734531.exe 3124 tmp240735062.exe 1776 notpad.exe 4292 tmp240737609.exe 4048 tmp240738593.exe 2232 tmp240739312.exe 4280 tmp240791625.exe 1040 notpad.exe 4852 tmp240792875.exe 4172 tmp240793187.exe 3352 tmp240793421.exe 1456 tmp240793921.exe 3192 tmp240820437.exe 4388 tmp240820593.exe -
resource yara_rule behavioral2/files/0x000800000002317f-133.dat upx behavioral2/files/0x000800000002317f-134.dat upx behavioral2/memory/1568-135-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000700000002317a-139.dat upx behavioral2/memory/1568-143-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00070000000231b3-145.dat upx behavioral2/files/0x00070000000231b3-146.dat upx behavioral2/files/0x000700000002317a-151.dat upx behavioral2/memory/1776-147-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1776-156-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00080000000231b9-155.dat upx behavioral2/files/0x00080000000231b9-154.dat upx behavioral2/memory/4048-157-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4048-163-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00080000000231b3-165.dat upx behavioral2/files/0x00080000000231b3-166.dat upx behavioral2/files/0x000700000002317a-170.dat upx behavioral2/files/0x00070000000231c8-174.dat upx behavioral2/memory/1040-175-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x00070000000231c8-173.dat upx behavioral2/memory/4172-177-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4172-180-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0008000000023182-183.dat upx behavioral2/files/0x0008000000023182-182.dat upx behavioral2/memory/4172-184-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1456-191-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1456-185-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation tmp240734531.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation tmp240737609.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240737609.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240737609.exe File created C:\Windows\SysWOW64\notpad.exe tmp240737609.exe File created C:\Windows\SysWOW64\notpad.exe tmp240792875.exe File created C:\Windows\SysWOW64\fsb.tmp bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe File created C:\Windows\SysWOW64\notpad.exe- bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe File created C:\Windows\SysWOW64\notpad.exe tmp240734531.exe File created C:\Windows\SysWOW64\notpad.exe bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240734531.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240792875.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240792875.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240792875.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240734531.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240737609.exe File created C:\Windows\SysWOW64\fsb.stb bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240734531.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240734531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240737609.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240792875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1568 2444 bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe 83 PID 2444 wrote to memory of 1568 2444 bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe 83 PID 2444 wrote to memory of 1568 2444 bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe 83 PID 1568 wrote to memory of 1476 1568 notpad.exe 84 PID 1568 wrote to memory of 1476 1568 notpad.exe 84 PID 1568 wrote to memory of 1476 1568 notpad.exe 84 PID 1568 wrote to memory of 3124 1568 notpad.exe 85 PID 1568 wrote to memory of 3124 1568 notpad.exe 85 PID 1568 wrote to memory of 3124 1568 notpad.exe 85 PID 1476 wrote to memory of 1776 1476 tmp240734531.exe 87 PID 1476 wrote to memory of 1776 1476 tmp240734531.exe 87 PID 1476 wrote to memory of 1776 1476 tmp240734531.exe 87 PID 1776 wrote to memory of 4292 1776 notpad.exe 88 PID 1776 wrote to memory of 4292 1776 notpad.exe 88 PID 1776 wrote to memory of 4292 1776 notpad.exe 88 PID 1776 wrote to memory of 4048 1776 notpad.exe 89 PID 1776 wrote to memory of 4048 1776 notpad.exe 89 PID 1776 wrote to memory of 4048 1776 notpad.exe 89 PID 4048 wrote to memory of 2232 4048 tmp240738593.exe 90 PID 4048 wrote to memory of 2232 4048 tmp240738593.exe 90 PID 4048 wrote to memory of 2232 4048 tmp240738593.exe 90 PID 4048 wrote to memory of 4280 4048 tmp240738593.exe 91 PID 4048 wrote to memory of 4280 4048 tmp240738593.exe 91 PID 4048 wrote to memory of 4280 4048 tmp240738593.exe 91 PID 4292 wrote to memory of 1040 4292 tmp240737609.exe 92 PID 4292 wrote to memory of 1040 4292 tmp240737609.exe 92 PID 4292 wrote to memory of 1040 4292 tmp240737609.exe 92 PID 1040 wrote to memory of 4852 1040 notpad.exe 93 PID 1040 wrote to memory of 4852 1040 notpad.exe 93 PID 1040 wrote to memory of 4852 1040 notpad.exe 93 PID 1040 wrote to memory of 4172 1040 notpad.exe 94 PID 1040 wrote to memory of 4172 1040 notpad.exe 94 PID 1040 wrote to memory of 4172 1040 notpad.exe 94 PID 4172 wrote to memory of 3352 4172 tmp240793187.exe 95 PID 4172 wrote to memory of 3352 4172 tmp240793187.exe 95 PID 4172 wrote to memory of 3352 4172 tmp240793187.exe 95 PID 4172 wrote to memory of 1456 4172 tmp240793187.exe 96 PID 4172 wrote to memory of 1456 4172 tmp240793187.exe 96 PID 4172 wrote to memory of 1456 4172 tmp240793187.exe 96 PID 1456 wrote to memory of 3192 1456 tmp240793921.exe 97 PID 1456 wrote to memory of 3192 1456 tmp240793921.exe 97 PID 1456 wrote to memory of 3192 1456 tmp240793921.exe 97 PID 1456 wrote to memory of 4388 1456 tmp240793921.exe 98 PID 1456 wrote to memory of 4388 1456 tmp240793921.exe 98 PID 1456 wrote to memory of 4388 1456 tmp240793921.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe"C:\Users\Admin\AppData\Local\Temp\bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\tmp240734531.exeC:\Users\Admin\AppData\Local\Temp\tmp240734531.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\tmp240737609.exeC:\Users\Admin\AppData\Local\Temp\tmp240737609.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\tmp240792875.exeC:\Users\Admin\AppData\Local\Temp\tmp240792875.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240793187.exeC:\Users\Admin\AppData\Local\Temp\tmp240793187.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\tmp240793421.exeC:\Users\Admin\AppData\Local\Temp\tmp240793421.exe8⤵
- Executes dropped EXE
PID:3352
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240793921.exeC:\Users\Admin\AppData\Local\Temp\tmp240793921.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\tmp240820437.exeC:\Users\Admin\AppData\Local\Temp\tmp240820437.exe9⤵
- Executes dropped EXE
PID:3192
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240820593.exeC:\Users\Admin\AppData\Local\Temp\tmp240820593.exe9⤵
- Executes dropped EXE
PID:4388
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240738593.exeC:\Users\Admin\AppData\Local\Temp\tmp240738593.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\tmp240739312.exeC:\Users\Admin\AppData\Local\Temp\tmp240739312.exe6⤵
- Executes dropped EXE
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240791625.exeC:\Users\Admin\AppData\Local\Temp\tmp240791625.exe6⤵
- Executes dropped EXE
PID:4280
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240735062.exeC:\Users\Admin\AppData\Local\Temp\tmp240735062.exe3⤵
- Executes dropped EXE
PID:3124
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
162KB
MD5e92d3a824a0578a50d2dd81b5060145f
SHA150ef7c645fd5cbb95d50fbaddf6213800f9296ec
SHA25687f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661
SHA51240d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
162KB
MD5e92d3a824a0578a50d2dd81b5060145f
SHA150ef7c645fd5cbb95d50fbaddf6213800f9296ec
SHA25687f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661
SHA51240d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
17.5MB
MD541486a32b10b383a6843dc728a556c55
SHA12a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c
SHA256428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237
SHA512bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6
-
Filesize
17.5MB
MD541486a32b10b383a6843dc728a556c55
SHA12a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c
SHA256428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237
SHA512bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
162KB
MD5e92d3a824a0578a50d2dd81b5060145f
SHA150ef7c645fd5cbb95d50fbaddf6213800f9296ec
SHA25687f53bc444c05230ce439dbb127c03f2e374067d6fb08e91c834371fd9ecf661
SHA51240d0ac6fa5a424b099923fcdb465e9a2f44569af1c75cf05323315a8720517316a7e8627be248cff3a83382fb6db1cf026161f627a39bc1908e63f67a34c0fd5
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
10KB
MD5280b12e4717c3a7cf2c39561b30bc9e6
SHA18bf777a28c25793357ce8305bf8b01987bc4d9f2
SHA256f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc
SHA512861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
8.6MB
MD5551f83e52d985497f7601601d95b85bd
SHA11303d690f2089a91f5669e094ea2562e101e3b69
SHA256bfeac5cd6f52cad74b210ee3af12bda832efff686ae68dc84fa722b8b957b6ce
SHA5126b4a24955e9ac3b13c0c0aa8587b3e3559342000f064149c3216c8eb9219d7e763aacddb2448aa7ce2071ac0c92a7bb127b710fff883426358ef18429078a9b2
-
Filesize
17.5MB
MD541486a32b10b383a6843dc728a556c55
SHA12a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c
SHA256428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237
SHA512bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6
-
Filesize
17.5MB
MD541486a32b10b383a6843dc728a556c55
SHA12a567ffb7f6d0c9ba6b85ee86b71f176acce4a3c
SHA256428816fcd1dc36b389441b686f0b2c27f97555d13b0940def5bdc6f390e8d237
SHA512bcd68380d3335eb8413d3ed3fd104e51d4d421f38b8648c1d04a679e1b5d64e918e7545fa362902b52d27698a42fe6e640319f356ca428b1f3b0275160d37ec6
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
8.8MB
MD550745b00ff2b3c0e60b015756c5987c4
SHA15899d28c3c20dd2cde98aabed45ba796a2994f23
SHA256e9c2c25a8ad667028d7e833924ced44e656a95c26967411ec9c843dd4ea6dae1
SHA51287370acacb0e93833c381efb2b27fcd44de6bffda8d413eb7754a4a085c6ca0e64ecd6fc0d572d19e6f365d031fd144365b8725ad7564389beb1f53e255a9b2f
-
Filesize
26.1MB
MD5a8b967c7a389d5a61db8c935f19c1a8c
SHA16ba3a98c38564bc9d499506493aeacf5853bf2e3
SHA25610ed8841a1ab69f48b0dbcbb92ba2d392964ce6c9cef78cb3807728792fbfe7a
SHA512d2a2907f5584992558eb31d89a692216695940bd4473b4249e99b94c1a55d3e63a566da1d1739fdb0c6172790331cfd318e7cecaa80a03aff4db23a7be4297e4
-
Filesize
26.1MB
MD5a8b967c7a389d5a61db8c935f19c1a8c
SHA16ba3a98c38564bc9d499506493aeacf5853bf2e3
SHA25610ed8841a1ab69f48b0dbcbb92ba2d392964ce6c9cef78cb3807728792fbfe7a
SHA512d2a2907f5584992558eb31d89a692216695940bd4473b4249e99b94c1a55d3e63a566da1d1739fdb0c6172790331cfd318e7cecaa80a03aff4db23a7be4297e4